If the 29 July deadline has passed and your agency still isn’t enrolled, the most important thing to understand is this: there’s no grace period, and waiting for a better moment doesn’t exist as an option. Enrol today. Then deal with everything else in the order below.
This isn’t the article to read if you’re looking for a way to make the missed deadline disappear. It doesn’t disappear. But how you respond from here genuinely matters, and there’s a real difference between an agency that catches up properly starting now and one that keeps putting it off.
What missing the deadline actually means
Late enrolment isn’t a technicality — it’s a contravention of the AML/CTF Act in its own right, separate from whatever obligations you were also meant to be meeting from 1 July. AUSTRAC has been explicit that it will take action against businesses operating without enrolling, and the civil penalty structure is designed to accrue for every day the breach continues, not to apply once as a flat fine.
There’s no mechanism to backdate an enrolment or quietly bring it into line without it being visible that it happened late. AUSTRAC’s own systems record when you submitted, not when you meant to.
That’s the uncomfortable part. Here’s the part that’s actually useful.
What genuinely helps from this point
Enrol immediately, today, before you do anything else. Every day you’re not enrolled is a day the exposure continues to accrue. There is no version of this where waiting another week to “get everything else sorted first” makes your position better. Enrol, then build.
Keep a clear record of when you realised, and what you did next. Regulators — AUSTRAC included — consistently draw a real distinction between businesses making a genuine, timely effort to comply once a gap is identified, and businesses that keep ignoring the regime altogether. That distinction can’t help you if there’s no evidence of it. From today, document what you’re doing and when.
Don’t try to make it look like you were compliant all along. Backdated policies, training records with fabricated dates, or a risk assessment dressed up to look older than it is will make your position dramatically worse if it’s ever examined closely. An honest gap, being actively closed, is a defensible position. A fabricated paper trail is not — and it converts an administrative breach into a much more serious integrity problem.
Build the actual program now, properly, rather than a rushed version to look busy. A thin, genuine program that reflects how your agency actually operates is worth more than a comprehensive-looking one assembled in a weekend from a downloaded template. If you haven’t already, our piece on the first 30 days as a reporting entity sets out the build order AUSTRAC itself recommends — governance first, then risk assessment, then policies and CDD, with independent review scheduled rather than rushed.
If AUSTRAC contacts you before you’ve caught up
If you receive any correspondence from AUSTRAC — a request for information, a notice, anything — respond to it. Don’t let it sit unanswered while you scramble to get compliant first. Ignoring regulatory correspondence while you quietly try to fix things in the background is one of the more common ways a recoverable situation turns into a genuinely serious one. Answer honestly, be specific about what’s in place and what’s still being built, and get advice before you respond if the correspondence suggests it’s a formal inquiry rather than a routine check-in.
What this doesn’t mean
Missing the deadline doesn’t mean your agency is now assumed to be a money laundering risk, and it doesn’t mean every transaction you’ve handled since 1 July is automatically under scrutiny. AUSTRAC’s regime is designed around risk and proportionality — a small agency that enrols three weeks late and gets a genuine program running is in a fundamentally different position to one that ignores the regime for a year. Don’t let panic drive decisions that a calm, structured catch-up would handle better.
Your priority order, starting today
- Enrol. Not tomorrow, not once the risk assessment is drafted — today.
- Nominate your AML/CTF Compliance Officer, even as an interim appointment if you haven’t settled it permanently.
- Start your risk assessment, because every other document depends on it.
- Get customer due diligence live on current transactions. You can’t fix the past, but you can make sure right now is handled properly.
- Get staff trained, with evidence, starting immediately.
- Keep a running record of what you’ve done and when, from today onward.
None of this undoes a late enrolment. All of it materially changes what your agency’s position looks like from here.
Where to get moving today
Lead Comply’s free account includes full customer due diligence workflow and seven AML/CTF training modules for your whole team — no cost, no credit card, and it’s ready the moment you sign up. If you want a clear, honest picture of exactly where your agency stands and what needs to happen first, our free 30-minute Compliance Gap Audit is built for precisely this situation — agencies that are behind and need a straight answer on what to prioritise, not another generic checklist.
