Bright Law | searchable regulatory information for Australian financial service providers

AML/CTF April 2026 final consolidated Act and Rules update

David Jacobson — Wed, 08 Apr 2026 07:54:37 +0000

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 as amended by the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 commenced in relation to current reporting entities on 31 March 2026.

The Act will apply to Tranche 2 entities from 1 July 2026.

A consolidated version is available here.

Background.

Anti-Money Laundering and Counter-Terrorism Financing (Proliferation Financing) Regulations 2026 also commenced on 31 March 2026.

Separately, the Government has introduced the Anti-Money Laundering and Counter-Terrorism Financing Amendment Bill 2026 into the House of Representatives to empower the AUSTRAC CEO to restrict or prohibit, by legislative instrument, a reporting entity from using a high-risk mechanism
to provide a designated service. For example, exchanging money for virtual assets via a cryptocurrency ATM. The Bill, if passed, will also amend the meaning of financing of terrorism to reference new offences for financing a state sponsor of terrorism. Technical amendments will also be made to the AML/CTF Act.

2025 Rules

The amended Act is implemented by the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 which have been amended by the Anti-Money Laundering and Counter-Terrorism Financing (2025 Rules) Amendment Rules 2026 which also commenced on 31 March 2026.

The Anti-Money Laundering and Counter-Terrorism Financing (Class Exemptions and Other Matters) Amendment Rules 2026 also commenced on 31 March 2026. These Rules:

exempt ATM operators from undertaking initial customer due diligence on people who withdraw less than $10,000 in cash where the person isn’t otherwise the ATM operator’s customer;
exempt Virtual Asset Service Providers (VASPs) from undertaking initial customer due diligence on people who withdraw less than $1,000 in virtual assets to their self-hosted wallet where the person isn’t otherwise the VASP’s customer;
exempt reporting entities that issue open-loop gift cards from undertaking initial customer due diligence about the gift card recipient when paying for goods and services where there are other appropriate risk mitigations;
exempt other people that issue open-loop gift cards from AML/CTF obligations where there are other appropriate risk mitigations;
exempt services provided by barristers to Australian government bodies;
exempt incidental services provided by clearing and settlement facilities;
exempt incidental legal assistance services provided by community legal centres, legal aid, duty lawyers and advocates representing a client under a court referral scheme.

The Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026 include a 3 year initial CDD transition period for existing reporting entities from 31 March 2026 to 30 March 2029.

Austrac has updated the Suspicious Matter Reporting (SMR) reference guide to contain best-practice expectations for drafting grounds for suspicion text.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The post AML/CTF April 2026 final consolidated Act and Rules update appeared first on Bright Law.

Credit and debit card surcharging removal

David Jacobson — Wed, 08 Apr 2026 07:54:16 +0000

The Reserve Bank of Australia (RBA) has published a Conclusions Paper which proposes a package of reforms that includes removing surcharging, reducing interchange fees and increasing transparency in order to promote competition and efficiency in the payments system.

The key decisions of the RBA include:

removing surcharging on debit, prepaid and credit cards on the designated eftpos, Mastercard and Visa card networks;
lowering the caps on interchange fees paid by Australian businesses when they accept domestic or overseas card payments;
increasing transparency over the fees charged by card networks and payment service providers.

Most of these changes will come into effect on 1 October 2026, including the removal of surcharging and reductions in the interchange caps for domestic card transactions.

The introduction of an interchange cap on foreign cards and some changes to payment cost transparency will come into effect on 1 April 2027.

The RBA plans to start a public consultation in mid-2026 to assess the public interest case for regulating areas of the retail payments system that were not covered under the Review, including mobile wallets, three-party card networks, ‘buy-now, pay-later’ services and e-commerce platforms.

The post Credit and debit card surcharging removal appeared first on Bright Law.

AFCA jurisdiction for bank scam complaints expanded

David Jacobson — Wed, 08 Apr 2026 07:53:53 +0000

AFCA has announced its jurisdiction for scam-related bank complaints has expanded.

The change allows AFCA to look at the investigation of scam-related complaints involving receiving banks and unauthorised opening of accounts and credit facilities in a consumer’s name without their consent or authority, even where the consumer making the complaint is not a customer of that bank.

AFCA’s Receiving Banks and Unauthorised Opening of Accounts factsheet provides guidance on timing, eligibility and processes for complaints under the expanded jurisdiction.

The post AFCA jurisdiction for bank scam complaints expanded appeared first on Bright Law.

Payment service providers regulation

David Jacobson — Wed, 08 Apr 2026 07:53:30 +0000

Treasury is consulting on draft legislation for a new regulatory framework for payment service providers.

The draft Tranche 1 legislation covers:

definitions of regulated payment functions;
licensing obligations, including how certain providers must safeguard payment-related money;
exemptions and exclusions;
rules for unclaimed monies;
a new prudential framework;
a power to make rules for a mandatory and revised ePayments Code; and
transitional arrangements.

Treasury has also released an early, partial draft of exemption and exclusion regulations.

Background.

The post Payment service providers regulation appeared first on Bright Law.

IDR dashboard

David Jacobson — Wed, 08 Apr 2026 07:53:00 +0000

ASIC has released its interactive Internal Dispute Resolution dashboard which publishes a summary of complaints data for each of its licensed entities.

The summary shows types of complaints, products involved, resolution times and resolution outcomes.

It also allows a comparison of financial firms’ complaints.

The post IDR dashboard appeared first on Bright Law.

AML/CTF update March 2026

David Jacobson — Wed, 11 Mar 2026 02:29:10 +0000

This update covers the draft AML transitional rules, AUSTRAC’s guidance on its new compulsory examination powers, and the Office of the Australian Information Commissioner’s privacy guidance for current and new reporting entities under the AML/CTF Act.

AML transitional rules draft

The Department of Home Affairs has published draft transitional rules to allow periods of time for reporting entities to adjust their business and processes to certain obligations, while still managing their ML/TF risk. Background.

AUSTRAC guidance on its new compulsory examination powers

AUSTRAC has published guidance on its new compulsory examination powers under section 172A of the AML/CTF Act.

Section 172A provides that AUSTRAC may issue a notice to a person requiring them to attend for an examination and answer questions on oath or affirmation.

It can only use this power if it believes on reasonable grounds that a person has information or documents relevant to compliance with the AML/CTF Act, Rules or regulations, or a a prescribed criminal offence.

If a person receives a section 172A notice, they must attend and answer questions asked of them. Failure to comply is an offence.

The guidance sets out when their answers may not be used against them if they incriminate them or expose them to a penalty.

Examinees are entitled to be represented by an Australian legal practitioner during an examination.

Privacy obligations under the Anti-Money Laundering / Counter-Terrorism Financing Act

The Office of the Australian Information Commissioner (OAIC) has released updated Privacy guidance for reporting entities under the AML/CTF Act having regard to an expanded range of businesses that will be regulated by the Privacy Act as part of the AML/CTF reforms. This includes those which are small businesses with an annual turnover of less than $3 million which would otherwise be exempt.

The guidance discusses what personal information businesses may collect, how they must protect it, and when it must be deleted under the AML/CTF regulatory framework.

From 1 July 2026, real estate professionals, dealers in precious metals and stones, and professional service providers such as lawyers, conveyancers, accountants, and trust and company service providers (also known as ‘Tranche 2’ entities) will be brought into the Privacy Act.

The guidance clarifies that reporting entities from 31 March 2026, and from 1 July 2026 for tranche 2 entities, businesses should not retain copies of full ID documents for AML/CTF record-keeping purposes. The AML/CTF regime does not require copies full ID documents to be kept, and entities’ obligations under the Privacy Act require them to minimise the data they retain.

Reporting entities should consider whether they have obligations to make copies of full ID documents outside of the AML/CTF Act.

Entities must also have clear and accessible privacy policies and collection notices explaining how personal information is handled – unless issuing a notice would breach statutory tipping‑off restrictions.

The guidance also discusses the collection of biometric information and the Digital ID scheme.

The post AML/CTF update March 2026 appeared first on Bright Law.

Payday Super regulations

David Jacobson — Wed, 11 Mar 2026 02:28:35 +0000

The Treasury Laws Amendment (Payday Superannuation) Regulations 2026 have been registered to support changes made by the Treasury Laws Amendment (Payday Superannuation) Act 2025, which requires that employees’ superannuation is paid at the same time as their wages.

The regulations:

confirm the kinds of payments that do not attract superannuation, and the consequences of an employer voluntarily disclosing any missed payments; and
provide a reduced 3‑day timeframe for superannuation funds to approve or reject contributions. This will ensure contributions are allocated to a member correctly in a shorter timeframe, including resolving any errors, benefiting employees through contributions landing in accounts earlier.

The ATO has published Practical Compliance Guideline 2026/1 which sets out its compliance approach for the first year of operation of Payday Super in respect of investigating a superannuation guarantee (SG) shortfall that occurs from 1 July 2026 to 30 June 2027 inclusive.

The post Payday Super regulations appeared first on Bright Law.

Liability of company directors in high-risk businesses: Star Entertainment Group

David Jacobson — Wed, 11 Mar 2026 02:27:47 +0000

In Australian Securities and Investments Commission v Bekier (Liability Judgment) [2026] FCA 196, the Federal Court of Australia has found that the Managing Director and CEO of Star, a casino operator, and its Company Secretary and Group General Counsel, breached their duties of care and diligence as company officers under section 180(1) of the Corporations Act. Background.

Two other Star executives had previously admitted to breaches of their duties and been penalised.

ASIC’s action related to two main issues: Star’s dealings with Macau junket operators, which involved criminal risks, and misleading statements provided to NAB regarding the use for gambling of debit cards issued by China Union Pay International Ltd at NAB ATMs located on Star’s premises.

Justice Lee dismissed ASIC’s claims against the 7 non-executive directors, including the Chair, that they should have taken action over these issues, even though management failed to properly inform them.

In the 501 page judgment, he expressed a ” sense of disquiet” about the non-executive directors’ conduct, and commented as follows:

“It is not a portrait of directors actively pressing management with difficult questions as to whether the business was being conducted ethically, lawfully, and to the highest available standard. The contemporaneous minutes disclose little by way of sustained scrutiny or insistence upon explanation in circumstances where risks were obvious. There is one notable exception, when Mr Sheppard did seek to interrogate the credit evaluation process and underlying commercial arrangements, but this incident stands out because it is exceptional.”…

“The directors .. had assumed a governance role in a company operating a casino. This was no ordinary enterprise, and the role demanded vigilance. … The “culture” that prevailed was so dysfunctional and unethical that senior management was tardy in preventing junket operators from behaving inappropriately and lied to its bankers to secure an ongoing commercial advantage. Ultimately, it fell to investigative journalism, and then a statutory inquiry, to expose the extent of the problems. …the more self-congratulatory submissions of the non-executive directors are jarring.

The successful defendants were on far surer ground in correctly insisting that: s 180(1) does not demand omniscience or impose a “standard of perfection”; that management failed; that this case was not some sort of freewheeling inquiry into the board’s discharge of its duties; and that ASIC bears a heavy persuasive onus and must be confined to its pleaded case.”

With respect to director liability, Justice Lee endorsed the general principles decided in the Centro case:

Directors are now required to take reasonable steps to place themselves in a position to guide and monitor the management of the company;
This means that a director should become familiar with the fundamentals of the business or businesses in which the corporation is engaged; a director is under a continuing obligation to keep informed about the activities of the corporation; directorial management requires a general monitoring of corporate affairs and policies (including by way of regular attendance at board meetings); and a director should maintain familiarity with the financial status of the corporation by a regular review of financial statements;
While directors are required to take reasonable steps to place themselves in a position to guide and monitor management, they are entitled to rely without verification on the judgment, information and advice of management and other officers, at least except where they know, or by the exercise of ordinary care should have known, facts that would deny reliance.

The post Liability of company directors in high-risk businesses: Star Entertainment Group appeared first on Bright Law.

Case note: privacy and facial recognition technology

David Jacobson — Wed, 11 Mar 2026 02:27:03 +0000

In Bunnings Group Limited and Privacy Commissioner (Guidance and Appeals Panel) [2026] ARTA 130 the Administrative Review Tribunal set aside the Privacy Commissioner’s finding that Bunnings breached Australian Privacy Principle (APP) 3.3 (collection of solicited personal information) because subclause 3.4 applies as facial recognition technology (FRT) was a suitable and effective response to the problem of unlawful activity in the form of retail crime by repeat offenders as envisaged under section 16A of the Privacy Act.

The Tribunal affirmed the Privacy Commissioner’s finding that Bunnings contravened Australian Privacy Principles (APP) 1 (open and transparent management of personal information) and 5 (notification of the collection of personal information) when rolling out FRT in its stores.

The Tribunal found that Bunnings failed to provide appropriate notice to individuals of its use of FRT and should have completed a ‘formal, structured and documented’ risk assessment of its FRT system, which considered the privacy implications.

However, the Tribunal was satisfied that Bunnings was entitled to rely on exemptions to the requirement to obtain consent, for the limited purpose of combatting retail crime and protecting their staff and customers from violence, abuse and intimidation within their stores. Background.

The Privacy Commissioner has not filed an appeal in the matter.

The Privacy Commissioner has announced that specific updates to existing guidance will be made to reflect the Tribunal’s decision and ensure that retailers have up-to-date information about the regulatory application of the law.

“Those updates will also emphasise that the decision in Bunnings confirms a high bar for the use of facial recognition technology in Australia, and that entities will need to conduct a detailed risk assessment specific to their circumstances before deploying the technology. Retailers should view the decision as a useful case study, rather than a green light for deployment of biometric technologies.”

The post Case note: privacy and facial recognition technology appeared first on Bright Law.

ASIC sustainability reporting update

David Jacobson — Wed, 11 Mar 2026 02:26:15 +0000

ASIC has published a sustainability reporting webpage covering sustainability and climate-related financial information reporting required under the Corporations Act . Background.

The webpage has links to educational modules to help smaller companies and report preparers with sustainability reporting requirements.

ASIC has also published a sustainability reporting and audit relief decisions register containing some of its decisions on relief applications under Chapter 2M of the Corporations Act in relation to sustainability reporting.

The post ASIC sustainability reporting update appeared first on Bright Law.

Bright Law | searchable regulatory information for Australian financial service providers

AML/CTF April 2026 final consolidated Act and Rules update

Related Stories

Credit and debit card surcharging removal

Related Stories

AFCA jurisdiction for bank scam complaints expanded

Related Stories

Payment service providers regulation

Related Stories

IDR dashboard

Related Stories

AML/CTF update March 2026

Related Stories

Payday Super regulations

Related Stories

Liability of company directors in high-risk businesses: Star Entertainment Group

Related Stories

Case note: privacy and facial recognition technology

Related Stories

ASIC sustainability reporting update

Related Stories