Do Lawyers Have to Report Their Own Clients Under Tranche 2? Legal Professional Privilege vs AML, Explained

Confidentiality is one of the oldest promises a lawyer makes. The idea that what a client tells you stays between the two of you is not a courtesy or a policy. It is close to the core of what it has always meant to practise law.

So when a reform reaches into that promise, it strikes a nerve. If you have spent any time on TikTok or LinkedIn lately, you have probably seen it: a solicitor talking straight to camera, warning that the new anti-money-laundering rules force lawyers to inform on their own clients, and that this breaks a tradition the profession has held for centuries.

It is a compelling message. In its strongest form, it is also wrong.

The short answer: From 1 July 2026, law practices that provide certain "designated services" are AUSTRAC reporting entities, and they must report a genuine suspicion of money laundering without warning the client. But legal professional privilege is expressly preserved. You never have to hand over privileged advice or communications, and where a suspicion rests only on privileged material, you are not required to report it at all. The information you actually have to collect, and sometimes report, is identity, ownership and transaction detail, which was almost never privileged in the first place.

That distinction is the whole story, and it is the part a 60-second clip tends to skip. Here is how it actually works.

Where the “DOB in Your Own Clients” Claim Comes From

The claim wraps a real grievance around a half-truth.

The real part is that, after nearly two decades of being left out, Australian lawyers are now inside the AML/CTF regime, alongside accountants, conveyancers, real estate agents and dealers in precious metals and stones. Australia first committed to bringing legal professionals in around 2008, deferred it again and again, and drew sustained criticism from the international Financial Action Task Force for leaving the profession’s gatekeeper role uncovered. That gap closes on 1 July 2026.

The half-truth is that reporting a suspicion means surrendering privileged client confidences. It does not. Privilege survives the reform largely intact, because the reform was drafted specifically to keep it.

First, the Part That Is True: Lawyers Are Now Reporting Entities

Whether the new obligations apply to your practice turns on a single test. Do you provide a designated service? As Law Council of Australia President Tania Wolff has explained, whether the obligations apply to a firm depends on whether it provides a prescribed designated service.

Those designated services for legal practices include acting on real estate transfers, buying or selling entities, managing client money or assets, arranging equity or debt finance, forming or restructuring companies and trusts, and acting as (or arranging) a nominee director, trustee or registered office. Pure legal advice, litigation and representation are generally not designated services.

If you provide one or more of those services, you must enrol with AUSTRAC, maintain a risk-based AML/CTF program, perform customer due diligence, monitor the relationship, and report suspicious matters. And here is the part that lights up social media: you must report a suspicious matter without "tipping off", or informing, the client the report is about.

So yes, for the first time, a solicitor can be legally required to file a report about a client and legally prohibited from telling them. That is a genuine shift, and the discomfort is understandable. But it is not the same as being forced to disclose what your client told you in confidence.

But Legal Professional Privilege Is Expressly Preserved

The reform was built to protect privilege. The Commonwealth’s own explanation of the Amendment Act says it will preserve the core intention of the doctrine of legal professional privilege, while still allowing reporting entities that handle client information to meet their obligations.

In practice, that means the AML/CTF Act does not override your right, or your client’s right, to refuse to disclose information that is genuinely privileged. Privileged legal advice and privileged communications stay privileged. Nothing in the reporting obligation compels you to reveal them.

So When Do You Actually Have to File an SMR, and When Don’t You?

Timing matters too. A suspicious matter report is generally due within three business days of forming the suspicion, tightening to 24 hours where terrorism financing is suspected. Where a report includes information over which privilege is claimed, a longer five-business-day window applies. There is no monetary threshold for an SMR. It is about suspicion, not transaction size. (Confirm the current SMR timeframes and the LPP claim mechanism on AUSTRAC before relying on them; see the note below on what is still being finalised.)

What Is Not Privileged, and Never Was: Identity and Ownership

Here is the part that deflates most of the outrage. The information you are actually required to collect under customer due diligence, who your client is, their verified identity, who beneficially owns the entity behind them, and screening against sanctions and politically-exposed-person lists, is not privileged legal advice. As the Law Society of NSW makes clear, it is factual know-your-client information, and it must be collected regardless of any privilege claim.

Privilege protects the legal advice you give and the confidential communications around it. It has never protected the bare fact of who walked through your door and who really controls the money. Tranche 2 asks you to be rigorous about capturing that factual layer, not to breach the confidence of your advice.

The Tipping-off Trap: Why You Cannot Warn Your Client

The obligation that sits least comfortably with the lawyer-client relationship is the prohibition on "tipping off." You cannot tell a client you have reported them, or disclose anything that would, or could, reasonably prejudice an investigation.

This can collide with your duty to act in a client’s interests. The Law Council’s practical guidance is blunt about the consequence: if you find yourself in a tipping-off situation, you will need to cease acting for the client and seek legal and ethical advice. The confidentiality rules that already bind solicitors contain an exception for disclosure "compelled by law" (Australian Solicitors’ Conduct Rules, r 9.2), and that is the mechanism reconciling a mandatory report with your professional duty of confidence.

The Genuinely Unsettled Part

An honest article has to say this plainly: not everything here is settled. As the Law Society Journal notes, the boundary between a reportable suspicion and a privileged communication is not fully settled in practice. AUSTRAC’s LPP claim form and the Minister’s guidelines on how privilege claims are handled were being finalised in the lead-up to commencement, so the exact process for asserting privilege is one to confirm directly with AUSTRAC as you build it into your workflow.

The Law Council has said it will monitor the impact of the reforms to make sure they work without significant unintended consequences for lawyers and their ability to represent their clients. In other words, expect this area to be refined. That is a reason to build a defensible, well-documented process now, not a reason to assume the worst version of the rule.

What This Means for Your Practice

Your starting posture can be measured, too. AUSTRAC’s CEO, Brendan Thomas, has said the regulator is "not expecting perfection on day one" and has never penalised a small business for administrative mistakes, reserving enforcement for those who wilfully ignore their obligations. Reasonable, well-documented effort is the expectation.

Getting the Non-Privileged Layer off Your Plate

The heaviest, most repetitive part of all this is the factual layer: verifying identity, confirming beneficial ownership, screening against sanctions and PEP lists, and keeping a seven-year audit trail you can produce on request. None of it is privileged, and none of it is the work you trained for.

That is exactly the part VeriEzi is built to carry. It handles AUSTRAC-aligned identity verification and customer due diligence, PEP, sanctions and adverse-media screening, and a complete, exportable audit trail, so your practice can meet its Tranche 2 obligations without the compliance admin eating into the advice only you can give.