What Actually Happens When You File a Suspicious Matter Report

In an Australian accounting forum on Reddit this year, a practitioner was describing the issues piling up on a particular file. They then said the quiet part out loud:

That sentence is worth more than a hundred compliance webinars. It identifies the actual failure point in the suspicious matter reporting regime. It’s not that firms don’t know how to submit a report. After all, the AUSTRAC Online form is pretty simple.

The issue is that the person making the decision doesn’t know what will happen next: to the client, to the retainer, or to them, and that uncertainty is what can make all the difference.

Let’s look in detail at what actually happens when you file a suspicious matter report and hopefully clear a few things up.

What actually triggers the obligation

Three things about that list surprise people.

It is suspicion, not proof. You are not being asked to make a conclusion, reach a verdict, investigate anything, or even be right in your suspicions. AUSTRAC describes reasonable grounds as ‘an objective standard’, meaning ‘a reasonable person in your position would form a suspicion based on the facts, circumstances, and information available’. This is judged on what you knew or could reasonably have been expected to know at the time.

You report even if you cannot identify anyone. AUSTRAC is explicit that you must submit ‘even if you can’t identify the offender or suspected victim’. A genuine suspicion with no name attached is still reportable as far as they’re concerned.

This is the one that really catches firms out: you report even if you turn the work away. AUSTRAC says the obligation applies ‘even if you don’t end up providing the designated service to your customer’, because ‘criminals may ‘test the market’ to find vulnerabilities with certain providers’.

The Act puts it more forcefully than the guidance. s 41(1) offers three alternative gateways: the entity commences to provide or proposes to provide a designated service; or a person requests one; or a person merely inquires whether the entity would be willing to provide one. Put simply, a request or an inquiry is enough, with no service ever provided.

So if you assumed that declining a dodgy-looking matter ends your involvement, it does not. The approach itself is the reportable event. A firm that quietly turns away three suspicious approaches a year and reports none of them has three unmet obligations, and its own file notes will testify to this.

Moreover, there’s no ‘already reported’ exemption. Each new suspicion requires its own report, and AUSTRAC asks you to include the reference numbers of earlier SMRs to help it trace particular patterns.

The clock

Read the third row carefully. The common summary of it is wrong. The extension is not ‘five days if you are claiming privilege’. s 41(2)(aa) has three cumulative conditions, and the one most often dropped is that the privilege must belong to someone other than the reporting entity. Where the privilege is your own firm’s, you are back to three business days. Filing late contravenes s 41(2) is a civil penalty provision under s 41(4).

The phrase to be especially wary of is ‘after the day you formed the suspicion’. The clock starts when the suspicion forms in someone’s mind, so keeping good file notes is crucial. A firm that records when a concern was raised, by whom, and what was done about it is one that is producing a legitimate evidence trail, mapped out on a timeline. A firm that decides not to do this is relying on memory to prove a statutory deadline was met.

Legal professional privilege is a genuine exception, with real limits

For law firms, this is the section that matters most, and it is both more substantial and more constrained than the general advice suggests.

s 41(2A) says a reporting entity may refuse to give a report where it reasonably believes that all of the information comprising the grounds on which it holds the suspicion is privileged.

Where only part is privileged, there is a defined process: an LPP form covering the withheld information, plus an SMR containing the information that is not privileged (s 41(3)(aa)). The general privilege provisions sit within ss 242 and 242A.

There are two limits AUSTRAC states that matter here more than anywhere else.

First, privilege is narrower than confidentiality: ‘Information subject to LPP is generally narrower than information that is subject to a legal practitioner’s general duty of confidentiality.’

Second, and directly relevant to a money laundering suspicion:

That is the crime and fraud exception, and it can matter where the information giving rise to suspicion may itself have been created for an improper purpose. Privilege still exists under the new regime. Firms that think Tranche 2 has simply done away with it are working from a false premise. It is not a reason to stop giving careful consideration to the underlying issue.

We covered these boundaries in our earlier article on legal professional privilege and AML.

Can you tell the client? The rule changed, and most guidance has not caught up

This is a question that still catches many firms out.

AUSTRAC states the current position plainly:

The old s 123 prohibited disclosing that a report had been made, and separately any information from which that could reasonably be inferred. It had a long list of express exceptions, but anything outside that list was prohibited.

The new s 123, inserted by the AML/CTF Amendment Act 2024 and in force since 31 March 2025, replaced the inference test with an outcome test: disclosure is an offence where it would or could reasonably be expected to prejudice an investigation.

Don’t read the new rule as giving you broad permission to tell your clients or potential clients everything. There are still important limits.

It is immaterial whether an investigation has commenced. s 123(3) says so expressly. AUSTRAC puts it plainly: ‘It doesn’t matter if you know or think an investigation has started. You need to consider the consequences that disclosing information could have on an investigation, if there was one now or in the future.’ The subsection rules out the assumption that, because no investigation has started, nothing can be prejudiced. If an investigation exists now or in the future, the question is whether the disclosure could prejudice it.

Not prohibited is not the same as authorised. AUSTRAC’s list of disclosures that ‘aren’t likely to be considered tipping off’ comes with its own warning: ‘While the tipping off offence may not prohibit these kinds of disclosures, it doesn’t authorise them. Other legal restrictions may apply when disclosing information to third parties, including the Privacy Act 1988.’

The offence reaches former roles. As the section now stands, it applies to a person who is or has been a reporting entity, an officer, employee or agent of one, a member of a reporting group or their officers, employees and agents, or a person served with a notice under s 49(1) or s 49B(2). Leaving the firm does not put an end to this obligation.

There is one exception in particular that must be discussed given the theme of this article. s 123(4) disapplies the offence where a legal practitioner, a firm supplying legal services, a qualified accountant or an accountancy firm discloses information about a customer’s affairs in good faith, for the purpose of dissuading the customer from engaging in conduct that constitutes or could constitute an offence. It is a real exception, and it is not a general permission to explain yourself: the defendant, ultimately, carries the burden to provide evidence.

Section 123 carries a maximum penalty of 2 years’ imprisonment or 120 penalty units, or both. That figure is unchanged from the previous offence; the penalty is the one thing about s 123 that didn’t move.

What this means in practice: the instinct that you must say absolutely nothing to anybody is an overcorrection built on the pre-2025 rule. What remains squarely prohibited is what you would expect, which is telling the customer or their associates that you formed a suspicion and reported it. The rule is narrower than most firms operate under, and the difference matters on the day you need to end a client relationship without explaining why. It is still a criminal provision, and it is still worth a phone call to your adviser before you improvise an exit strategy.

What AUSTRAC does with it

Very little that you will see.

SMRs feed AUSTRAC’s financial intelligence function. As AUSTRAC describes it, the financial information it collects is made available to its partners to support law enforcement and national security operations across federal, state and territory agencies.

What comes back to you is a reference number. Not an outcome, not an assessment, not confirmation that it mattered. Practitioners read that silence as proof the exercise is pointless, but in truth it’s not proof of anything: a single SMR is one data point in a pattern the reporting firm cannot see, and the firm is not the intended audience for what happens next. Whilst frustrating for some, this is the way it has to be.

Occasionally, something might come back and if it does, it’s mandatory. Under s 49(1), the AUSTRAC CEO, the AFP Commissioner, the ACIC CEO, the Commissioner of Taxation, the Comptroller-General of Customs, the National Anti-Corruption Commissioner or an investigating officer may serve written notice requiring further information or documents arising from an SMR. Non-compliance is a civil penalty provision under s 49(3).

A practitioner in an r/auslaw thread captured the resulting mood: ‘I love my new role as a police officer for AUSTRAC, said no one ever.’ The feeling is understandable, but hearing nothing back does not mean nothing is happening.

What if you report and you are wrong?

This fear is certainly a factor that leads to hesitation. You’ll be glad to know that it’s a fear that’s almost entirely unjustified.

Section 235 protects a good-faith report. No action, suit or proceeding, criminal or civil, lies against a person, or against their officers, employees and agents, in relation to anything done or omitted in good faith in compliance, or in purported compliance, with a requirement under the Act. Both limbs matter: limb (a) covers the firm itself, limb (b) covers its people. ‘Purported compliance’ covers a good-faith report where the suspicion turns out to be unfounded. In practice, that means you cannot be sued for breach of confidence or for defamation.

Two things to mention here: (1) The protection is conditional on good faith; it is not automatic. And (2) s 235(2) qualifies three categories: criminal proceedings for an offence against the Act or regulations, civil penalty proceedings under s 175, and Proceeds of Crime proceedings relating to the Act. In other words, filing an SMR does not immunise a firm against AUSTRAC enforcement.

Nobody should file carelessly, because a low-quality SMR wastes analysts’ time. AUSTRAC even publishes examples of what an ineffective report looks like just to prove this point. But, to return to what we first spoke about in this article, the practitioner asking whether their compliance officer will be ‘ballsy enough’ has the risk backwards. Reporting in good faith is a position completely protected by the legislation.

What firms need to remember

The firms that manage this well are not braver. They have made the inputs visible, with verification completed and timestamped, source-of-funds questions asked and recorded, and risk ratings documented as they shift. So, when something looks wrong, the evidence is already assembled, and the decision is about judgement rather than digging through old papers.

VeriEzi maintains a timestamped record of each verification for seven years, matching the Act’s retention period, and exports AUSTRAC-ready SMR, TTR and annual compliance reports, drawing on records that already exist rather than a painstaking reconstruction. The suspicion, the judgement and the decision to report remain the firm’s.

If you’re interested in seeing what difference VeriEzi can make to your firm’s reporting processes, claim 5 free verifications today.