The AML compliance platform for small Australian businesses.

Powered by AUSTRAC’s kit.

See your checklist →

No demoNo sales pitchNo pricing tiers.

Your business

Which best describes your business?

One tap and the rest of the page tailors to you.

I’m not sure yetCompare AUSTRAC’s four newly-regulated sectors on austrac.gov.au.AUSTRAC: Tranche 2 overview

Key dates

The dates you cannot afford to miss.

Your Compliance Officer

by 1 July 2026

Nominate your AML/CTF Officer. Sole traders nominate themselves.

Obligations commence

from 1 July 2026

Risk programs, CDD and reporting kick in together.

Annual Report

by 30 September 2027

Covers your first financial year. Submit between 1 July and 30 September 2027.

What changed

AUSTRAC now regulates your business.

Australia's 20-year-old AML/CTF regime extends to small business from 1 July 2026, with no exemption.

New law, 1 July 2026.

Every Australian business newly regulated under Tranche 2 is in scope, with no small-business exemption.

What you will need in place.

  • An AUSTRAC enrolment

    Enrol your business with AUSTRAC before 29 July 2026.

  • A written AML/CTF program

    A risk-based program. Trained staff. Senior-manager approval.

  • A Compliance Officer

    A senior-level Compliance Officer, notified to AUSTRAC.

  • Customer due diligence

    Verify every customer before service. Monitor as the relationship continues.

  • Reports and records

    Report SMR, TTR and the Annual Compliance Report. Keep records seven years.

Real penalties for getting it wrong.

  • Civil penalties

    Up to A$33M for companies, A$6.6M for individuals.

  • Criminal offence

    Tipping off carries 2 years' imprisonment.

  • Publicly named

    AUSTRAC named 16 businesses last year. See AUSTRAC (opens in a new tab)

What it does

Senly AML is your AML compliance partner.

Everything you need to be AML-compliant, in one place.

    • Pick your sector and the services you provide.
    • Senly AML drafts your risk assessment and AML/CTF procedures.
    • The draft is adopted verbatim from AUSTRAC's published kit.
    • Your senior manager signs off, the program is yours.
    • Verify your customer in person or by video call. Automated identity-vendor checks arrive soon.
    • Senly AML structures the verification against your sector's CDD form.
    • Sanctions screened against the live DFAT list at the moment of check.
    • Outcomes stored, never the document itself.
    • Every customer scored Low, Medium or High from the data you enter.
    • You can always show how each customer reached their score.
    • You set the risk weights that fit your business and your sector.
    • The score updates whenever a customer's risk factors change.
    • Senly AML drafts the full submission when a reportable event triggers.
    • Built to AUSTRAC's official XML format for bulk upload.
    • Built-in countdown to submit your SMR, TTR and Annual Compliance Report on time.
    • Every AUSTRAC receipt linked back to the underlying customer or transaction, ready for audit.
    • Enrolment by 29 July 2026.
    • Compliance Officer nomination shortly after enrolment.
    • First Annual Compliance Report by 30 September 2027.
    • Your first Independent Evaluation by 2030.
    • Senly AML watches the clock so you never miss the date.
    • Every staff member walks through your AML/CTF program and risk assessment.
    • The walkthrough is logged automatically to the register.
    • Log any external course (REIA, REBAA, Law Society, e-learning etc) in the same register.
    • Annual refresh reminders, plus prompts when the law or your program changes.
    • Role-based topic guidance flags what each person still needs to cover.
    • Every regulated event captured with signed timestamps.
    • All data stored in Australia. AES-256 encryption at rest.
    • Every CDD check, program version, manager approval, SMR access.
    • AUSTRAC inspection-ready today and seven years from now.

How it works

Three steps, after you enrol with AUSTRAC.

Enrol with AUSTRAC, then finish Senly AML setup yourself in one sitting.

  1. Set up your profile

    Enter your sector and the services you provide. Senly AML drafts your AML/CTF program ready for sign-off.

  2. Verify every customer

    Verify the person, their business, and screen for sanctions. Senly AML logs the outcome.

  3. Run your business

    Senly AML keeps you on track. Deadlines, records, sanctions refreshes, and an audit-ready trail of everything.

Built for trust

We operate on AUSTRAC's starter kits.

We get small Australian businesses AUSTRAC compliant.

Locked end to end

Encrypted in transit and at rest, with the same protection banks use.

Hosted in Australia

Stored in AWS Sydney, governed by Australian privacy law.

Australian-built

Built in Australia by Australian founder.

Frequently asked

Common questions, straight answers.

Tap any question to expand the answer.

Yes. The obligation applies to every entity that provides one or more designated services under the AML/CTF Act 2006. There is no small-business or sole-trader exemption. AUSTRAC's CEO has publicly stated that 'too small to take responsibility' is not a defence.

AML/CTF obligations commence on 1 July 2026. Your AML/CTF program must be approved and operational before you provide your first designated service on or after that date.

The outer limit for AUSTRAC enrolment is 29 July 2026 if you are providing a designated service on 1 July. The enrolment window has been open since 31 March 2026.

AUSTRAC's kit gives you the regulatory content. Senly AML operates it. We turn the Word documents into structured workflows, sanctions screening, deadline timers, and the drafting of your SMR, TTR and Annual Report, capturing every regulated event as signed, timestamped, audit-grade evidence.

When AUSTRAC publishes a new kit version, we compare it against your adopted program and surface the changes for one-click adoption. Templates are step one. Operating them defensibly for years is the rest.

Not always. AUSTRAC's standard is reasonable grounds using reliable and independent documentation (s.28 of the Act). For low-risk customers, a sighted document with a recorded attestation meets that standard, in person or over a video call, with no third-party vendor mandated. For higher-risk customers, AUSTRAC expects stronger verification, typically electronic checks against multiple independent sources.

Senly AML captures the structured attestation for low-risk verification today and surfaces a recommendation when a customer's risk score is Medium or High. For stronger checks, Senly AML integrates with an Australian-Government-aligned identity vendor as an optional upgrade. The specific vendor will be named on our trust page when integration completes.

Not yet. AUSTRAC accepts SMRs and TTRs either typed into AUSTRAC Online directly, or uploaded as an XML file. Senly AML drafts the report content and generates the XML in AUSTRAC's official format. You upload it through AUSTRAC Online in a few clicks, and Senly AML logs the receipt number to your audit trail. The same flow applies to enrolment and the Annual Compliance Report.

If AUSTRAC opens up automated submission later, Senly AML will support it. The platform is already aligned with AUSTRAC's published formats.

Yes. Every reporting entity must have a written, risk-based AML/CTF program approved by a senior manager before providing any designated service from 1 July 2026. Under the Reform (Part 1A of the AML/CTF Act 2006, in force from 31 March 2026), the program has two parts (replacing the earlier Part A and Part B framing):

  • An ML/TF risk assessment under s.26C covering money-laundering, terrorism-financing and proliferation-financing risks.
  • AML/CTF policies under s.26F that put the risk assessment into practice.

AUSTRAC publishes a starter-kit risk assessment and policy template for each sector. Senly AML adopts the right kit and operates it.

Personal information collected through Senly AML is held in Australia and encrypted at rest. We never store copies of identity documents. We keep only the verification outcome and the verifier's attestation. The platform is built to align with the Privacy Act 1988 (Cth) and OAIC guidance, including the requirement under APP 3 to collect only personal information that is reasonably necessary.

Yes. Every staff member completes a guided walkthrough of your AML/CTF program and risk assessment right inside Senly AML. Once they have read it, the training is logged automatically, and you are reminded a month before the annual refresh is due. Deeper role-based courses for Principal, AMLCO and Agent are coming soon, with sector-specific learning to follow.

You can also log any external course (REIA, REBAA, the Law Society, your industry body, a webinar, anything you trust). Just add the date and attach the certificate. Senly AML keeps the training register that AUSTRAC expects to see at audit.

AUSTRAC has serious civil penalty powers: up to A$33 million per breach for companies, and A$6.6 million for individuals (under s.175 of the AML/CTF Act). Tipping off, under s.123, is a criminal offence carrying up to two years' imprisonment, a fine, or both.

AUSTRAC has signalled an educative posture in year one for entities making genuine efforts. Even so, in November 2024 it issued infringement notices ranging from A$3,756 for a sole trader to A$18,780 for a company, to 16 businesses that missed their 2023 annual compliance report, and two of those 16 were sued in the Federal Court in December 2025. Genuine effort is the standard, and the bar is being enforced.

Senly AML gets your business AUSTRAC compliant.

Three minutes to set up.

View my checklist →

What Senly AML is

Senly AML is a software platform that helps Australian businesses newly regulated under AUSTRAC's Tranche 2 reforms meet their anti-money-laundering and counter-terrorism-financing (AML/CTF) obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), as amended by the AML/CTF Amendment Act 2024. These obligations commence on 1 July 2026. The product is built and operated by Uinspo Pty Ltd (ABN 47 664 833 872), a Victorian company based in Melbourne. Senly AML is the first product in the Senly product family.

Who must comply

From 1 July 2026, every Australian business that provides one or more designated services under sections 5 to 6 of the AML/CTF Act becomes a reporting entity. Tranche 2 brings newly regulated entities under four tables in section 6:

Obligations apply regardless of business size. There is no small-business or sole-trader exemption. AUSTRAC's CEO has publicly stated that “too small to take responsibility” is not a defence.

Key dates

What you'll need in place by 1 July 2026

AUSTRAC's official Summary of obligations page enumerates five grouped AML/CTF obligations for Tranche-2 reporting entities: Enrolment, AML/CTF Program (including personnel due diligence and training), Compliance Officer, Customer Due Diligence, and Reporting + Record Keeping. Senly AML surfaces these as eight discrete actions in the checklist for clarity; the underlying obligation structure remains the five AUSTRAC defines.

  1. Enrol with AUSTRAC by lodging an application via AUSTRAC Online. Required information includes legal name, ABN, ACN if a company, business structure, address, the designated services you provide, beneficial owners (anyone holding 25% or more directly or indirectly), and the proposed compliance officer's details.
  2. Appoint an AML/CTF compliance officer at management level. Must be an Australian resident with authority to make compliance decisions, including stopping a transaction if a suspicion forms. AUSTRAC must be notified within 14 days of appointment or change.
  3. Develop a written, risk-based AML/CTF program approved by a senior manager before providing any designated service from 1 July 2026. Two components under Part 1A of the AML/CTF Act 2006 (in force 31 March 2026): an ML/TF risk assessment under section 26C covering money laundering, terrorism financing and proliferation financing risks; and AML/CTF policies under section 26F that put the risk assessment into practice. The old Part A / Part B framing is retired. AUSTRAC publishes five starter kits at Tranche-2 launch: Real Estate, Accounting, Legal Profession, Conveyancing, and Jewellers; businesses that provide services across more than one kit compose a program covering all declared services. Senly AML supports all five kits as-is and refers populations outside a published kit (property developers, full-tier jewellers) to AML/CTF consultants.
  4. Train all staff who handle designated services before 1 July 2026 and at least annually thereafter. Required topics: AML/CTF obligations, sector red flags, internal escalation, the tipping-off prohibition under section 123 of the AML/CTF Act, and use of internal systems. Maintain a training register with staff name, date, content, and evidence of completion.
  5. Perform customer due diligence (CDD) on every customer before providing a designated service. The customer-relationship model varies by sector: in real-estate brokering, both the buyer and the seller are customers regardless of which side you act for; in Professional Services, your customer is the client you're engaged by under your retainer; in Precious Metals, your customer is the individual on the other side of the regulated transaction. CDD comprises identity establishment on reasonable grounds (section 28), risk assessment, PEP and sanctions screening, source-of-funds enquiry for medium and high risk customers, and ongoing monitoring. AUSTRAC requires reliable, independent documentation. A sighted document with a recorded attestation satisfies the Act; third-party verification vendors are optional accelerants, not gatekeepers of compliance. Risk-rated review cadence: high every 12 months, medium every 24 months, low every 36 months.
  6. File reports to AUSTRAC. Suspicious matter reports (SMRs) within 24 hours of forming a suspicion that relates to terrorism financing, or 3 business days for all other suspicions (section 41). Threshold transaction reports (TTRs) for any single physical-cash transaction of A$10,000 or more within 10 business days (section 43). Cross-border movement (CBM) reports for physical currency or bearer negotiable instruments of A$10,000 or more, pre-departure for outbound and within 5 business days for inbound (section 46). Annual compliance report (ACR) to AUSTRAC Online for each financial year, lodged in the 3-month window after the reporting period closes. First Tranche-2 period 1 July 2026 to 30 June 2027, first ACR due 30 September 2027 (section 47 of the Act + section 9-9 of the Rules 2025).
  7. Retain records for a minimum of 7 years (sections 107–115). Includes program versions, risk assessments, CDD records, transaction records, all AUSTRAC reports with reference numbers, training records, consent records, and independent evaluation reports. Per OAIC guidance and the requirement under APP 3 to collect only personal information that is reasonably necessary, do not store identity-document copies; store only the verification outcome and the verifier's attestation.
  8. Ongoing rhythm: annual program review with re-approval by the senior manager, periodic effectiveness checks documented by the compliance officer, annual report to the governing body, and an independent evaluation at least every 3 years (first evaluations due 2029).

Penalties and enforcement

AUSTRAC has civil penalty powers under section 175 of the AML/CTF Act up to 100,000 penalty units per breach for body corporates and 20,000 penalty units for individuals, currently A$33 million and A$6.6 million respectively at the A$330 penalty-unit value, with the next indexation due 1 July 2026. Tipping off is a criminal offence under section 123 with a maximum penalty of 2 years' imprisonment, 120 penalty units, or both. Structuring transactions to avoid the A$10,000 threshold is a separate criminal offence under section 142. AUSTRAC has signalled an educative posture in year one for entities making genuine efforts to comply, but has taken real action: in November 2024 it issued infringement notices of A$3,756 (sole trader) to A$18,780 (company) to 16 businesses that missed their 2023 annual compliance report, with Castra Licensee Pty Ltd and Princeton Securities (NSW) Pty Ltd sued in the Federal Court in December 2025; in September 2025 it issued Revolut Payments Australia with a A$187,800 infringement notice for late international funds transfer reports.

What Senly AML does

Senly AML adopts AUSTRAC's published starter kit for your sector (Real Estate, Accounting, Legal Profession, Conveyancing or Jeweller streamlined tier) and operates it. Senly AML serves kit-fits populations only; scope outside a published kit (property developers, full-tier jewellers) is referred to AML/CTF consultants. The ML/TF risk assessment (section 26C) and AML/CTF policies (section 26F) come from the kit verbatim, composed across all the designated services you declare. Every customisation you make is captured with provenance, so when AUSTRAC publishes a new kit version we can diff it against your program and surface the changes for one-click adoption. Customer due diligence is captured through a three-mode verification toggle: in-person sight, video sight (Zoom, Microsoft Teams, Google Meet, FaceTime, or certified copy received), or an optional vendor API check arriving in Phase 1.5. The DFAT consolidated sanctions list is bundled inside the platform and searchable with an audit-logged attestation; UN and OFAC sanctions plus global PEP and adverse-media databases ride on top of the same flow through the optional vendor API. A deterministic risk-scoring engine with transparent, configurable weights scores every customer Low, Medium or High and triggers periodic review on a risk-based cadence. SMR and TTR wizards include statutory deadline timers and a tipping-off lockdown that engages the moment SMR drafting begins. Records are stored encrypted at rest in Australia with a hash-chain tamper-evident audit log for the 7-year retention period. Annual compliance report data is captured throughout the year ready for the Phase 1.5 export wizard.

What Senly AML does not do

Senly AML does not submit anything directly to AUSTRAC on your behalf. AUSTRAC requires the reporting entity to lodge enrolment, SMRs, TTRs, CBM reports, and the annual compliance report directly via AUSTRAC Online; no third-party API exists. For enrolment, Senly AML provides a one-page prep checklist of everything to gather before opening AUSTRAC Online: legal name, ABN, ACN, structure, declared services, beneficial owners, compliance officer details. We store the data in your business profile so it's entered once. For each subsequent report (SMR, TTR, ACR), Senly AML generates the content and runs the deadline timer; you copy the content into AUSTRAC Online and Senly AML logs the receipt number. Senly AML does not replace legal advice; for complex compliance situations engage a qualified Australian AML/CTF specialist.

Data residency, privacy and identity-document handling

Personal information collected through Senly AML is held in Australia (Supabase Sydney region and AWS S3 ap-southeast-2) and encrypted at rest. The platform is built to align with the Privacy Act 1988 (Cth), the Australian Privacy Principles (including the requirement under APP 3 to collect only personal information that is reasonably necessary, and APP 11 security of personal information), and OAIC guidance. Senly AML never stores copies of identity documents. We keep only the structured verification outcome, the verifier's attestation, and the metadata required for audit (document type, document number, expiry, issuing authority, sighting method, date, verifier identity). The same principle applies to certified copies and video-call sightings: metadata only, never scans or screenshots.

Pricing and access

Senly AML is A$49 per month on the monthly plan or A$41 per month on annual (A$492 billed once per year) with a 14-day free trial that starts on first login. Every Phase-1 feature is bundled in both plans (unlimited customers, unlimited CDD records, unlimited reports) including the DFAT consolidated sanctions list with daily refresh, all program and risk-assessment generation, all compliance-report drafting (SMR, TTR, CBM, ACR), and a 7-year encrypted Australian vault. No self-serve sign-up: every customer is manually onboarded by the founder via a 20-minute call, which matches the incumbent AML-platform pattern and keeps activation high. Optional vendor API checks (DVS, biometric, full sanctions / PEP / adverse-media databases) arrive in Phase 1.5 with per-check pricing on top of the base subscription.

Authoritative sources

About Uinspo Pty Ltd

Senly AML is built and operated by Uinspo Pty Ltd, an Australian proprietary limited company (ABN 47 664 833 872). Contact: mithun@senly.ai for general enquiries, privacy@senly.ai for privacy matters, security@senly.ai for responsible vulnerability disclosure.