From 1 July 2026, new national laws known as Tranche 2 of the Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) reforms will bring accountants and financial advisers into the same regulatory framework that has applied to banks since 2006. From that date, these obligations will apply to every accounting and advisory firm across Australia.
As part of these changes, we’ve updated our Privacy Policy and introduced a new AML/CTF Privacy Collection Notice. Together, these documents explain what information we collect, why we collect it, how it’s collected, who assists us, and how we protect it.
This email provides a plain-English overview of the changes and what they mean for you.
For most clients, the practical impact will be minimal. There’s nothing you need to do at this stage.
Why these changes are being introduced
Tranche 2 extends Australia’s AML/CTF regime to accountants, lawyers, real estate professionals and several other designated professions. Australia is one of the last OECD countries to implement these reforms.
Banks have operated under these requirements for almost twenty years. That’s why opening a bank account, applying for a home loan or activating a mobile phone plan typically involves an identity check.
From 1 July 2026, the same requirements will apply to certain services we provide, including:
- Establishing a company or trust
- Restructuring an existing entity
- Handling client money
- Business sales and acquisitions
- Establishing a self-managed superannuation fund (SMSF)
What you’ll experience
To make the process as simple and secure as possible, we’ve partnered with two specialist Australian providers.
EasyAML is the secure platform we use to manage client identity verification. If we need to verify your identity, you’ll receive a personalised email from EasyAML on behalf of Cosca containing a secure verification link.
Scantek provides the identity verification technology behind EasyAML. It is an Australian-accredited Government Gateway Service Provider with direct access to the Document Verification Service (DVS). This is the same technology used by Telstra, Optus, Australia’s major banks and many other organisations you likely deal with every day.
If you’ve ever opened a bank account online, activated a SIM card, or uploaded your driver’s licence and taken a quick selfie to verify your identity, you’ve already completed a very similar process. It usually takes around three minutes on your phone.
How your information is protected
Protecting your personal information has been our highest priority in implementing these new requirements.
We selected EasyAML and Scantek because they meet the security standards we’d expect for protecting our own family’s information.
- ISO/IEC 27001 certified – EasyAML holds internationally recognised ISO 27001 certification, the global benchmark for information security management.
- Hosted in Australia – Your information is securely stored on Amazon Web Services infrastructure located in Sydney and is encrypted both in transit and at rest.
- Technology trusted by leading organisations – Scantek’s identity verification platform is used by Telstra, Optus, Australia’s major banks, superannuation funds and government agencies. We’ve deliberately chosen an established Australian provider rather than a boutique or overseas alternative.
- Protected by Australian privacy law – Your personal information continues to be handled in accordance with the Privacy Act 1988 and the Australian Privacy Principles, together with our updated Privacy Policy.
Our updated privacy documents
We’ve published two updated documents on our website.
Privacy Policy (Version 2)
Updated to reflect the new AML/CTF obligations, overseas data flows, and the way information may be shared between Cosca Group entities, with appropriate safeguards in place.
AML/CTF Privacy Collection Notice
This new document complements our Privacy Policy by explaining, in plain English, what information we collect for AML/CTF purposes, why we collect it, who assists us, and how long we retain it.
You can access these documents at:
- Privacy Policy: cosca.com.au/privacy
- AML/CTF Privacy Collection Notice: cosca.com.au/aml-privacy
There’s no need to read them from cover to cover—we’ve summarised the key points in this email—but they’re available if you’d like more detailed information.
What you need to do
At this stage, nothing.
If we ask you to complete identity verification in the future, we simply ask that you complete the process promptly so we can continue providing our services and meet our legal obligations while maintaining the high standards you’ve come to expect from Cosca.
If you have any questions about these changes or how they may affect you, please don’t hesitate to contact your Cosca Coutts Redington adviser. We’re always here to help.
This version retains all of the important legal information but reads more like a communication from a trusted adviser than a compliance notice. It reassures clients, explains the changes in plain language, and reinforces confidence in your firm’s professionalism and security practices.
