RegTech & Identity Verification Playbook: AML/CTF and Digital ID in ANZ

Australia and New Zealand are undergoing the most significant overhaul of their compliance and digital-identity frameworks in a generation — and the timing creates an unusual window for foreign RegTech vendors. In Australia, the AUSTRAC AML/CTF reforms passed on 29 November 2024 will bring an estimated 5,000–10,000 new "tranche 2" entities — lawyers, accountants, real estate professionals, conveyancers, and trust and company service providers — under the AML/CTF regime for the first time from 1 July 2026. Every one of those entities will need onboarding technology, KYC/CDD tooling, ongoing transaction monitoring, and suspicious matter reporting capability. That demand pipeline is structural, not cyclical.

Simultaneously, the Digital ID Act 2024 commenced on 30 November 2024, placing Australia's voluntary digital-identity accreditation scheme on a legislative footing and opening the Australian Government Digital ID System (AGDIS) to private-sector participation by December 2026. New Zealand's Digital Identity Services Trust Framework has been operative since 1 July 2024. Together, these reforms are generating procurement demand across banking, professional services, government, and the legal sector — precisely the verticals where foreign RegTech companies such as Fenergo, Daon, and Kyckr have already demonstrated traction.

Three companies illustrate the range of entry strategies available. Fenergo, the Dublin-headquartered client lifecycle management platform, won enterprise banking mandates across NAB, ANZ Bank, and Westpac by aligning its product roadmap to AUSTRAC's KYC/CDD requirements and positioning ahead of each regulatory uplift cycle. Its lesson: land the major banks first, then ride the wave as regulatory requirements cascade down to mid-tier lenders and now to tranche 2 professional-service firms.

Daon, the identity-verification and biometric authentication specialist, embedded its platform into Australian banking onboarding workflows through Big Four engagements, benefiting from rising demand for liveness detection and presentation attack detection — capabilities now codified in the Digital ID Act's Accreditation Data Standards. Kyckr took a data-first approach, selling KYC compliance data and corporate registry intelligence directly to Australian financial institutions seeking to automate beneficial-ownership checks. All three companies entered before the current reform wave; vendors arriving now will find a market that is larger, better funded, and more urgently in need of production-ready solutions.

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 — passed by the Australian Parliament on 29 November 2024 — is the most substantial revision to Australia's AML/CTF regime since the original Act commenced in 2006. According to Home Affairs, the reforms modernise and simplify the regime and bring it into alignment with FATF international standards. The key implementation timeline is:

• 7 January 2025: The Financial Transaction Reports Act 1988 (FTR Act) was repealed, removing a parallel and overlapping reporting framework that had operated alongside the AML/CTF Act since 2006.
• 31 March 2025: Changes to the tipping-off offence took effect. It is now a criminal offence to disclose certain information only where that disclosure would, or could reasonably be expected to, prejudice an investigation — a narrower and more workable standard than the previous blanket prohibition.
• 31 March 2026: Existing reporting entities must comply with updated obligations covering value transfer requirements, revised definitions of bearer negotiable instruments, refreshed AML/CTF program requirements, and enhanced due diligence standards.
• 1 July 2026: Tranche 2 entities become regulated for the first time (see below).

For foreign RegTech vendors, the 31 March 2026 uplift for existing entities and the 1 July 2026 tranche 2 commencement together represent a two-wave commercial opportunity: existing clients needing system upgrades now, and a new tranche-2 client base needing full solutions from scratch.

From 1 July 2026, the following entity types become subject to AUSTRAC regulation for the first time:

• Real estate professionals (agents, buyers' agents)
• Lawyers and law practices
• Conveyancers
• Accountants and accounting practices
• Trust and company service providers
• Dealers in precious stones, metals, and products
• Businesses providing certain virtual asset services beyond the existing digital currency exchange (DCE) regulation

This group has never previously held AML/CTF obligations in Australia. They will need to enrol with AUSTRAC, design and implement an AML/CTF Program, establish customer identification and verification procedures, conduct ongoing due diligence, and file Suspicious Matter Reports (SMRs) and Transaction Threshold Reports (TTRs). Many are small-to-medium professional practices without in-house compliance infrastructure — making them natural buyers of turnkey RegTech solutions. For vendors like Fenergo and Kyckr, the professional-services segment represents a meaningful expansion beyond their existing financial-institution client base.

Under the AML/CTF reforms, AUSTRAC is renaming digital currency exchange (DCE) providers to "virtual asset service providers" (VASPs) and expanding regulatory coverage. From 31 March 2026, AUSTRAC's scope extends to all VASPs, not merely the fiat-to-crypto exchanges previously regulated. A publicly searchable VASP register is already live. AUSTRAC may refuse, suspend, or cancel registration where a business poses unacceptable risk of money laundering or terrorism financing.

For identity-verification vendors, this expansion creates a discrete demand vertical: crypto exchanges, NFT platforms, DeFi protocols, and digital asset custodians that have not previously needed robust KYC infrastructure will need to stand up compliant onboarding flows before the 31 March 2026 deadline. Vendors with biometric liveness detection, document verification, and sanctions screening capabilities are particularly well placed — the VASP community has historically under-invested in these controls relative to the banking sector.

Any business providing a "designated service" with a geographical nexus to Australia must enrol with AUSTRAC before commencing that service. Designated services are defined in Schedule 1 of the AML/CTF Act and span deposit-taking, lending, payment services, remittance, digital currency exchange, securities dealing, and from 1 July 2026, the tranche 2 professional services listed above. Enrolment is completed online via AUSTRAC's Business Portal.

Once enrolled, the entity must:

• Adopt and maintain an AML/CTF Program — a documented risk-based framework covering customer due diligence procedures, ongoing monitoring, staff training, board oversight, and an independent review cycle.
• Appoint an AML/CTF Compliance Officer.
• Conduct initial and ongoing Customer Due Diligence (CDD), including Know Your Customer (KYC) identity verification before providing a designated service.
• Apply Enhanced Due Diligence (EDD) to high-risk customers (politically exposed persons, high-risk jurisdictions, complex ownership structures).
• File Suspicious Matter Reports (SMRs) with AUSTRAC where there are reasonable grounds to suspect a transaction is related to money laundering, terrorism financing, or other serious crime.
• File Transaction Threshold Reports (TTRs) for cash transactions of A$10,000 or more.

For foreign RegTech vendors, this creates a clear product-market fit: AUSTRAC's risk-based approach rewards automation, audit trails, and real-time screening — exactly the capabilities that RegTech platforms provide at scale.

The AML/CTF Act requires reporting entities to verify a customer's identity before providing a designated service. In practice, this means collecting and verifying identity documentation (passport, driver's licence, Medicare card), confirming beneficial ownership for corporate customers, and screening against sanctions lists and politically exposed persons (PEP) registers. The reforms to 31 March 2026 update due diligence standards and may require existing entities to upgrade their CDD procedures and the technology supporting them.

This is the core demand driver for vendors such as Daon, whose biometric and liveness-detection technology addresses the identity-proofing layer, and Kyckr, whose corporate registry data resolves the beneficial-ownership layer. Critically, the Digital ID Act 2024 Accreditation Data Standards now specify technical requirements for biometric matching, presentation attack detection, and electronic identity document verification technology (eIDVT) — creating a de facto technical standard that AUSTRAC-regulated entities and their technology providers must align with. Vendors seeking both AML/CTF and Digital ID market share should ensure their biometric pipelines meet these standards.

The AUSTRAC enrolment obligation falls on the reporting entity — the business providing the designated service — not on its technology suppliers. A RegTech vendor selling KYC software to a bank or conveyancer is not itself required to enrol with AUSTRAC solely by virtue of that supply relationship. However, there are two important caveats.

First, if the foreign RegTech vendor also provides a designated service directly (for example, operating a remittance platform or a digital currency exchange as part of its product), it will itself be a reporting entity and must enrol. Second, vendors that operate as "designated service" intermediaries — for instance, processing customer identification on behalf of a reporting entity under a delegation arrangement — should seek specialist legal advice on whether that activity constitutes provision of a designated service with an Australian geographical link. Home Affairs publishes guidance on the scope of the reforms that vendors should review carefully before structuring their service delivery model.

The Digital ID Act 2024 and its suite of supporting instruments — the Accreditation Rules, Accreditation Data Standards, Digital ID Rules, and AGDIS Data Standards — all commenced on 30 November 2024. According to the Department of Finance, the Act places the pre-existing voluntary Digital ID Accreditation Scheme on a legislative footing and provides statutory authority for the Australian Government Digital ID System (AGDIS) to expand beyond the public sector.

The Act establishes three categories of accredited provider:

• Identity Service Provider (ISP): generates, manages, or verifies identity information — the "who are you?" layer (e.g., document verification, biometric matching).
• Attribute Service Provider (ASP): verifies and manages attributes associated with a Digital ID — the "what do you qualify for?" layer (e.g., age verification, professional credentials).
• Identity Exchange Provider (IXP): facilitates the flow of information between ISPs, ASPs, and relying parties — the integration and orchestration layer.

Accreditation is voluntary. However, accredited providers gain the right to display the Digital ID Accreditation Trustmark, access the AGDIS once private-sector participation opens, and benefit from the reputational signal that they meet government-grade privacy and security standards. For vendors such as Daon, positioning for ISP accreditation is a logical next step from existing Big Four banking engagements.

Accredited entities must comply with the Accreditation Rules and Accreditation Data Standards published by the Data Standards Body. The Rules cover fraud management systems, protective security controls, privacy obligations, accessibility and usability requirements, and an annual review cycle. The Data Standards specify technical requirements including biometric matching accuracy thresholds, presentation attack detection (PAD), and electronic identity document verification technology (eIDVT) — the same capabilities at the heart of Daon's product suite.

Beyond these operational requirements, accreditation under the Digital ID Act triggers additional privacy safeguards that go beyond the baseline Privacy Act 1988 obligations:

• Prohibition on the use of single identifiers across services (preventing cross-service tracking).
• Prohibition on using Digital ID data for marketing purposes.
• Restrictions on the collection, use, and disclosure of biometric information.
• Civil penalties apply for non-compliance with accreditation conditions.

The Digital ID Regulator is the ACCC, which manages accreditation applications and participation approvals for the AGDIS. The OAIC retains its Privacy Act oversight role and gains an expanded function under the Digital ID Act.

The Digital ID Act sets out a phased expansion timeline. From 30 November 2024, Commonwealth, state, and territory government entities can apply to the ACCC to participate in the AGDIS. Private-sector entities may apply for AGDIS participation no later than December 2026 — two years after the Act's commencement. The target outcome is reciprocal use of Digital ID and attribute services between public and private sector services by that date.

For identity-verification vendors, AGDIS participation is the long-term prize: a government-endorsed network that connects relying parties (banks, fintechs, professional services firms) with accredited identity providers through a standardised exchange layer. Vendors that achieve ISP or ASP accreditation before the private-sector participation window opens will be positioned to on-board relying parties rapidly when it does. The December 2026 deadline should be treated as a product roadmap anchor — accreditation applications, technical integration, and compliance build-out typically take 12–18 months from initiation.

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024, delivering the first substantive amendments to the Privacy Act 1988 since 2012. According to FTI Consulting, these amendments represent the first tranche of a broader reform program — further changes are expected in subsequent legislative tranches.

The most commercially significant provision for RegTech vendors is the new right to explanation for automated decisions, which is scheduled to take effect in December 2026. Under this right, individuals will be entitled to request a meaningful explanation of decisions that significantly affect them and that were made using automated processes. For RegTech platforms that use machine-learning models for credit risk scoring, fraud detection, AML transaction monitoring, or identity verification, this creates an explainability requirement that must be designed into the product architecture — not bolted on after the fact. The OAIC has recommended that APP entities begin preparation well in advance of the December 2026 commencement date.

Any foreign entity that carries on business in Australia or that collects personal information from Australians is subject to the Privacy Act 1988 and the 13 Australian Privacy Principles (APPs). This applies regardless of where the vendor is incorporated or where its servers are located. The Privacy Act's extraterritorial reach means that a Dublin-based RegTech company processing Australian customer data for an Australian bank is an APP entity and must comply with the full suite of APPs — including APP 8 (cross-border disclosure obligations) and APP 11 (security of personal information).

The practical implications for product and GTM strategy are:

• Data processing agreements with Australian clients must address APP compliance and specify data residency or cross-border transfer safeguards.
• Privacy-by-design must be embedded in product development — particularly for biometric data, which attracts heightened obligations under the Digital ID Act accreditation regime and the incoming Biometric Processing Code of Practice being developed in New Zealand.
• The December 2026 automated-decision explanation right requires model explainability tooling to be roadmapped now.
• OAIC can investigate complaints and issue determinations; serious or repeated interferences with privacy can attract civil penalties.

New Zealand's Digital Identity Services Trust Framework Act 2023 (DISTF) came into operative effect on 1 July 2024. The Trust Framework Rules 2024 were published on 8 November 2024, with Amendment Rules 2025-1 following on 24 July 2025. The framework is administered by the Trust Framework Authority, which sits within the Department of Internal Affairs.

As with Australia's Digital ID Act, accreditation under the DISTF is voluntary — providers are not legally required to seek accreditation to operate in New Zealand. However, accreditation signals compliance with a set of independently verified privacy, security, risk management, and data-sharing standards, and is increasingly expected by government agencies and regulated entities when procuring identity services. The NZ Digital Government site publishes the authoritative guidance for providers considering accreditation.

Accreditation requirements under the DISTF Rules 2024 (as analysed by Minter Ellison NZ) include:

• Informed consent: Individuals must give free and informed consent before their identity credentials are used; purpose limitation applies.
• Privacy Impact Assessments (PIAs): Providers must conduct PIAs before deploying new or significantly changed services.
• Secure cryptographic methods: Data transmission and storage must use approved cryptographic standards.
• Risk management plans: Documented risk identification, assessment, and treatment frameworks are required.
• Data breach protocols: Incident detection, containment, notification, and review procedures must be in place before accreditation is granted.
• Information governance plans: Detailed plans covering data retention, deletion, access controls, and cross-border transfer restrictions.

The Simply Privacy NZ commentary notes that the framework is deliberately technology-neutral and outcome-focused, which means vendors with strong governance documentation from an Australian or EU accreditation process (ISO 27001, GDPR compliance, Digital ID Act accreditation) will find considerable overlap and can re-use much of their compliance artefact library.

The typical sequencing for a foreign identity-verification or RegTech vendor is: Australia first, New Zealand second. Australia offers a larger addressable market, more immediate regulatory deadlines (tranche 2 from 1 July 2026, existing entity uplift from 31 March 2026), and a more structured accreditation pathway through the Digital ID Act. An established Australian client base and ACCC accreditation also provides strong reference points for the New Zealand market, where the Trust Framework Authority and procurement decision-makers respond well to demonstrated APAC regulatory credentials.

In New Zealand, the compliance landscape is lighter for foreign vendors in one important respect: New Zealand's Privacy Act 2020 (already modernised before Australia's reforms) and the DISTF's voluntary accreditation model mean that a vendor can begin trading without formal accreditation, using Australian compliance artefacts to demonstrate equivalent standards. The NZ AML/CFT Act 2009 (administered by the Department of Internal Affairs for non-financial businesses and the FMA/RBNZ for financial services) imposes obligations on NZ-based reporting entities — again creating demand for RegTech tooling — but the compliance architecture is separate from Australia's and requires localisation. Vendors should engage NZ-specific legal counsel before structuring their NZ go-to-market approach.

Complete these steps before committing to significant ANZ investment:

• ☐ Map your regulated activities: Determine whether your product or service constitutes a "designated service" under the AML/CTF Act — if so, AUSTRAC enrolment is mandatory before you commence.
• ☐ Register as a foreign company with ASIC under Part 5B.2 of the Corporations Act — a prerequisite for most Australian regulatory authorisations and commercial contracting.
• ☐ Appoint an AML/CTF Compliance Officer (if you are or become a reporting entity) with responsibility for your AML/CTF Program design and maintenance.
• ☐ Conduct a Privacy Act gap analysis: Confirm your product architecture complies with the 13 Australian Privacy Principles, with particular attention to APP 8 (cross-border disclosure), APP 11 (security), and the incoming automated-decision explanation right (December 2026).
• ☐ Review Digital ID Act accreditation eligibility: Assess whether ISP, ASP, or IXP accreditation is commercially viable for your product — apply to the ACCC (Digital ID Regulator) and begin the 12–18 month accreditation build.
• ☐ Align biometric and eIDVT capabilities to the Digital ID Act Accreditation Data Standards — biometric matching, presentation attack detection, and eIDVT are codified technical requirements.
• ☐ Identify your tranche 2 channel strategy: Map which professional-service firm segments (lawyers, accountants, real estate, conveyancers) represent the best-fit customer profile and begin pipeline development at least 12 months before the 1 July 2026 deadline.
• ☐ Prepare for the 31 March 2026 existing-entity uplift: If selling to current AUSTRAC reporting entities, audit whether your product supports the updated AML/CTF program, value transfer, and due diligence requirements effective that date.

Once regulatory foundations are in place, execute the following commercial and operational steps:

• ☐ Engage an ANZ RegTech-specialist legal adviser (law firms with AUSTRAC and Digital ID Act expertise) to review your operating model and accreditation strategy.
• ☐ Build an ANZ reference client: Target a tier-2 financial institution, a law firm, or a real estate group as a design-partner or pilot customer — this is the Fenergo and Kyckr playbook and dramatically shortens subsequent enterprise sales cycles.
• ☐ Join AUSTRAC's industry engagement channels: AUSTRAC publishes guidance, consultation papers, and workshops for reporting entities and their technology providers; engagement signals market commitment and provides early visibility of upcoming regulatory changes.
• ☐ Commission an IRAP assessment (via an accredited ACSC-approved assessor) if targeting government or critical-infrastructure clients — this supports Digital ID Act accreditation and government procurement.
• ☐ For NZ: Register your New Zealand entity with the NZ Companies Office; review NZ AML/CFT Act obligations; assess Trust Framework accreditation via the Trust Framework Authority.
• ☐ Localise your privacy documentation: Australian Privacy Policy, data processing agreements, and breach-response procedures must reference the Privacy Act 1988 and APPs specifically — GDPR-aligned documentation is a starting point but is not sufficient.
• ☐ Monitor the AGDIS private-sector participation timeline: Track ACCC announcements on the December 2026 private-sector AGDIS opening and ensure your accreditation status positions you to participate from day one.

No. Accreditation under the Digital ID Act 2024 is voluntary. You can sell identity-verification, KYC, or RegTech services to Australian banks, professional services firms, and other businesses without holding ACCC accreditation. However, accreditation matters commercially in two situations: first, if you want to participate in the Australian Government Digital ID System (AGDIS) and access government relying parties — accreditation will be a prerequisite when private-sector participation opens by December 2026. Second, enterprise clients in regulated industries increasingly include Digital ID Act accreditation (or equivalent technical standards compliance) in their procurement criteria, given the accreditation's rigorous fraud management, privacy, and biometric standards. Vendors targeting the government and banking sectors should treat accreditation as a medium-term commercial necessity even if it is not a legal requirement.

The Financial Transaction Reports Act 1988 (FTR Act) was repealed on 7 January 2025 as part of the AML/CTF modernisation. The FTR Act had operated in parallel with the AML/CTF Act 2006 and imposed certain cash transaction and international funds transfer reporting obligations. Its repeal consolidates all AML/CTF reporting obligations into the AML/CTF Act, simplifying the compliance framework. For RegTech vendors, the practical implication is that products built around FTR Act-specific reporting workflows — particularly older cash-transaction reporting modules — need to be updated to align with the consolidated AUSTRAC AML/CTF Act obligations. Vendors should audit their product's reporting engine against the post-repeal regime and update customer documentation accordingly.

The two frameworks are separate and independently administered — the NZ Digital Identity Services Trust Framework (administered by the NZ Trust Framework Authority) and Australia's Digital ID Act accreditation (administered by the ACCC) are not formally mutual-recognition arrangements. A provider accredited in Australia is not automatically recognised in New Zealand, and vice versa. However, there is significant conceptual alignment: both frameworks are voluntary, both emphasise privacy by design, informed consent, secure cryptographic methods, risk management plans, and data breach protocols, and both are technology-neutral. A vendor holding Australian Digital ID Act accreditation will find that much of its compliance documentation — privacy impact assessments, fraud management frameworks, biometric standards compliance — maps directly to NZ DISTF requirements, reducing the incremental cost of seeking NZ accreditation. Simply Privacy NZ notes this alignment explicitly in its analysis of the framework.

The tipping-off offence under the AML/CTF Act was amended with effect from 31 March 2025. Previously, the offence was broadly framed: disclosing the existence of an SMR (or related information) to virtually anyone could constitute tipping-off, creating significant operational complexity for reporting entities and their technology providers. The reformed offence is narrower: it is only a criminal offence to disclose such information where the disclosure would, or could reasonably be expected to, prejudice an investigation. This is a more proportionate, intent-linked standard aligned with FATF recommendations.

For RegTech vendors building SMR workflow tools, the reform has product implications: audit trail design, access control hierarchies, and SMR data-sharing features between group entities (which are now more clearly permissible where they do not risk prejudicing investigations) should be reviewed against the new standard. Home Affairs guidance on the tipping-off changes should be reviewed alongside any product legal review.

The Digital ID Act 2024 accreditation process is administered by the ACCC as Digital ID Regulator. Accreditation requires demonstration of compliance with the Accreditation Rules and Accreditation Data Standards — covering fraud management, protective security, privacy, accessibility, and technical biometric standards. Vendors typically report that the end-to-end process from initial readiness assessment to accreditation decision takes 12–18 months when building compliance infrastructure from a standing start. Organisations with existing ISO 27001 certification, IRAP assessments, or GDPR compliance programmes can often compress this timeline by re-using existing artefacts.

Verified cost figures for the accreditation process are not published by the ACCC, and costs vary significantly based on the complexity of the applicant's technical architecture and the maturity of its existing compliance programme. Vendors should budget for legal and technical advisory support, internal compliance resource, and potential remediation costs identified during the accreditation assessment. Given the December 2026 deadline for AGDIS private-sector participation, vendors targeting the government channel should initiate their accreditation application no later than Q1 2025 — or as early as possible if starting now.