Tranche 2
AML/CTF for trust and company service providers: formation, nominee and registered-office obligations
If your business creates or manages legal entities for clients — forming companies and trusts, supplying nominee directors or shareholders, transferring shelf companies, or providing registered offices — you are a trust and company service provider, and your core service is exactly what Tranche 2 regulates. For TCSPs, AML/CTF is not an edge case: it is the business.
Why TCSPs are squarely in scope
The professional designated services in the AML/CTF Act read like a TCSP service list: creating companies, trusts and other legal arrangements; restructuring them; transferring shelf companies; acting as or arranging nominee directors, officers or shareholders; providing registered offices and business addresses; and acting in trust administration roles. If any of these is your everyday work, your business is a reporting entity.
The risk AUSTRAC sees in your service
Structures obscure ownership — that is precisely why clients buy them, and why launderers buy them too. AUSTRAC's concern is the formation mill that never asks who is really behind the entity. Your compliance value is concentrated in two places: knowing who your client actually is, and knowing who will ultimately own or control every entity you create or manage.
Customer due diligence for a TCSP
- Verify the instructing client — the person or business engaging you — before the formation or service is provided
- Map and verify the beneficial owners of every entity you form: the individuals at 25% or more, or who control it another way (appointors, trustees, controllers)
- Walk layered structures: where an entity owns an entity, keep walking until you reach real people
- Screen the client, the new entity's controllers and beneficial owners against sanctions, PEP lists and adverse media
- Record a risk rating per engagement — offshore controllers, complex layering and unexplained urgency all push risk up
- Re-verify on a risk-based cycle, especially for entities you continue to administer
Ongoing services mean ongoing obligations
A TCSP that only forms an entity and walks away has a point-in-time file. A TCSP that keeps the registered office, the nominee role or the administration has an ongoing relationship — and ongoing due diligence: rescreening, review cycles, document expiry tracking, and refreshed verification when controllers change. Nominee arrangements deserve special discipline: your name (or your staff's) sits on public registers attached to entities controlled by others.
Red flags in formation and administration work
These patterns are suspicious-matter territory: report to AUSTRAC (generally within three business days of the suspicion forming) and never tip off the client.
- Clients who cannot or will not explain the commercial purpose of the structure
- Unnecessary layers, especially across jurisdictions with no business logic
- Requests for nominee arrangements designed to distance the real owner from the entity
- Shelf company transfers where the buyer's identity or purpose is vague
- Clients who resist beneficial-ownership disclosure or provide inconsistent ownership stories
Frequently asked questions
We only form companies — we never touch client money. Are we captured?
Yes. Forming a company or trust is itself a designated service; handling money is not required for capture. A formation-only business is a reporting entity and needs enrolment, a program, CDD and record-keeping like everyone else.
Who is the beneficial owner of a company we form for a client?
The individuals who ultimately own or control it — normally those holding 25% or more directly or indirectly, plus anyone controlling it another way, such as an appointor or a person with veto rights. Where a client asks you to act as nominee shareholder, the beneficial owner is the person you are holding for, and the file must say so.
Do we need to redo CDD for entities we formed years ago?
For ongoing relationships (registered office, nominee, administration), yes — on a risk-based cycle and on trigger events such as controller changes. For completed one-off formations, keep the original file for seven years and apply your program's review rules if the client returns.
Can we refuse a formation if the client fails verification?
You must not provide the designated service if you cannot complete the required due diligence. A clear verification-first policy at engagement time is the simplest control.
Put it into practice
Cassandra AML turns these obligations into a working system: designated-service decisions, customer due diligence, screening, monitoring and reporting records — hosted in Sydney, free to start.
This guide is general information for Australian professionals. It is not legal advice and does not replace the AML/CTF Act, the AML/CTF Rules or AUSTRAC guidance. Confirm your specific obligations with AUSTRAC or a qualified legal adviser.