For a small firm, the hardest part of a suspicious matter report (SMR) is often not lodging it. It is the conversation afterwards. The client calls to ask why their settlement is delayed, a colleague asks why a file has been closed, or the client’s accountant wants to know what is going on. Say the wrong thing and you risk committing the tipping off offence.
Australia’s tipping off offence changed on 31 March 2025, and many firms newly regulated under Tranche 2 have never had to think about it before. This guide explains the current offence, what information it protects, who it applies to, and what you and your staff can safely say in common situations. It is general information, not legal advice.
What tipping off means now
Under section 123 of the AML/CTF Act, as amended, it is an offence to disclose certain SMR-related information to another person, other than an AUSTRAC entrusted person, where the disclosure would or could reasonably be expected to prejudice an investigation. The investigation might be into an offence against Commonwealth, state or territory law, or a proceeds of crime matter.
AUSTRAC explains that the change moved the focus to whether a disclosure could prejudice an investigation. As an example, it says prejudice could arise if information gets back to the subject of a report, or to someone associated with them, or if it is released publicly.
The offence carries a maximum penalty of two years’ imprisonment, a fine of 120 penalty units, or both.
What information is protected
The protected information is broader than the SMR itself. It includes:
- that a reporting entity has given a suspicious matter report, or is required to give one
- related information set out in section 123(2), such as the contents of a report
- that a person has been required by an AUSTRAC notice to give information or produce documents, or has responded to one
That last point matters. Telling a client ‘we’ve had to send something to AUSTRAC about you’ is an obvious problem, but so is an indirect hint, such as ‘you’ll understand we have reporting obligations in situations like this’.
Who the offence applies to
The offence applies to anyone who is or has been a reporting entity, or an officer, employee or agent of one, so it continues to apply after someone leaves the business. In a small firm, that means the receptionist who takes the client’s call is covered just as much as the principal who lodged the report. Everyone who might be asked about a file needs to know the basics.
What staff can and can’t say
| Situation | A safer approach | Avoid |
|---|---|---|
| Client asks why their matter is delayed | ‘We need some more information to complete our checks before we can proceed.’ | Mentioning AUSTRAC, a report or a suspicion |
| You decide to stop acting for the client | ‘We are unable to continue acting on this matter.’ | Explaining that the decision follows a report or a concern about the client |
| You need more information for enhanced checks | Ask questions as part of normal due diligence, such as source of funds | Saying the questions are needed because something looked suspicious |
| A colleague asks why a file is restricted | Refer them to the compliance officer | Discussing the report in open-plan areas, shared chats or general email |
| The client’s adviser or family member calls | Speak only about the matter in general terms, if at all, and refer to the compliance officer | Confirming any suspicion or report to anyone connected to the client |
| A sanctions asset freeze is involved | DFAT permits you to say an asset has been frozen in compliance with Australian sanctions laws | Linking the freeze to any SMR |
The common thread is to describe what is happening in the ordinary language of due diligence, and to say nothing about why beyond that.
Practical controls for a small firm
You do not need a large compliance team to manage tipping off risk. A few habits go a long way.
Limit who knows. Keep knowledge of an SMR to the compliance officer and the people who genuinely need it. Everyone else only needs to know that a file is restricted.
Store records separately. AUSTRAC’s record keeping guidance says sensitive records such as SMRs should be stored securely with access limited to authorised staff, and notes that insecure storage makes tipping off more likely. Keep SMR records out of the general client file and away from shared drives that clients’ advisers can access.
Script the hard calls. Agree two or three neutral sentences that staff can use when a client asks about a delay or a closed file. Practising them once is enough for most teams.
Watch written communications. Emails, file notes visible to clients, portal messages and invoices can all leak information. A file note reading ‘SMR lodged, do not proceed’ in a client-visible system is a tipping off risk.
Train new staff. Tipping off belongs in your AML/CTF training for anyone who deals with clients, not just the compliance officer.
What is not tipping off
The current offence is not a blanket ban on saying anything. A disclosure is only an offence if it would or could reasonably be expected to prejudice an investigation. Telling a client that you need more information, that you are unable to act, or that you have frozen an asset under sanctions law, without linking any of it to a report or suspicion, will generally not involve the protected information at all. Where you are unsure whether a particular disclosure is safe, take advice before making it.
Frequently asked questions
Can I tell the client I have lodged an SMR?
No. Telling the subject of a report that a report was made, or that you formed a suspicion, is the clearest example of a disclosure that could prejudice an investigation.
Can I still refuse to act after lodging an SMR?
Yes. AUSTRAC’s guidance allows you to stop providing services, but you must not provide information that establishes you submitted an SMR. Keep the explanation neutral.
Does tipping off apply if I lodged the SMR months ago?
The offence is about the disclosure, not the timing. It continues to apply to the information, and to people who have since left your business.
Can I discuss an SMR inside my firm?
Share it only with people who need to know for the purpose of your AML/CTF obligations, and keep the records restricted. Disclosures that could find their way back to the client are the risk.
What about sanctions matters?
DFAT permits you to tell a designated person or entity that an asset has been frozen in compliance with Australian sanctions laws. Do not link that disclosure to any SMR.
How NameScan can help
Many SMRs begin with a screening result that needs a closer look. NameScan lets small firms run PEP, sanctions and adverse media checks on a pay-as-you-go basis, review and record decisions on each result, and keep dated records that sit with the rest of the CDD file. Keep any SMR-related notes in your restricted compliance records rather than with general screening results.
Start screening with NameScan, or read our guide to what to do when a client won’t provide information.
0 Comments