Australian compliance developments for 4 October 2026, including TPB sanctions, Victorian property rules, strata training and secure AI access.
Weekly overview
Several previously announced reforms became operational this week. The Tax Practitioners Board’s expanded sanctions framework commenced nationally on 1 October. Victorian property-price disclosure reforms also moved into effect, although some requirements apply only to auctions and fixed-date sales from 16 October. NSW introduced annual training for strata committee members. AUSTRAC refreshed its education calendar rather than announcing a new regulatory obligation. Separately, Australian cyber authorities warned that compromised credentials are being used to obtain unauthorised access to organisational AI services. The common compliance challenge is execution: assigning owners, updating systems and retaining evidence that new controls are working.
Key dates and deadlines
Legal practices
Cyber authority warns organisations to secure access to AI services
Jurisdiction: National. Status: government cybersecurity advisory, not a new statutory obligation.
On 28 September, the Australian Signals Directorate warned that malicious actors are obtaining unauthorised access to organisational AI services through compromised API keys, authentication tokens, user sessions, vulnerable applications and third-party arrangements.
The guidance recommends maintaining an inventory of AI accounts and service identities, assigning an owner to each, applying least-privilege access, protecting credentials with phishing-resistant multi-factor authentication, monitoring unusual activity and limiting suppliers to auditable access. It also warns that a compromised AI agent may be able to reach connected systems or organisational data beyond the AI service itself. Cyber.gov.au
Why it matters: Legal practices increasingly connect AI tools to document repositories, email, practice-management platforms and client information. A compromised token may therefore create confidentiality, privacy and professional-conduct risks beyond the cost of unauthorised AI usage.
Practical consideration, LawMatter analysis: Create a register of approved AI tools, account owners, integrations and stored credentials. Check whether departed staff, contractors or proof-of-concept applications retain access. Document the process for revoking tokens, preserving logs and notifying the responsible partner if a compromise is suspected.
Source: Australian Signals Directorate, 28 September 2026, Protect your organisation’s AI services.
Accountants, bookkeepers and tax practitioners
TPB’s expanded sanctions framework is now operating
Jurisdiction: National. Status: confirmed requirements in force from 1 October 2026.
The commencement of the Tax Practitioners Board’s enhanced sanctions framework is the material development this week. The reforms were previewed in the earlier round-up, but the powers are now operational.
The framework introduces new criminal penalties for serious unregistered activity, civil penalties for Code of Professional Conduct breaches, increased maximum civil penalties, infringement notices, enforceable undertakings and new suspension mechanisms. The maximum period during which a terminated practitioner may be prevented from applying for registration has increased to 10 years.
The TPB states that it will use a measured, proportionate and risk-based approach. It also says the changes are directed at misconduct and are not intended to impose additional regulatory burden on practitioners already meeting their obligations. Tax Practitioners Board
Why it matters: Failures involving client confidentiality, trust money, professional knowledge, insurance, client records and cooperation with the TPB can now attract a broader range of responses.
Practical consideration, LawMatter analysis: Review the practice’s Code compliance register and escalation process. Confirm that client-record, professional indemnity insurance, CPE and complaint-handling evidence can be produced promptly. Practices using offshore teams or unregistered service providers should also verify supervision, representations to clients and the boundaries of work performed.
Source: Tax Practitioners Board, current from 1 October 2026, Enhancing the TPB sanctions regime.
Jewellers and precious-metal or precious-stone dealers
No significant compliance development identified this week.
AUSTRAC’s refreshed webinar schedule includes a general Industry Insights session on 22 October that covers, among other sectors, bullion. However, AUSTRAC did not announce a new jeweller or precious-stone dealer obligation within this reporting period. AUSTRAC
Practical consideration, LawMatter analysis: Businesses that deal in both jewellery and investment-grade bullion should distinguish the services and transaction types that create regulatory obligations. Training should explain how to identify linked transactions and where customer and transaction decisions are recorded.
Conveyancers
Victorian price-disclosure reforms move into operation
Jurisdiction: Victoria. Status: confirmed requirements, with staggered application dates.
Consumer Affairs Victoria updated its guidance on 1 October to confirm that the property-sales reforms have commenced. The new Property Price Statement replaces the Statement of Information and must include key features of the sale property and comparable properties.
Sold prices must generally be added to the statement within seven days after a sale becomes unconditional, for relevant sales becoming unconditional from 1 October. The statement must then remain publicly available for at least 18 months unless an approved exemption applies.
The reserve-price, Property Price Statement and comparable-property requirements apply to auctions and fixed-date sales held from 16 October. Consumer Affairs Victoria
Why it matters: Most obligations sit with the estate agent, but conveyancers may hold the clearest information about contract conditions, unconditional dates and personal or family violence considerations relevant to an exemption.
Practical consideration, LawMatter analysis: Agree how and when the conveyancer will notify the agent that a contract has become unconditional. Avoid assuming the other party has supplied the information. Record the date, recipient and content of every operational handover.
Source: Consumer Affairs Victoria, updated 1 October 2026, New changes to property sales and underquoting laws.
Real estate professionals
Victorian advertising and sold-price processes require immediate attention
Jurisdiction: Victoria. Status: confirmed requirements in force or subject to the 16 October transition.
Agents should now be using the approved Property Price Statement and preparing systems for applicable auctions and fixed-date sales from 16 October. Reserve prices must be stated as a single dollar amount and published at least seven days before the relevant auction or sale. If the reserve price has not been published in time, the event cannot proceed.
Online placement, sold-price updates, exemption decisions and the 18-month publication period all require reliable workflow ownership. Consumer Affairs Victoria
Practical consideration, LawMatter analysis: Test the entire process using a current listing. Check the document template, placement beside the advertised price, approval trail, unconditional-date trigger, sold-price update and retention period.
NSW strata committee training requirement commences
Jurisdiction: NSW. Status: confirmed requirement in force from 1 October 2026.
NSW strata committee members must now complete free online training annually within three months of appointment. Two-lot schemes, commonly duplexes, have been exempted from annual Strata Hub reporting. The changes affect strata managing agents, developers, owners and committee members, and generally extend to community land schemes. NSW Government
Why it matters: Strata managers may need to distinguish between supporting committee compliance and personally completing the committee members’ obligation.
Practical consideration, LawMatter analysis: Record appointment dates, calculate each member’s training deadline and retain completion evidence. Update induction packs and meeting templates so responsibility is visible from the beginning of the appointment.
Source: NSW Fair Trading, effective 1 October 2026, Changes to strata laws.
AUSTRAC and Australia’s AML/CTF regime
AUSTRAC expands its October education calendar
Jurisdiction: National. Status: education update, not a change to legal obligations.
AUSTRAC updated its webinar page on 1 October. Upcoming sessions include an AML30 webinar on following financial footprints associated with child sexual exploitation on 15 October and Industry Insights sessions covering payments, bullion and other regulated sectors later in the month. Recorded customer due diligence material is also available on initial, simplified, ongoing and enhanced due diligence. AUSTRAC
Why it matters: Regulatory education provides useful material for role-based training, but attending a webinar does not by itself demonstrate that a business has implemented appropriate controls.
Practical consideration, LawMatter analysis: Select sessions according to the business’s risks. After attendance, record what was learned, whether the risk assessment needs updating and who owns any resulting action.
Source: AUSTRAC, updated 1 October 2026, AML/CTF webinars.
Cross-industry insight
LawMatter analysis: The week’s developments illustrate the gap between knowing a rule and operationalising it. A commencement date must trigger assigned tasks, revised forms, system changes, staff communication and evidence of completion.
The same principle applies to AML/CTF programs. A policy should connect to named owners, decision points, escalation routes, record-retention rules and periodic testing. If a practice cannot reconstruct what happened from its records, the control may exist on paper but not in operation.
What to watch next week
- The first Victorian reserve-price disclosures due on 9 October for auctions and fixed-date sales on 16 October.
- Early implementation questions arising from the TPB’s new enforcement framework.
- Further AUSTRAC guidance or sector-specific education announcements.
- Cybersecurity updates following confirmed exploitation of Citrix NetScaler vulnerabilities affecting Australian organisations. Cyber.gov.au
Comply.LM helps professional practices structure customer checks, risk decisions and supporting compliance records in one place. Learn more about Comply.LM.
This article provides general information only and does not constitute legal, regulatory or professional advice.