logo image
LoginGet Started
All Articles

When Should a Growing Business Move from Spreadsheets to a Compliance Platform? 5 Signs It’s Time (Especially Under AUSTRAC Tranche 2)

Introduction

Almost every Australian fintech, MSB, or professional services firm starts its compliance journey the same way: a single spreadsheet, a shared drive folder, and a compliance officer who knows where everything is.
In the early days, it works. You’re onboarding a handful of customers a week, you can recite every higher-risk case from memory, and a quick row in Excel feels faster than any software. But somewhere between your first hundred customers and your first thousand, the cracks start to show: missed reviews, version-conflicted files, an audit request that takes three days to answer instead of three minutes.

Now layer on AUSTRAC’s reforms to the AML/CTF Act, which commence on 31 March 2026 for existing reporting entities and 1 July 2026 for Tranche 2 entities including legal, accounting, real estate, and jeweler industries. The compliance bar isn’t just rising; it’s expanding tens of thousands of additional businesses being captured into the regulatory net. For both existing reporting entities and newly regulated sectors, AUSTRAC compliance is moving from “good enough” to “empirically justifiable.”

That shift is the tipping point where spreadsheets stop being a pragmatic tool and start being a liability. Below are the five clearest signs your business has reached and what to do about it.

Sign 1: More Customers = More Manual Checks and More Room for Error

Customer due diligence (CDD) scales linearly with growth. Every new customer is another identity to verify, another sanctions check to run, another risk rating to assign, another set of records to file. In a spreadsheet world, every one of those steps is a human action (copy, paste, screenshot, save, name the file, link it back to the row).

The error rate creeps up quietly. Independent research consistently puts the human error rate in manual data entry at roughly 1% per cell under good conditions, climbing significantly when the work is repetitive and time-critical. At 50 customers a month, that’s noise. At 500, it’s a regulatory exposure.
Where spreadsheets break down at scale:

  • Inconsistent data formats (DOB entered six different ways)
  • PEP and sanctions screening done weeks apart, or skipped entirely
  • Risk ratings that drift because two people scored “medium” differently
  • Identity documents stored in someone’s inbox rather than against the customer record
  • Re-verification dates that quietly pass with no alert

Under AUSTRAC Tranche 2, the new AML/CTF Rules tighten what counts as adequate CDD – including lowering the initial CDD threshold for certain gambling services from $10,000 to $5,000. If your verification process is held together by manual diligence and good intentions, the volume will eventually break it.AUSTRAC

Key takeaway: Manual CDD is sustainable until it isn’t. The moment you can’t confidently say every customer was checked to the same standard, automated customer due diligence stops being a luxury.

Sign 2: Compliance Information Lives in Too Many Places

Ask a growing compliance team where a specific customer’s KYC file is, and the answer often involves a chain: “The ID is in the CRM, the sanctions screenshot is in Slack, the risk assessment is in the master sheet, the SMR draft is in someone’s drafts folder, and the source-of-funds evidence is in an email thread from March.”
That’s not a process – it’s an archaeological dig.

Fragmentation is one of the most common, and most expensive, signs a business has outgrown spreadsheets. Each system holds part of the picture, and only the person who built the workflow knows how the parts connect. The risks compound:
  • Single points of failure. When that person is on leave, knowledge walks out the door with them.
  • Inconsistent records. The CRM says the customer is low risk; the spreadsheet says medium.
  • Slow incident response. A regulator query that should take an hour, takes a week.
  • Data security gaps. Sensitive identity documents sitting in inboxes and shared drives are an obvious exposure under the Privacy Act and APP 11.
A modern compliance platform doesn’t just replace the spreadsheet – it consolidates the record. Customer profile, verification evidence, risk rating, monitoring alerts, review history, and reporting status sit in one place, against one customer, with one timestamped history.
For Tranche 2 readiness specifically, that consolidation matters because AUSTRAC expects you to demonstrate a coherent AML/CTF program, not assemble one retrospectively from six different sources.

Sign 3: It’s Hard to Prove What Was Checked and When

Here’s a useful thought experiment: if AUSTRAC asked you tomorrow to produce the complete CDD record for a specific customer including who verified them, what documents were sighted, what screening was run on what date, every risk rating change, every review, and every monitoring alert – how long would it take?
If the answer is more than a few minutes, you have an audit trail problem.

Demonstrating “reasonable steps” is the spine of AUSTRAC compliance. It’s what separates a defensible AML/CTF program from one that exposes the business to enforceable undertakings, civil penalty orders, or remediation programs and it’s exactly what spreadsheets are worst at, because:
  • Cell histories aren’t real audit logs
  • “Last modified by” doesn’t capture what was changed
  • Files get renamed, moved, or accidentally overwritten
  • Screenshots prove a check happened, not when it happened or what the underlying data was
  • There’s no tamper-evidence
A compliance platform produces an immutable, timestamped audit trail by default. Every check, every override, every decision is logged against a user and a moment in time. When a regulator or your own auditor asks the inevitable “show me,” the answer is a few clicks rather than a few days.
This becomes especially important under Tranche 2 because AUSTRAC has signaled an outcomes-focused regulatory model. You’re not just expected to follow the process; you’re expected to prove the process worked.
Key takeaway: If you can’t reconstruct the full compliance history of any customer in under five minutes, your audit trail isn’t compliance ready.

Sign 4: Monitoring and Reviews Become Inconsistent

Onboarding is the easy part of AML compliance. Ongoing customer due diligence is where most manual programs quietly fail.

A customer onboarded as low-risk two years ago may not be low-risk today. Their transaction patterns may have shifted. Their beneficial ownership may have changed. They may now appear on a sanctions or PEP list. Under the new rules, your obligation isn’t just to assess risk at the door, it’s to keep assessing it throughout the relationship.
In a spreadsheet model, ongoing monitoring usually looks like:

  • A column for “next review date”
  • A calendar reminder that fires for the compliance officer
  • A scramble to find the file and redo the assessment
  • A note added back to the row
When you have 200 customers, that’s manageable. When you have 20,000, it isn’t. Reviews slip. Sanctions list updates aren’t re-run against your back-book. Transaction patterns aren’t monitored in real time and they’re spot-checked when something looks weird.
Tranche 2 raises the stakes further. The unified AML/CTF program model expected from 2026 places stronger emphasis on dynamic, risk-based monitoring rather than periodic point-in-time reviews. That’s effectively impossible to deliver manually past a certain scale.
A compliance platform handles this automatically: continuous sanctions and PEP rescreening, behaviour-based transaction monitoring, automated review scheduling, and risk-rating recalculation when customer attributes change. The compliance officer’s job shifts from running checks to investigating the ones that matter.

Sign 5: The Team Spends Too Much Time on Administration Instead of Risk Management

This is the sign most founders miss until it’s already costing them.
Watch what a manual-process compliance team does day-to-day: copying IDs between systems, formatting evidence into PDF packs, chasing customers for missing documents over email, manually re-running sanctions checks before a review, tagging spreadsheet rows, exporting data for the monthly report. Most of it is the administration. Very little of it is risk management.

This isn’t a productivity complaint, it’s a risk one. When experienced compliance professionals spend 70–80% of their time on data movement, two things happen:
  • Real risk gets missed. The unusual transaction, the subtle structuring pattern, the customer whose stated source of wealth doesn’t quite add up; these need a human looking at them carefully. They don’t get that attention when the same human is reformatting a spreadsheet.
  • Good people leave. Senior compliance hires don’t stay long in roles that have quietly become data-entry jobs. Replacing them is expensive, and the institutional knowledge that leaves your business with them is hard to rebuild.A compliance platform inverts the ratio where routine work is automated, and humans focus on judgement calls. That is exactly the work AUSTRAC, in an outcomes-focused regime, increasingly wants to see being done.
  • Key takeaway: If your compliance team is too busy to think, your compliance program isn’t working, regardless of what the spreadsheet says.

Conclusion: What to Look for in a Compliance Platform as the Business Scales

Moving from spreadsheets to a compliance platform isn’t about chasing software as that seems to be your best solution. It’s about reaching the point where your manual processes can no longer defensibly support the obligations you’ve taken on, and the obligations of Tranche 2 are about to add.

When you evaluate platforms, look for a tool that genuinely fits a growing business rather than a global bank. Strong candidates share a few characteristics:

  • End-to-end CDD and EDD automation: identity verification, sanctions and PEP screening, beneficial ownership, and risk scoring in one workflow
  • A centralised, immutable audit trail: every action timestamped, attributable, and reproducible on demand
  • Real-time ongoing monitoring: continuous rescreening and transaction monitoring rather than scheduled batch checks
  • AUSTRAC reporting readiness: SMRs, TTRs, and IFTI reporting built into the workflow, aligned to the AML/CTF Rules 2025
  • Scalability without enterprise bloat: the configurability of a serious tool without a 12-month implementation
  • Integration capabilities: clean APIs into your CRM, core banking, payments, or onboarding stack
  • Strong data security and Australian data residency: encryption, access controls, and infrastructure choices that align with the Privacy Act and your customers’ expectations

The honest truth is that spreadsheets were never designed for AML compliance; they were tolerated as long as the volume was small, and the obligations were simple. With 31 March 2026 and 1 July 2026 in the calendar, neither of those conditions holds anymore.

The businesses that will navigate Tranche 2 most smoothly aren’t the ones with the biggest compliance teams. They’re the ones that recognised the tipping point early and built infrastructure that can grow with them – quietly, defensibly, and without burning out the people who keep them compliant.

Answers, before you ask.

Is Excel still acceptable for AUSTRAC compliance?
There’s no rule banning spreadsheets, but they make it increasingly difficult to demonstrate “reasonable steps” as volume grows. Excel can’t produce a tamper-evident audit trail, can’t run continuous monitoring, and can’t enforce consistent processes across a team. For low-volume reporting entities it may still be workable; for anyone scaling toward or already operating at meaningful transaction volumes, it’s a growing risk rather than a control.
How does AUSTRAC Tranche 2 change my obligations?
Tranche 2 extends AML/CTF obligations to previously unregulated sectors, including legal, accounting, real estate, trust and company service providers, and dealers in precious metals and stones — alongside expanded obligations for virtual asset service providers and updated rules for existing reporting entities. Obligations commence 31 March 2026 for existing reporting entities and 1 July 2026 for newly regulated Tranche 2 entities.
When do I need to be enrolled with AUSTRAC?
Enrolment for newly regulated entities opens on 31 March 2026 and must be completed by 29 July 2026. Existing reporting entities should already be enrolled and transitioning to the updated AML/CTF program model.
What's the real cost of staying on spreadsheets?
Beyond the obvious risk of enforcement action, the hidden costs include compliance officer time spent on administration rather than risk analysis, slow response times to regulator queries, higher staff turnover in compliance roles, and the operational drag of remediating issues that a system would have prevented at the point of capture.
Do small businesses really need a compliance platform?
Not always. A sole practitioner with a small, low-risk client base may reasonably manage documented manual processes. The question isn’t size, it’s whether you can consistently demonstrate that your AML/CTF program is operating as designed. Once the answer becomes “only if I work the weekend to prepare the evidence,” it’s time.
What's the difference between CDD automation and just using digital ID verification?
Digital ID verification is one component of CDD. True customer due diligence automation also covers risk rating, sanctions and PEP screening, beneficial ownership analysis, ongoing monitoring, and the linking of all of those into a single auditable customer record. Many businesses have the verification piece but still rely on spreadsheets for everything around them, which is where the gaps usually sit.
How long does it take to implement a compliance platform?
Modern platforms aimed at growing businesses typically deploy in weeks rather than months. The longer pole in the tent is usually internal decisions, agreeing with your risk appetite, documenting your AML/CTF program, and migrating existing customer records rather than the technology itself.

Date published

08/01/2026

Time to read

19 minute read

Author

Madhurima Guha

Co Founder, Head of Operations

Locations

Australia
Contact Us

Don’t wait until the deadline.

Start your Tranche 2 compliance journey today

Book A Demo