Commencement dates are not implementation plans

The morning of 1 July 2026 will look unremarkable from the outside. Five Australian agencies will open for business, as they do every day. But each will be responsible for enforcing a major framework that did not exist a year earlier, and not one will have more staff than it had the day before.

That is the part the legislation does not cover. Passage is comparatively easy: Royal assent here, a commencement date there, and a press release later we call it a day.

What follows is considerably harder: building the supervisory infrastructure that makes a new law mean something in practice. And right now, across Australia, five regulators are finding out whether they managed to build it in time.

Before you can enforce

Before a regulator can act meaningfully against a non-compliant entity, three conditions need to hold simultaneously.

First, regulated entities have to know what is expected of them. That means guidance is published, sector education is complete, starter kits are distributed, and questions are answered. The standard cannot arrive at the same moment as the sanction.

Second, the regulator has to be able to see what is happening. Reporting systems, intelligence feeds, and data pipelines have to be live. Enforcement without visibility is guesswork with legal authority attached.

Third, the regulator has to have a credible, proportionate response ready: a graduated tool set, internal escalation protocols, and confirmed legal authority. The absence of any one of these undermines the others.

The Australian Transaction Reports and Analysis Centre’s (AUSTRAC) approach to Tranche 2 is a clean illustration of how this sequencing works in practice. 

The agency published sector-specific starter kits in January, opened enrolment on 31 March, and has told the market directly that early enforcement will focus on entities that wilfully ignore the obligation to enrol or are complicit with – or wilfully blind to – money laundering in their business. Technical errors in a new anti-money laundering and counter-terrorism financing (AML/CTF) programme from a law firm that enrolled in good faith are not the priority. Entities that never showed up at all are.

Technical errors in a new AML/CTF programme from a law firm that enrolled in good faith are not the priority. Entities that never showed up at all are.

Sequencing lets supervisors and firms learn the new regime together – and concentrates scarce enforcement capacity on actual risk rather than distributing it thinly across a population of 90,000 newly regulated entities, most of whom are genuinely trying to comply.

The capacity problem nobody budgets for

The hardest part of any major implementation is the part that never appears in the agency’s budget submission: the load on existing teams while those teams are simultaneously running the prior regime, managing transition-period queries, and absorbing the political noise that surrounds any contentious reform.

The Aged Care Quality and Safety Commission (ACQSC) is a useful illustration. It commenced the rights-based aged care framework on 1 November 2025 – a complete regulatory reset, shifting from a provider-centric model to one built around the rights of older people – while simultaneously registering providers under new categories, operationalising an expanded Complaints Commissioner function, and embedding strengthened standards across the sector. No new regulator was stood up. An existing one was rebuilt in motion.

This is how most major regulatory change actually happens. Agencies that plan for it – by identifying which functions can be phased, which can be deferred, and which have to be live from day one – tend to build durable capability faster than those that try to make everything operational at once.

The reasonable steps problem

Several of the July 2026 frameworks hinge on an intentionally flexible standard: reasonable steps. The Scams Prevention Framework (SPF) uses it. The social media age-assurance regime uses it. This is defensible legislative design for a fast-moving space, but it creates a specific challenge for the regulator.

You cannot enforce reasonable steps without first publishing what you think reasonable looks like. That guidance work is unglamorous, slow, and resource-intensive. And it has to precede meaningful enforcement, not follow it.

The Australian Financial Complaints Authority’s (AFCA) expanded scam jurisdiction, which went live on 12 March, gives a glimpse of what happens when dispute resolution starts before that guidance is complete. AFCA can now consider complaints against receiving banks – including from consumers who are not their customers – but the standards for what constitutes adequate scam prevention are still being worked out. The standard will be built case by case, which is a legitimate common-law process. It is also expensive for every party involved, and slower than guidance would have been.

The guidance work that precedes enforcement deserves the same senior attention as the legislation that preceded it.

That isn’t to imply that AFCA moved too fast. The jurisdiction change was deliberate, and the incoming SPF required a visible commitment to accountability before the full external dispute resolution (EDR) framework was ready. But the episode illustrates why the guidance work that precedes enforcement deserves the same senior attention as the legislation that preceded it.

What the strongest implementations share

Looking across recent regimes, three habits keep turning up in the implementations that stick.

Agencies that use time deliberately – through phased commencement, transitional deferrals, and plans-over-perfection signals – concentrate their scarce capacity on genuine risk rather than spreading it across a population still finding its feet. AUSTRAC’s three-year customer due diligence (CDD) transition window for existing reporting entities is not a concession. It reflects where the actual money laundering risk sits.

Agencies that publish clear early guidance on what the flexible standard requires reduce litigation exposure for themselves and compliance costs for industry at the same time.

Agencies that take visible early action – a public statement, a named compliance notice, even a formal information request – in the first quarter signal that the regime is real without overwhelming their own capacity. That signal is how the regulated population decides whether the regime is real.

But in the pressure of a major commencement, all three habits are easy to deprioritise in favour of managing immediate queries and putting out immediate fires.

The implementation years

The July 2026 crunch may be Australian, but the pattern is not. UK regulators went through a version of this when Consumer Duty, the Digital Markets, Competition and Consumers Act designations, and Online Safety enforcement arrived in close sequence. New Zealand is about to face it as the Regulatory Standards Board begins its first full year of operation – scrutinising legislation, fielding complaints, and testing whether transparency obligations translate into practice.

After a decade of framework-building, passing the law has become the straightforward part. Making it mean something on a Monday morning is where the real implementation risk lives – and where the work begins.