← Back to writing
AIEntity ResolutionAML/CTFGraph

The 80,000-Entity Wave: Why Tranche 2 Is an Entity Resolution Problem, Not a Compliance One

7 min read
The 80,000-Entity Wave: Why Tranche 2 Is an Entity Resolution Problem, Not a Compliance One

The TL;DR is that the anti-money-laundering reforms known as Tranche 2 are being sold to the newly captured professions as an onboarding and compliance exercise, when the real problem sits downstream, inside the financial intelligence system that now has to resolve, monitor and make sense of roughly 80,000 new reporting entities without drowning its analysts in false positives (Australian Transaction Reports and Analysis Centre, 2025).

This article argues that Tranche 2 is an entity resolution and cost-per-decision problem wearing a compliance costume. If we bolt AI onto the reporting wave without getting the identity-matching and the economics right first, we will either miss the signal or bankrupt the monitoring. Both outcomes fail the public.

The question I keep asking is this: when 80,000 new entities start filing reports, are we building a bigger inbox, or a better brain?

Introduction

Australia has finally extended its anti-money-laundering and counter-terrorism-financing regime to the so-called tranche two professions, the lawyers, accountants, real estate agents, and dealers in precious metals and stones. The new obligations commenced on 1 July 2026, and newly captured businesses have until 29 July 2026 to enrol with AUSTRAC (Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth)). Most of the commentary, understandably, is aimed at those professions: how to enrol, how to build a compliance program, how to file a suspicious matter report.

That is the easy part. It is the part that fits in a portal and a policy document. But you did not come here for the easy part.

The hard part lands on the financial intelligence unit and its partners, because a regime that suddenly ingests reports from tens of thousands of new sources does not get smarter by default. It gets louder. And louder is not the same as safer.

The Wave Nobody Is Architecting For

Let us peel back the layers. Tranche 2 lifts AUSTRAC's regulated population from about 19,000 businesses to over 100,000 (Australian Transaction Reports and Analysis Centre, 2025). When the reporting population expands by roughly 80,000 entities, three things happen at once, and each one compounds the next.

  • The volume of reports climbs steeply. More entities, more transactions monitored, more suspicious matter reports. The intake grows, but the number of analysts does not, because public sector staffing is capped and specialist financial-intelligence talent is thin.

  • The quality of incoming data drops. New entrants, new systems, inconsistent identity data, patchy record-keeping. A real estate agency's idea of a customer record is not a bank's.

  • The same real-world people appear under many new guises. A person known to the system through their bank now also appears through their conveyancer, their accountant, and a property settlement, each with a slightly different name, address, or identifier.

That third point is the one everyone underestimates, and it is the whole game.

It Is an Entity Resolution Problem

Here is the shift in thinking. The value of Tranche 2 is not in collecting more reports. It is in correctly joining the new reports to the entities and networks the system already tracks. That is entity resolution, and it is a genuinely hard problem that the record-linkage literature has been working on for over fifty years (Fellegi & Sunter, 1969).

Get it right and a property settlement, a suspicious cash purchase, and a known network suddenly connect into a picture worth acting on. Get it wrong in one direction and you miss the link, and the money moves. Get it wrong in the other direction and you falsely tie an innocent conveyancer or an ordinary home buyer to a network they have nothing to do with, which is its own serious harm.

This is where the maths gets uncomfortable. Entity resolution trades false positives against false negatives, and in a screening context with a low base rate of actual criminality, even a good matcher produces a large number of false links simply because most people are innocent (Fellegi & Sunter, 1969). Scale the reporting population by 80,000 and you scale that false-positive burden with it.

This issue however is far more pervasive than just AUSTRAC, look at Firearms Criminal Intelligence Assessment (CIA) changes coming upstream post the tragedy of the Bondi Beach Shooting in 2025 through to the colossal changes we are seeing in our Military Kill Chains to achieve decision advantage through C4ISR and sensor, UAV and other drone data creating more noise than signal at present.

The Base-Rate Trap

Here is the part that trips up clever people, and it has a name. In 1974 Amos Tversky and Daniel Kahneman showed that when we judge how likely something is, we fixate on how accurate the test looks and quietly ignore how rare the thing is to begin with (Tversky & Kahneman, 1974). They called it base-rate neglect, and a scaled monitoring regime is practically built to commit it.

Run the numbers on the wave. Suppose that among the population your resolved entities represent, genuine matches of interest are rare, say one in a thousand. Suppose your matcher is good: it correctly flags 99 percent of the real links, and wrongly flags only 5 percent of the innocent. Point that at a population of a million people. About a thousand are real, and you catch roughly 990 of them. Good. But 999,000 are innocent, and 5 percent of them, just under 50,000 people, get flagged anyway. So of the roughly 51,000 alerts your excellent matcher produces, fewer than one in fifty is a real link. The other fifty out of fifty-one are ordinary people, a conveyancer, a home buyer, a small suburban accountant, wearing a suspicion the maths manufactured.

That is not a broken matcher. That is a good matcher meeting a low base rate, and no amount of accuracy in the brochure changes it. Scale the reporting population by 80,000 and you scale the innocent-flag count with it. The base rate is the number nobody puts on the slide, and it is the one that decides whether your system is fair.

Hold the matcher excellent and make real matches rarer. The base rate decides who fills the alert pile.

The False-Positive Firehose

I have written before about drowning in cloud spend rather than doing systems thinking (Hall, 2023). Tranche 2 sets up the same trap in a different domain. When the alerts multiply, the instinct is to throw people and third-party tooling at the backlog. That is reactive. It treats the symptom, the alert queue, and never the cause, which is a system that cannot tell one person from another cheaply and accurately.

And it is not free. Every alert an analyst reviews has a cost. Every model inference that scores a transaction has a cost. When you multiply those unit costs by a reporting population that has grown by tens of thousands, the economics of monitoring stop being a rounding error and start being the constraint. This is the cost-per-decision discipline that most business cases quietly skip, and it is what separates a monitoring capability that survives its second budget cycle from one that gets quietly cancelled.

The seam that matters is entity resolution. Everything downstream inherits its errors.

The So What?

So if Tranche 2 is really an entity resolution and cost problem, what does an architect do about it? A few things, and none of them start with buying a bigger alert queue.

  • Resolve before you monitor. Put deterministic and probabilistic entity resolution at the front of the pipeline, not as an afterthought, so that monitoring runs against resolved entities rather than raw reports.

  • Carry confidence and provenance through every seam. A probabilistic match is not a fact. If a 0.82 likelihood hardens into an asserted identity by the time it reaches an analyst, you have manufactured false confidence. Keep the uncertainty visible.

  • Design for cost per decision from day one. Model the economics: volume, review rate, reviewer cost, inference cost. If the numbers only work at pilot scale, the capability is already broken.

  • Keep a human in command of the consequential calls, and make that oversight real. Tie a person to a network only when a human with the time and standing to disagree has looked at it, not when a score crossed a line.

Interactive: slide the match threshold and the base rate, and watch precision collapse on synthetic data.

Conclusion

Tranche 2 is a good reform, and long overdue. But we are at risk of celebrating the wrong milestone. Enrolling 80,000 entities is an administrative achievement. Making sense of what they report, without drowning analysts or falsely implicating the innocent, is the actual mission, and it is an entity resolution and economics problem before it is a compliance one.

So here is the question I would put to anyone standing up a Tranche 2 capability. When the wave hits, will your system be a bigger inbox, or a better brain? Because only one of those was worth the reform.

Thanks for reading.

The views expressed in this article are my own and do not represent those of my employer, or any of my clients.

See related articles: The FinOps Firehose: Stop Drowning, Start Systems Thinking and Embedding FinOps: Achieving a Continuous Authority to Operate (cATO)

References

APA 7. Confirm current versions, dates, and URLs against the research pack before publishing. Where a direct quote would strengthen a claim, insert it at the marked slots and add the page number.

Related reading

1 min read

The Double-Edged Sword of AI in Law Enforcement: Navigating the Deep Fake Dilemma

The same AI that helps investigators can also fabricate convincing evidence. A look at how deepfakes cut both ways in law enforcement, and what accountable governance requires.

National SecurityDeepfakesLaw Enforcement