Between June 2025 and December 2026, Australian small and medium businesses quietly lost the protection they had relied on for decades. The exemption that once turned on turnover, headcount or industry label has been replaced by a test based on activity — on what your business actually does for its clients. Around 100,000 businesses became reporting entities under the anti-money laundering regime on 1 July 2026. Individuals can now sue any business, of any size, for a serious invasion of privacy. Climate disclosure obligations are cascading into supply chains as procurement questionnaires, arriving at businesses that fall below every reporting threshold. None of this was applied for. It arrived.