For agencies who haven't started yet · plain English
AML/CTF for Australian Real Estate
From 1 July 2026 every Australian real estate agency that brokers a sale becomes regulated by AUSTRAC. This page explains what the rules mean, what you have to do, in what order, and the traps that catch people. No legal jargon. No fluff. Roughly a six-minute read.
Why this exists
The 30-second context.
Australian real estate has been used to wash criminal money for decades. The international standards-setter (FATF) named Australia as one of only five countries globally that still didn't regulate this in 2015. The federal government finally acted: from 1 July 2026, real estate joins the same anti-money-laundering regime that already covers banks, casinos and bullion dealers.
It's called the Tranche 2 reform. The agency - not the individual agent - becomes a reporting entity. Penalties run to A$33m for a body corporate. AUSTRAC has said they'll be patient about quality in the first 12 months but ruthless about anyone who fails to enrol.
Are you in scope?
Quick test for any property professional.
- -Sales agencies (residential, commercial, rural)
- -Buyer's agents
- -Vendor advocates
- -Property developers selling direct
- -Auctioneers, in their brokering role
- -Mixed sales + property-management agencies (the sales side is caught)
- -Off-the-plan developers (yes, once contracts exist)
- -Property fund managers (yes, in some structures)
- -Pure option grants (unclear - risk-assess)
- -Pure property management
- -Residential or commercial leasing
- -Rent-roll operations
- -Holiday/short-stay management
- -Strata management
What you do, in order
Steps 1–6 must be done before 1 July 2026. Steps 7–12 are ongoing operations.
Register your agency on AUSTRAC Online. The window opened 31 March 2026. Miss the deadline and AUSTRAC can fine you roughly A$19,800 per day until you do. This is the one thing AUSTRAC will not be patient about - enrol on time.
This is the named person responsible for AML at your agency - usually the licensee in charge or the principal. They're personally accountable, so make sure they actually understand the role before you nominate them. Their name and contact details get notified to AUSTRAC.
Choose a tool that does customer ID verification, beneficial-ownership lookups, PEP/sanctions screening, suspicious-matter report drafting and ongoing monitoring. There are at least 15 in the Australian market - First AML, PEXA Clear, AMLHUB, AMLTranche, AML Assured and others. Get demos, check the per-check pricing.
Most run A$13–40 per individual customer check, A$28–65 per business/trust check, plus a monthly platform fee from A$59–300+. Free pilots are common until 1 July 2026.
Your written rulebook. It has two parts: a risk assessment of your business (what kinds of customers do you have, where do they come from, how risky is your geography and channel mix) and the policies that say how you'll handle ID verification, ongoing monitoring, training, reporting and record-keeping.
AUSTRAC publishes a Real Estate Starter Kit you can use as a base for small agencies. Larger or more complex agencies should tailor properly - a generic Starter Kit alone won't survive an examination on its own.
Your director or principal has to formally approve the program before you provide any service that's caught by the rules. Without sign-off you're not allowed to trade from 1 July. Keep the signed copy and the date - you'll be asked for it.
Every staff member who deals with vendors or buyers needs basic AML/CTF training - usually 30–60 minutes online. The compliance officer needs more, often a full-day course. Refresh annually. Keep a register of who completed what, when. Most AML providers bundle training and a register.
From 1 July, every vendor and every buyer in a brokered sale gets verified. ID document + selfie liveness check; beneficial-ownership questions if the customer is a company, trust or SMSF; PEP and sanctions screening; a risk rating per customer.
Your AML provider sends the customer a link, runs the checks, and reports the result. Your job is to check the result, decide if EDD is needed, and proceed (or escalate). About 90% of customers are low-risk and clear in under a minute.
Customers get re-screened when sanctions lists change or when their situation changes. You also watch for unusual patterns: structured deposits (multiple sub-A$10,000 cash payments), sudden change of buyer, atypical funding, behaviour that doesn't match the buyer profile. Document what you saw and what you decided - even if you decided to do nothing.
Three reports you might have to file with AUSTRAC. Suspicious Matter Report (SMR): 3 business days for money-laundering suspicion, 24 hours for terrorism financing. Threshold Transaction Report (TTR): 10 business days, when you receive A$10,000+ in physical cash. Annual Compliance Report: Q1 of the following year.
The compliance officer files. Nobody else - including the agent on the deal - should know an SMR has been filed.
Every CDD record, screening result, transaction record, program version, training record and report stays accessible for 7 years. Important privacy nuance: destroy ID document images after verification. Keep the data (name, DOB, document number, verification outcome) - not the photos. The OAIC's February 2026 guidance is explicit on this.
A short return to AUSTRAC summarising your AML activity for the prior year. Your AML provider's reporting tools should make this mostly auto-fill. The compliance officer signs and lodges via AUSTRAC Online.
Someone from outside the agency - usually a specialist consultancy or law firm - reviews whether your AML program is working in practice. They check whether what you wrote is actually what you do. Plan A$5–25k per evaluation depending on size.
What happens for one customer
A typical residential vendor, from listing to settlement.
Listing agreement signed
Agent signs the vendor up in your CRM (such as AgentBox, Rex, or Console Cloud). The CRM triggers the AML provider to send the vendor an ID-verification link.
Vendor verifies (under 90 seconds)
Vendor opens the link on their phone, takes a selfie, photographs their licence or passport. The AML provider runs DVS (government document check), PEP screen, sanctions screen.
Result lands in your queue
Most vendors clear automatically as Low Risk. The compliance officer reviews anyone flagged Medium or High and decides whether to proceed, request more, or escalate.
If entity-customer (trust, company, SMSF)
A second link asks for the trust deed, beneficial owners, trustees and any controllers. More moving parts, but the AML provider walks the customer through it.
Buyer comes through
Same flow runs for the buyer, plus - if the risk rating is elevated - a source-of-funds request (recent payslips, sale-of-prior-property contract, gift letter, etc.).
Ongoing screening
While the deal is live, both parties are re-screened automatically when the sanctions list updates. If a flag appears, the compliance officer is alerted.
Settlement
Records are sealed for 7-year retention. The conveyancer takes the customer through PEXA-side AML at settlement (overlapping but separate). Your obligation closes once retention starts.
Glossary - every term in plain English
Twenty-five terms you'll see across AUSTRAC guidance, your AML provider's UI, and any vendor pitch.
The legal regime that requires regulated businesses to check who they're dealing with and report anything that looks like dirty money or terrorism funding.
The federal regulator. They run the rules, take your reports, and run the audits. From 1 July 2026 they're your AML regulator if you broker property sales.
The legal label that says you're caught by the rules. From 1 July 2026 every agency that brokers a sale is one. The agency is the reporting entity, not the individual agents.
The activities that trigger the rules. For real estate it's brokering, selling or assisting in the transfer of property. Property management and leasing don't trigger anything.
Knowing who your customer actually is. Identity, contact details, and - if they're a company or trust - who actually owns and controls them.
The same idea as CDD, just a different acronym borrowed from banking. In Australian regulation the official term is CDD, but you'll hear KYC everywhere.
Extra checks for higher-risk customers. Triggered by foreign politicians, complex ownership structures, sanctioned countries, or anything that doesn't add up.
A current or recent senior public official, their immediate family, or close associates. Foreign PEPs always need extra checks; Australian ones get risk-rated.
Checking your customer isn't on a government list of people you're not allowed to do business with. The DFAT Consolidated List is the one that matters in Australia.
The actual human who owns or controls a company or trust. Required because criminals use shell companies - the law wants the real person behind the legal name.
Anyone who owns or controls 25% or more of a company is treated as a beneficial owner and must be identified. Trusts have their own rules involving trustees, beneficiaries and controllers.
Where the money for this specific transaction came from. Required for higher-risk buyers - payslips, sale of a prior property, business sale, gift letter, etc.
Where the customer's overall wealth came from. Asked when source-of-funds alone doesn't add up - bigger picture than just this purchase.
A report you file with AUSTRAC when something looks off. Money-laundering suspicion: 3 business days. Terrorism financing: 24 hours. The compliance officer files; the customer must never know.
A report when you receive A$10,000+ in physical cash. Rare in real estate because settlement runs through banks - but cash deposits at open homes count. 10 business days to file.
A report for cross-border value transfers. Almost never applies to real estate agencies because you don't move money internationally - your conveyancer or the bank does.
It's a criminal offence to tell anyone - including the customer or the agent on the deal - that an SMR has been or might be filed. Up to 10 years in prison if breached.
Match your effort to the risk. A 70-year-old retiree downsizing locally needs less work than a foreign company buying $5m of land. Document why you rated each customer the way you did.
Your written rulebook. A risk assessment of your business plus the policies that say how you'll handle CDD, monitoring, training and reporting. Senior manager has to sign before you start providing services.
Someone from outside the agency reviews whether your AML program is working. No fixed cadence - usually every 2–3 years, more often if you're high-risk or had a problem.
The federal government service that confirms an ID document is genuine. Your AML provider connects to it via an approved gateway - you don't deal with it directly.
Australia's master sanctions list, maintained by the Department of Foreign Affairs and Trade. Updated regularly. Your AML provider screens everyone against it on intake and again when the list changes.
Foreign buyers need their approval to purchase Australian property. Sits alongside AML, doesn't replace it - you have to do both.
The international body that sets global AML standards. Australia's failure to regulate real estate was a long-standing FATF concern - Tranche 2 closes that gap.
The reform package that brings real estate, lawyers, accountants, and dealers in precious metals/stones into the AML/CTF regime from 1 July 2026. "Tranche 1" was the original 2006 regime that covered banks and casinos.
Gotchas - common traps
The things people get wrong, from "annoying mistake" to "career-ending breach".
Both sides get checked
When you broker a sale you have to verify both the vendor and the purchaser. Most agencies underestimate the buyer-side workload until they realise they're doing 2× the checks they planned for.
Auctions get a delayed-CDD allowance
Full CDD doesn't have to be done before the hammer falls - there's a recognised carve-out because the post-fall window is too short. You still have to do it before the contract goes to settlement.
Trusts and SMSFs are entity-level work
Buying via a trust or SMSF? You verify the trustees, beneficiaries (by class is usually fine), settlor, controllers - and any beneficial owner at or above 25%. About 3× the work of a personal purchase.
Foreign buyers stack obligations
Foreign buyers need FIRB approval and ATO Register of Foreign Ownership filings on top of AML/CTF. The AML regime doesn't replace the foreign-investment regime - both apply.
Cash at open homes counts
If a buyer drops a A$15,000 cash holding deposit at an open home, that's a TTR trigger. Settlement cash usually flows through banks (no TTR), but agency-side cash absolutely does. Your trust account is in scope.
VPA cash is a known laundering pattern
AUSTRAC has explicitly flagged agency-trust-account VPA (Vendor Paid Marketing) cash as a laundering vector - cash in, cheque or refund out. If a vendor wants to pay marketing in physical cash, your antennae should go up.
Don't keep ID document images
The OAIC's February 2026 privacy guidance says destroy the actual photo of the passport/licence after verification. Keep the extracted data (name, DOB, document number, verification outcome) - not the image. Holding the image breaches privacy law.
Tipping-off is criminal
Never tell the customer that you've filed (or might file) an SMR. Don't even hint at it. The compliance officer handles it; the agent on the deal often won't be told either. Up to 10 years in prison for breach.
Education-first, but enrol on time
AUSTRAC has signalled they'll be patient about the quality of your program in the first 12 months. They will not be patient about whether you enrolled. Daily fines of ~A$19,800 from 30 July 2026 if you haven't.
The compliance officer is personally liable
Civil penalties up to A$6.6m for individuals; criminal liability for serious wilful breach. Whoever takes the role needs to actually understand it - and the agency needs to actually back them. Not a tick-the-box appointment.