Is your building business ready for the 2026 compliance landscape?

Full quiz content - Building Compliance Quiz 2026 - Builder Licensing, NCC, AML/CTF Tranche 2 | Nifty Computing

This index lists every question, every answer option with its score, every tier band, every recommendation, and every regulatory source used by the building compliance readiness quiz. Last reviewed 2026-04-26.

Tier scoring

• Compliance Ready - score ≥ 85/100, review every 12 months. Your building business demonstrates strong compliance maturity across licensing, insurance, WHS, tax, and commercial practices. If you are a spec builder or developer, your AML/CTF readiness is on track for the 1 July 2026 commencement. Maintain annual reviews. Recommended next review: 12 months.
• Good - Minor Gaps - score ≥ 70/100, review every 12 months. Solid foundations with targeted gaps to address. Work through the priority findings below, particularly the August 2026 TPAR deadline, the VIC SOPA 2025 changes, and - if applicable to you - your AUSTRAC enrolment by 29 July 2026. Recommended next review: 12 months.
• Moderate Risk - Action Needed - score ≥ 50/100, review every 6 months. Several material gaps in your compliance practices. Given the active AFP focus on construction-sector cyber crime, state regulator focus on builder licensing, and the looming AML/CTF Tranche 2 commencement for spec/developer businesses, prioritise the findings below over the next 1–3 months. Recommended next review: 6 months.
• High Risk - Urgent Action - score ≥ 30/100, review every 1 months. Significant exposure across multiple obligations. A state regulator inspection, an ATO data-match, an uninsured loss, or - for spec/developer businesses - an AUSTRAC non-enrolment enforcement action is a material risk at this readiness level. Engage professional advice. Recommended next review: 1 month.
• Critical - Immediate Intervention - score ≥ 0/100, review every 1 months. Your business has substantial non-compliance with Australian regulatory obligations. For spec builders and developers, the AML/CTF commencement on 1 July 2026 is a hard deadline with criminal and civil penalties for non-enrolment. Engage qualified compliance, tax, and cyber advisers as soon as practicable. Recommended next review: 1 month.

Categories assessed

• LIC - Builder Licensing & Registration
• STD - NCC & Technical Standards
• WHS - Work Health & Safety
• ACL - Consumer Law & Building Contracts
• SOP - Security of Payment
• TAX - Tax, TPAR & Subcontractors
• INS - Insurance (DBI/HBCF/HWI, PL, PI, WC)
• ASB - Asbestos & Hazardous Materials
• CYB - Cyber & Business Email Compromise
• AML - AML/CTF Tranche 2

Questions

1. Q1 (LIC, weight 3): Is your builder / building practitioner licence current, matched to the class of work you undertake (unlimited, medium-rise, low-rise, kitchen/bathroom), and renewed on time?

   • Yes - current, correct class, renewed well before expiry (score 5)
   • Current but has lapsed once in the past 2 years (score 3)
   • Not sure what class we hold or when it expires (score 1)
   • We operate under someone else's licence or a subcontract arrangement (score 0)

   If a weak option is selected: Your builder licence is class-specific: unlimited, medium-rise, low-rise, kitchen & bathroom, swimming pool, demolition etc. Taking on a project over your class (e.g. a 3-storey walk-up on a low-rise licence) voids your insurance and is a prosecutable regulator breach. Record the class, number, and expiry date on every contract and quote. Set renewal reminders at 90 days.

2. Q2 (LIC, weight 3): Does the named Nominated Supervisor / Qualified Building Practitioner / Qualified Business Person on your company licence actively supervise your work?

   • Yes - they run the business day-to-day (score 5)
   • They are genuinely engaged but part-time (score 3)
   • Named for the licence but not active in operations (score 1)
   • No formal supervisor arrangement (score 0)

   If a weak option is selected: Every state requires a named, qualified individual to stand behind your company builder licence (terminology varies: Nominated Supervisor in NSW, Nominee in QLD, Qualified Business Person elsewhere). If they depart or let their registration lapse, the company licence is at immediate risk. Renting a 'paper' licence is a serious regulator offence and invalidates DBI/HBCF/HWI.

3. Q3 (LIC, weight 3): Have you met the QBCC annual financial reporting and minimum financial requirement (MFR) for your QBCC licence category?

   • Yes - annual MFR lodged, financials audited if required (score 5)
   • Lodged but late or with extensions (score 2)
   • Aware of the obligation but have not lodged in the most recent cycle (score 0)
   • Not aware of MFR obligations (score 0)

   If a weak option is selected: QBCC's 9-category MFR regime is the most prescriptive financial oversight of any Australian builder regulator. Categories SC1 up to Category 7 are defined by allowable annual revenue with prescribed net tangible assets and liquidity. Annual financial reporting is mandatory for most categories; higher categories require audited or reviewed financials prepared by an accountant. Missing an MFR lodgement results in licence suspension - not a warning.

4. Q4 (LIC, weight 2): Do you hold the correct individual practitioner registrations (e.g. VIC Building Practitioner Registration, NSW Registered Building Practitioner) for each named person who carries out regulated work?

   • Yes - each individual registered, CPD tracked (score 5)
   • Most individuals registered, CPD informal (score 3)
   • Company licence only - no individual registrations (score 1)
   • Not clear who needs individual registration (score 0)

   If a weak option is selected: Individual practitioner registration is separate from the company licence in VIC, NSW (RBP from 2025), and several other states. Each individual carrying out regulated work must hold their own registration number, meet CPD obligations, and be named on the company's compliance chain. The VIC Professional Engineers Act and NSW Design & Building Practitioners Act both added new individual-level obligations in recent years.

5. Q5 (LIC, weight 2): Does your advertising (website, vehicle signage, quotes, contracts, invoices) display your company builder licence number and class?

   • Yes - everywhere it's customer-facing (score 5)
   • On quotes and contracts but not on advertising (score 2)
   • Only on invoices (score 1)
   • Not routinely displayed (score 0)

   If a weak option is selected: Most state builder regulators require the licence number (and in VIC the BPR number for named practitioners) to appear on all advertising, quotes, contracts, and invoices. Missing it is a summary offence and, more practically, prevents a consumer from verifying you're licensed. Include in email signatures, website footer, vehicle livery, and every contract template.

6. Q6 (LIC, weight 2): If you act as an owner-builder on a personal project, are you tracking the sale restriction and warranty obligations that apply?

   • Yes - owner-builder permit in place, sale restrictions noted (score 5)
   • Have a permit but haven't reviewed obligations recently (score 2)
   • Built under own name without formal permit (score 0)
   • We don't act as owner-builder (score 5)

   If a weak option is selected: Owner-builder permits restrict how soon (and sometimes whether) you can sell the finished property without triggering builder's warranty or insurance obligations. Typical restriction: one owner-builder permit per individual in a 5–6 year period, with mandatory disclosure on sale and sometimes a requirement to obtain builder's warranty insurance before the sale completes. Breaching this is enforceable by state regulators.

7. Q7 (LIC, weight 2): If you work in multiple states, do you hold a separate builder licence in each state (recognising there is no national mutual recognition for builders)?

   • Yes - separate licence in each state we operate in (score 5)
   • We only operate in one state (score 5)
   • We rely on interstate mutual recognition (assume it applies) (score 0)
   • Have operated without checking (score 0)

   If a weak option is selected: Unlike electrical or plumbing licensing, builder licensing is NOT covered by Automatic Mutual Recognition (AMR) in any practical sense - each state maintains its own classes, insurance thresholds, and minimum financial requirements. A VIC DB-U licence does NOT let you build in QLD. Apply for a separate licence in each state before pricing work there. Working on an out-of-state job without the local licence invalidates your insurance and is a prosecutable offence.

8. Q8 (STD, weight 3): Is your team working to the current edition of the National Construction Code (NCC 2022 with Amendment 1 and Amendment 2, commenced 29 July 2025)?

   • Yes - all staff have access, transitional dates tracked (score 5)
   • Yes - one reference copy in the office (score 3)
   • We work from experience, refer only when uncertain (score 1)
   • Not sure which edition we're on (score 0)

   If a weak option is selected: NCC 2022 is the current National Construction Code; Amendment 2 commenced 29 July 2025 with significant changes to Section J (energy efficiency), condensation management, livable housing, and waterproofing. Volume One (Class 2–9), Volume Two (Class 1 & 10), and Volume Three (plumbing) all apply. Free digital access via ABCB. Transitional arrangements apply to projects under permit - know which edition applies to which job.

9. Q9 (STD, weight 3): Are your wet area waterproofing details compliant with AS 3740-2021 and documented (inspection, product specifications, applicator qualifications)?

   • Yes - specifications, inspections and records on every wet area (score 5)
   • Yes, but documentation is informal (score 3)
   • We rely on the waterproofing subbie to manage it (score 1)
   • Frequent waterproofing rework needed post-completion (score 0)

   If a weak option is selected: Waterproofing failures remain the #1 category in QBCC defects data and a top tribunal complaint area nationally. AS 3740-2021 requires specific fall gradients, membrane types, flashing details, and overlap with tiling and plumbing penetrations. Document the product used, applicator qualifications, and inspection. Where permitted, engage a licensed waterproofing contractor rather than having tilers membrane as part of the tile job.

10. Q10 (STD, weight 2): Do you verify that timber framing conforms to AS 1684 (residential timber framed construction) for span, connection, and bracing?

    • Yes - engineered span tables used, documented for every job (score 5)
    • Mostly - we rely on carpenter experience for standard spans (score 3)
    • Only refer to AS 1684 on unusual spans (score 1)
    • Not familiar with AS 1684 details (score 0)
    • Not applicable - we don't build timber-framed structures (score 5)

    If a weak option is selected: AS 1684 (residential timber framed construction) sets the national baseline for timber house framing - bracing, tie-downs, connections, span tables. Cyclonic regions (AS 1684.3) have additional wind-rating rules. Document your compliance - span tables attached to the plans or engineering certificates for non-standard spans. This is also a routine focus for DBI/HBCF insurer technical reviews on new builds.

11. Q11 (STD, weight 2): Are you current on the NCC 2022 energy efficiency requirements (7-star NatHERS for Class 1 & 2, Section J for commercial)?

    • Yes - 7-star NatHERS assessments on every Class 1/2, Section J on commercial (score 5)
    • Usually - sometimes rely on deemed-to-satisfy without full modelling (score 3)
    • Only when the client asks (score 1)
    • Not clear on current requirements (score 0)

    If a weak option is selected: NCC 2022 lifted residential from 6-star to 7-star NatHERS and introduced whole-of-home energy use requirements. Class 1 & 2 buildings under permit from 1 May 2024 (VIC, staged elsewhere) must comply. Section J for commercial adds stringent insulation, glazing, and services requirements. Engage an accredited NatHERS assessor early in design - retrofitting to 7-star is expensive.

12. Q12 (STD, weight 2): For Class 1 & 2 buildings, are you delivering the Livable Housing Design Standard (step-free entry, doorway widths, reinforced bathroom walls, etc.)?

    • Yes - all new Class 1/2 comply with LHDS (score 5)
    • When the regulator or contract requires it (score 3)
    • We only do commercial / Class 3+ (score 5)
    • Not familiar with LHDS requirements (score 0)

    If a weak option is selected: The Livable Housing Design Standard became mandatory in VIC on 1 May 2024 and has been adopted in most other states for Class 1 & 2. Requirements: step-free entry, minimum doorway widths, reinforced bathroom walls for future grab rail installation, accessible toilet on entry level. Not optional - breach is a compliance failure at occupancy permit. Easiest path: design to LHDS from concept, don't retrofit.

13. Q13 (STD, weight 2): Do you hold a full set of current Australian Standards referenced in the NCC, or provide access via an industry body subscription?

    • Yes - Standards Australia digital subscription or HIA/MBA library (score 5)
    • A few key standards in hard copy (score 2)
    • We download unofficial copies when needed (score 0)
    • No reference copies available (score 0)

    If a weak option is selected: Common standards: AS 1684 (timber framing), AS 3600 (concrete), AS 3700 (masonry), AS 3740 (waterproofing), AS 3959 (bushfire construction), AS 1288 (glass), AS 4055 (wind loading), AS 4654 (external waterproofing). Digital access via Standards Australia or through HIA/Master Builders membership is the most cost-effective option. Unofficial copies are a copyright breach and often outdated.

14. Q14 (STD, weight 1): In bushfire-prone areas, do you build to the applicable BAL rating (AS 3959) and document the assessment?

    • Yes - BAL assessment by a qualified practitioner on every job in BPA (score 5)
    • Yes, but documentation informal (score 3)
    • Only when the permit requires it explicitly (score 2)
    • We don't work in bushfire-prone areas (score 5)
    • Not familiar with BAL ratings (score 0)

    If a weak option is selected: AS 3959 (Construction of buildings in bushfire-prone areas) imposes construction requirements graded from BAL-LOW through BAL-12.5, BAL-19, BAL-29, BAL-40, and BAL-FZ (flame zone). Bushfire Attack Level assessment by a qualified practitioner is required before design. Building to the wrong BAL rating invalidates the occupancy permit and exposes you to catastrophic liability if the home is lost in a fire. Post-2019 assessments are especially scrutinised.

15. Q15 (WHS, weight 3): Do all workers (employees, apprentices, subcontractors) hold a current White Card (General Construction Induction)?

    • Yes - all verified and copies on file (score 5)
    • Most - tracking is informal (score 2)
    • Assumed but not verified (score 1)
    • Don't require it routinely (score 0)

    If a weak option is selected: The White Card is mandatory for anyone entering a construction site anywhere in Australia. As the PCBU, you must verify - not assume. Hold copies. Subcontractors must produce theirs on induction. No White Card = no site access = legal liability and WHS regulator exposure if an incident occurs.

16. Q16 (WHS, weight 3): Do you prepare job-specific SWMS for every High Risk Construction Work (HRCW) activity on your sites?

    • Yes - SWMS prepared, signed, reviewed per job (score 5)
    • Yes, but using generic templates (score 2)
    • Only on bigger jobs (score 1)
    • Not aware of SWMS requirements (score 0)

    If a weak option is selected: WHS Regulations list 18 HRCW categories that require a job-specific SWMS: work at heights over 2m, live electrical, confined spaces, hot work, asbestos, demolition of load-bearing parts, structural alterations requiring temporary support, trenches/excavations over 1.5m, and more. Generic templates don't meet the legal test - SWMS must be site- and job-specific, signed by workers, and reviewed if conditions change.

17. Q17 (WHS, weight 3): Do you have a documented fall prevention plan for all work at height on your sites (edge protection, scaffolding, roof work)?

    • Yes - edge protection / scaffold designed and inspected (score 5)
    • Sometimes - depends on the job (score 2)
    • Harness-only systems as default (score 1)
    • No documented fall prevention plan (score 0)

    If a weak option is selected: Falls from height remain the #1 construction fatality cause in Australia. The WHS hierarchy of control requires elimination (ground-level work), then passive protection (edge protection, guardrails, scaffolding) BEFORE fall-arrest (harnesses). Harness-only on standard residential construction is a regulator red flag. Engineered edge protection and scaffolding with SWIS is the modern norm. WorkSafe prosecutions after serious falls routinely target PCBUs who went straight to harness.

18. Q18 (WHS, weight 2): Do you comply with the engineered stone ban (from 1 July 2024) and the silica dust control regulations?

    • Yes - no engineered stone, documented silica controls, RCS air monitoring where required (score 5)
    • No longer supply engineered stone, some silica control gaps (score 3)
    • Not sure - rely on stone suppliers / tilers (score 1)
    • Not aware of engineered stone ban or silica rules (score 0)

    If a weak option is selected: Engineered stone has been prohibited for use, supply, manufacture or installation in Australia since 1 July 2024 - silicosis cases drove the national ban. Porcelain and sintered stone alternatives are permitted. Separately, crystalline silica regulations have tightened across concrete, brick, mortar, and tile cutting. SWMS, air monitoring, RPE, wet cutting, and health monitoring for workers with ongoing silica exposure are required. WorkSafe is actively prosecuting.

19. Q19 (WHS, weight 2): Do you have a psychosocial hazard management plan for your sites (bullying, harassment, excessive workload, fatigue)?

    • Yes - documented, consulted on, training delivered (score 5)
    • Informal awareness, no formal plan (score 2)
    • Not a focus area (score 0)
    • Not aware this is a WHS duty (score 0)

    If a weak option is selected: Psychosocial hazards became an explicit WHS duty from 2022 (NSW, QLD, VIC, now nationally). Construction has documented higher rates of suicide, fatigue incidents, and bullying claims than most industries. Your WHS management system should address: workload, role clarity, bullying/harassment, remote or isolated work, fatigue, traumatic events on site. Mates in Construction and industry body programs offer low-cost training and resources.

20. Q20 (WHS, weight 2): Do you have a site-specific emergency response plan at each active site (fire, injury, confined space rescue)?

    • Yes - site-specific plan posted, communicated at induction (score 5)
    • Generic plan only (score 2)
    • We rely on 000 (score 1)
    • No emergency plan (score 0)

    If a weak option is selected: WHS Regulations require a site-specific emergency plan covering: evacuation, medical emergency, fire, and - if applicable - confined space rescue, trench rescue, or other specialist response. Post it in the site office, communicate at induction, and conduct drills for larger or longer-duration sites. A documented emergency plan is a core evidence item in any WHS incident investigation.

21. Q21 (ACL, weight 3): Do you use a written domestic building contract that complies with your state's prescribed form (VBA/BCNSW/QBCC/WA Building Commission/CBS)?

    • Yes - state-compliant contract, all disclosures present (score 5)
    • Industry-body (HIA/MBA) contract used consistently (score 5)
    • Own template cobbled together (score 1)
    • Email or verbal agreements only (score 0)

    If a weak option is selected: Most states require a prescribed-form domestic building contract above a dollar threshold (e.g. $5K NSW, $10K VIC, $3,300 QLD). These contain mandatory disclosures: cooling-off rights, checklist, insurance notice, dispute process, and progress-payment schedule. HIA and Master Builders contracts are state-compliant and widely accepted. Non-compliant contracts: the consumer can void, refuse to pay progress claims, and the builder can be fined or lose licence.

22. Q22 (ACL, weight 3): Do you provide the prescribed consumer information (checklist, insurance notice, cooling-off rights) before the consumer signs?

    • Yes - delivered and signed-for before contract signing (score 5)
    • Delivered but not formally acknowledged (score 3)
    • Sometimes skipped (score 1)
    • Not aware of pre-contract disclosure obligations (score 0)

    If a weak option is selected: Every state requires specific pre-contract disclosures for domestic building: the 'HIA/MBA-style' Consumer Checklist (VIC), Home Building Checklist (NSW), Consumer Building Guide (QLD), and equivalents elsewhere. Delivery must be before signing; many states require a signed acknowledgement. Missing disclosures give the consumer extended cooling-off or contract rescission rights and expose you to a regulator penalty.

23. Q23 (ACL, weight 3): Do your progress payment schedules match the state statutory caps (prescribed percentages per stage, no front-loading)?

    • Yes - state-compliant stage percentages on every contract (score 5)
    • Mostly - sometimes vary by agreement (score 2)
    • Stage payments based on what the client will agree to (score 0)
    • Not aware of statutory caps on progress payments (score 0)

    If a weak option is selected: Every state caps progress payments by construction stage to prevent front-loading. VIC: 5%/10%/15%/25%/20%/20%/5%; NSW prescribes maximum percentages; QLD has its own schedule. Exceeding these without consumer agreement and disclosure is a breach that lets the consumer refuse the payment and recover overpayments. Use your state's HIA/MBA template - don't improvise.

24. Q24 (ACL, weight 2): Do you use a written variation process with the customer's written authorisation before doing variation work?

    • Yes - variation form signed before work starts (score 5)
    • Usually - but sometimes catch up after the fact (score 2)
    • Verbal agreements on smaller variations (score 1)
    • Variations invoiced without formal process (score 0)

    If a weak option is selected: Scope changes not signed in writing are the #1 cause of payment disputes and tribunal cases in the trades sector. Simple variation form: item, reason, cost, date, both signatures. Digital signing via a free tool (or SMS 'approved' from the client's known number) works. Never start variation work without written authorisation. Front-of-mind at every progress claim stage.

25. Q25 (ACL, weight 2): Have you reviewed your standard contract terms against the unfair contract terms regime (in-force civil penalties up to ~$50M)?

    • Yes - reviewed by a commercial lawyer in the past 12 months (score 5)
    • Reviewed at some point in the past (score 3)
    • Relying on HIA/MBA/industry standard terms without review (score 3)
    • Using own terms, no formal review (score 0)

    If a weak option is selected: Unfair contract terms carry civil penalties up to ~$50M for companies since November 2023. Clauses to scrutinise: one-sided cancellation rights, excessive termination fees, unilateral price or scope changes, automatic rollover, entire-agreement clauses that conflict with your state's home-building legislation. Get your standard contract reviewed annually. Industry body templates are a good baseline but worth running past your lawyer for your specific business model.

26. Q26 (ACL, weight 2): Do you have a documented complaints and defects rectification process (including mandatory defect liability periods post-completion)?

    • Yes - written process, logged, rectified to spec (score 5)
    • Informal - we handle complaints case by case (score 3)
    • Minor issues only - larger ones escalate to NCAT/VCAT/QCAT (score 1)
    • Complaints become disputes quickly (score 0)

    If a weak option is selected: Defects liability periods are baked into home-building law (typically 6 years for major defects, 2 years for minor - varies by state). A formal complaints process captures the issue, investigates, offers a timeframe for rectification, and documents resolution. Well-handled complaints become referrals; badly-handled ones become tribunal cases, Google reviews, and regulator complaints. Template: acknowledge within 5 days, inspect within 14, commit to rectification timeframe in writing.

27. Q27 (SOP, weight 3): Are your office and accounts staff trained to recognise, serve, and respond to statutory payment claims under your state's SOPA?

    • Yes - trained, documented process, reviewed annually (score 5)
    • One or two people understand it (score 3)
    • Not sure what counts as a statutory claim (score 1)
    • No SOPA training or awareness (score 0)

    If a weak option is selected: A valid payment claim specifies work done, amount claimed, and states it's made under the Act. Miss the statutory response window (typically 10 business days) and you're liable for the full amount claimed - no defence, no dispute, just pay. Train anyone who receives contractor invoices to spot the magic words and flag immediately. This is critical knowledge for head contractors paying subbies AND for subbie-style builders chasing principal payments.

28. Q28 (SOP, weight 3): Do your standard payment terms with subcontractors and principals align with the statutory maximum (e.g. NSW/VIC cap at 20 business days)?

    • Yes - contract templates reflect state caps (score 5)
    • Mostly - occasionally a contract exceeds the cap (score 3)
    • Terms are whatever we can negotiate (score 0)
    • Not aware of statutory payment term caps (score 0)

    If a weak option is selected: VIC 2025 SOPA Amendment Act introduces a 20-business-day cap on payment terms commencing by 1 September 2026. NSW already caps head-contractor-to-subcontractor terms at 20 business days. QLD has retention trust rules. If your contract sets 60 days but the statute caps at 20, the statute wins and you may be in breach by not paying earlier. Audit every standard contract template this year.

29. Q29 (SOP, weight 2): Do you calendar your statutory payment claim deadlines per project (NSW 12 months, VIC 3 months, QLD 6 months after last work)?

    • Yes - tracked in job management software (score 5)
    • Yes - but only on larger jobs (score 3)
    • Sometimes we miss the window and use normal debt recovery (score 1)
    • Not tracking payment claim deadlines (score 0)

    If a weak option is selected: Payment claim windows after last work on site: NSW 12 months, VIC 3 months (being amended), QLD 6 months. Miss it and you lose SOPA protection - normal debt recovery is still available but exponentially harder and slower. Set reminders at 75% of the applicable window. The statutory adjudication process is the single fastest way to recover unpaid amounts in the building industry.

30. Q30 (SOP, weight 2): Have you removed 'pay when paid' or 'pay if paid' clauses from your subcontract templates?

    • Yes - audited and removed (score 5)
    • Probably - haven't audited recently (score 2)
    • Still appears in some templates (score 0)
    • Not aware these clauses are void (score 0)

    If a weak option is selected: 'Pay when paid' and 'pay if paid' clauses are void under all state SOPAs. You cannot condition a subcontractor's payment on receipt from the principal. Such clauses are not just unenforceable - their inclusion can be a breach of the Act and a contributing factor in regulator complaints. Audit every subcontract template you use. Industry body templates have removed them; home-grown templates may not have.

31. Q31 (SOP, weight 2): If you hold subcontractor retentions above a statutory threshold, do you comply with retention trust rules (NSW above $20M, QLD BIFA requirements)?

    • Yes - retention trust account, audited annually (score 5)
    • Below threshold (score 5)
    • Above threshold but no retention trust in place (score 0)
    • Not clear whether rules apply to us (score 0)

    If a weak option is selected: NSW imposes retention trust rules on head contractors above $20M in qualifying projects: separate trust account, annual audit, compliance officer appointment. QLD BIFA requires Project Trust Accounts for qualifying projects above thresholds. WA has similar rules emerging. Penalties for non-compliance are significant and directors can be personally liable. If you hold subbie retentions on larger work, check your obligations this quarter.

32. Q32 (SOP, weight 2): Do you lodge statutory declarations of payment to subbies when required by the head contract (or require them from your subbies)?

    • Yes - stat decs collected and signed each claim cycle (score 5)
    • Sometimes - depends on the principal's requirements (score 3)
    • Verbal confirmation only (score 1)
    • Don't use stat decs (score 0)
    • Not applicable - we don't use subcontractors (score 5)

    If a weak option is selected: Most commercial head contracts require a statutory declaration at each progress claim stating you've paid all subcontractors and suppliers for work covered by prior claims. Lodging a false stat dec is a criminal offence (up to 4 years in most states). Collect matching stat decs from your subbies and retain records. This also protects against second-claim risk where a principal receives separate claims from a head and a subbie.

33. Q33 (TAX, weight 3): Do you lodge the Taxable Payments Annual Report (TPAR) by 28 August each year?

    • Yes - lodged via accounting software, on time (score 5)
    • Usually - sometimes lodged late (score 2)
    • Not sure if TPAR applies to us (score 1)
    • Haven't lodged TPAR recently (score 0)

    If a weak option is selected: If building and construction services are 50%+ of your business income AND you pay subcontractors, TPAR is mandatory by 28 August each year. Report each subbie's ABN, name, address, total paid, GST, and withholding. Penalties start at ~$5,550 for individuals and higher for companies. Non-lodgement is an ATO audit trigger. Xero, MYOB, and QuickBooks generate TPAR automatically if subcontractor payments are recorded correctly through the year.

34. Q34 (TAX, weight 3): Do you test every ongoing subcontractor against the ATO's employee-vs-contractor criteria at least annually?

    • Yes - formal annual review with accountant (score 5)
    • Reviewed at engagement, not since (score 3)
    • No formal review (score 0)
    • Some subbies work only for us, on our tools, under our direction (score 0)

    If a weak option is selected: Sham contracting is actively audited by ATO and Fair Work. A 'subbie' who takes most of their work from you, uses your tools and vehicles, is directed on hours, has no genuine business of their own, is likely an employee for tax, super guarantee, and workers compensation. Reclassification costs years of unpaid super, PAYG, workers comp premiums, and Fair Work penalties. The 2022 Jamsek and Personnel Contracting High Court decisions shifted the test to contract terms - with limits.

35. Q35 (TAX, weight 3): Are you ready for Payday Super (super paid with wages, not quarterly) commencing 1 July 2026?

    • Yes - cashflow model updated, bookkeeper briefed (score 5)
    • Aware but not actively preparing (score 2)
    • Haven't heard of Payday Super (score 0)
    • We don't have employees (score 5)

    If a weak option is selected: From 1 July 2026, super contributions must be paid at the same time as wages - not the current quarterly cycle. Many small builders have effectively used the 90-day super float as working capital; that disappears. Combined with the 12% SG rate (from 1 July 2025), cashflow tightens noticeably. Talk to your bookkeeper and bank now about working capital needs and update the payroll software settings well before 1 July 2026.

36. Q36 (TAX, weight 2): Are you reporting under Single Touch Payroll Phase 2 (STP2), including closely-held employees (family)?

    • Yes - STP2 compliant, closely-held reported (score 5)
    • STP2 but unsure about closely-held rules (score 3)
    • Still on STP1 or manual lodgement (score 0)
    • We don't have employees (score 5)

    If a weak option is selected: STP Phase 2 has been mandatory since 1 January 2022 (with transitional deadlines). Happens at every pay run, not quarterly. Closely-held employees (family on payroll) are in scope since 1 July 2022 with some simplified reporting options. Your payroll software must be STP2-enabled. ATO is actively following up non-compliers - STP2 is one of the clearest signals in their data matching of builders working around the rules.

37. Q37 (TAX, weight 2): Do you collect and retain subcontractor details (ABN, licence, workers comp COC, insurance) at engagement - before the first payment?

    • Yes - onboarding form, chased before first payment (score 5)
    • Usually at engagement, sometimes after (score 3)
    • Pick up details over time (score 1)
    • Collect for tax purposes only at year-end (score 0)
    • Not applicable - we don't use subcontractors (score 5)

    If a weak option is selected: Front-loaded subbie onboarding saves massive time at TPAR and avoids engagement with unlicensed or uninsured contractors. Minimum: ABN, trading name, address, bank details, builder/trade licence number and expiry, workers comp COC and expiry, PL COC, PI where applicable. A simple form (paper or digital) makes this a 10-minute task per subbie rather than a year-end scramble.

38. Q38 (TAX, weight 2): Is your GST reporting cycle aligned with your cashflow (quarterly BAS vs monthly) and up to date?

    • Yes - BAS lodged on time every cycle (score 5)
    • Occasional late lodgements (score 2)
    • Chronic late BAS lodgements (score 0)
    • We don't know our current BAS status (score 0)

    If a weak option is selected: GST turnover over $75K = mandatory registration. Quarterly BAS for most builders; monthly BAS if turnover over $20M or voluntary. Chronically late BAS is an ATO audit trigger and locks you out of ATO payment plans. If cashflow is tight, talk to your accountant about PAYGI variation, monthly BAS for better cashflow rhythm, or a formal ATO payment arrangement. Avoid default remission penalties by proactive communication.

39. Q39 (INS, weight 3): Do you have the correct Domestic Building Insurance / HBCF / HWI / BII for each job BEFORE taking a deposit?

    • Yes - policy in place, Certificate of Insurance given to consumer, before deposit (score 5)
    • Insurance in place but sometimes given to consumer late (score 2)
    • Commercial / not required (score 5)
    • Take deposits first, arrange insurance after (score 0)

    If a weak option is selected: Taking any deposit before the DBI/HBCF/HWI/BII policy is in place and the Certificate of Insurance has been given to the consumer is a direct statutory offence in every state - cheque-return penalties plus regulator action. VIC has a first-resort DBI regime from 2025 (consumer claims directly, no builder-can't-rectify proof needed). NSW HBCF is administered by icare. QLD HWI is QBCC. WA via Building Commission. SA BII via CBS.

40. Q40 (INS, weight 3): Is your Public Liability sum insured adequate for the contract values and sites you work on (commercial often requires $20M+)?

    • Yes - $20M+ PL, reviewed annually (score 5)
    • $10M - we only do smaller domestic work (score 3)
    • $5M or less (score 1)
    • Not sure of our sum insured (score 0)

    If a weak option is selected: $10M PL is inadequate for most commercial head-contract requirements now. $20M is the emerging minimum for any meaningful commercial work; tier-1 principal contracts often require $30M+. A significant incident at a multi-million-dollar property with an inadequate PL limit leaves directors personally exposed. Review annually with your broker, especially before bidding a larger or unfamiliar project type.

41. Q41 (INS, weight 3): Have you verified your Letter of Eligibility (VIC) / DBI facility (all states) covers your current turnover and project mix?

    • Yes - LOE reviewed after every financial year, facility limits adequate (score 5)
    • LOE in place but facility limits stale (score 3)
    • Don't have a formal DBI facility (score 1)
    • Commercial - not applicable (score 5)
    • Not familiar with LOE / DBI facility (score 0)

    If a weak option is selected: In VIC, the Letter of Eligibility (LOE) from an approved insurer is the gate to any DBI policy. Based on financial viability assessment by your accountant and the insurer. If your turnover or project size grows, the facility limits must keep pace - taking on a $1.5M project with a $500K facility cap means DBI will be denied. Review at every financial year close. NSW HBCF and other state regimes have similar eligibility/prequalification processes.

42. Q42 (INS, weight 2): Do you hold Professional Indemnity insurance if you do design-and-construct, take on spec work, or provide written technical advice?

    • Yes - PI sum insured matches project exposure (score 5)
    • PI in place but haven't reviewed limits (score 3)
    • No PI - only PL (score 1)
    • We only build to issued plans (score 5)

    If a weak option is selected: PL covers physical damage / injury; PI covers financial loss from errors in design, advice, or specification. If you take a design-and-construct role, provide written engineering or structural recommendations, run spec/developer work (where you effectively designed the building), or handle complex commercial work, PI matters. Typical specialist cover: $1–5M. Commercial principals and design-and-construct RFPs now routinely require it.

43. Q43 (INS, weight 2): Is your workers compensation classification correct for the builder + labour-only (carpentry, concreting, formwork) roles you actually run?

    • Yes - classifications match actual wage split (score 5)
    • Mostly - minor misclassifications probably present (score 3)
    • We declared everyone as office workers to reduce premium (score 0)
    • Not sure which classifications we use (score 0)
    • Not applicable - sole trader with no employees (score 5)

    If a weak option is selected: State workers comp (icare NSW / WorkSafe VIC / WorkCover QLD / ReturnToWorkSA / etc.) classifies each dollar of wages by industry and role. Building trades are high-premium categories; under-classifying (declaring a carpenter as office staff) triggers premium recalculation plus penalties on audit. Annual wage declaration is a sworn document - misclassification can be fraud. Review with your accountant or broker every renewal.

44. Q44 (INS, weight 2): Do you collect current Certificates of Currency (PL, PI, WC, trade licences) from every subbie - at engagement and renewal?

    • Yes - tracked in a register, renewed each cycle (score 5)
    • Mostly - some subbies slip through (score 3)
    • Collect at engagement, don't chase renewal (score 1)
    • Don't routinely collect COCs (score 0)
    • Not applicable - we don't use subcontractors (score 5)

    If a weak option is selected: If a subbie is uninsured and causes damage, your PL insurer may decline your claim on the basis you failed to verify cover - a 'contingent' exclusion. Collect COC for PL, PI (if applicable), workers comp, and trade/builder licence at engagement and on renewal. This is standard on commercial head contracts - mirror it with your own subbies. A simple Excel register with expiry dates solves 90% of the admin burden.

45. Q45 (INS, weight 1): Do you hold cyber insurance, either standalone or bundled into your business policy (with BEC / social engineering coverage specifically elected)?

    • Yes - BEC elected, limits reviewed (score 5)
    • Bundled but haven't checked BEC exclusion (score 3)
    • No cyber insurance (score 1)
    • Not sure if we have it (score 1)

    If a weak option is selected: Standalone cyber policies start around $1,500/year for small builders. Bundled cover in general business policies varies widely - many exclude BEC / 'social engineering' unless specifically elected. Given the AFP's October 2025 warning about construction-sector BEC (documented cases: $235K Inoteq/Mobius, $41.8K NSW construction, $50K Pure Glass WA, $3M Sydney hospital), the BEC extension is worth the extra premium. Check your policy schedule.

46. Q46 (ASB, weight 3): Do you request and review the asbestos register before commencing renovation or demolition work on pre-2004 buildings?

    • Yes - sighted on every pre-2004 job (score 5)
    • When it's readily available (score 3)
    • Only for commercial work (score 1)
    • Don't routinely check (score 0)

    If a weak option is selected: All workplaces built before 31 December 2003 must have an asbestos register (PCBU duty). Residential properties don't have one by default but owners often have reports from purchase inspections. Check before demolishing walls, cutting into roof spaces, or any disturbance. If you can't get the register on a workplace, you can't legally commence - sample-testing at cost is mandatory. Unsafe disturbance is a WHS offence with criminal penalties in serious cases.

47. Q47 (ASB, weight 3): Do you correctly engage Class A (friable) or Class B (non-friable over 10m²) licensed removalists for any removal on your jobs?

    • Yes - licensed removalists verified for every job (score 5)
    • Licensed but we haven't verified recently (score 3)
    • We handle smaller amounts ourselves without licence (score 1)
    • Not clear which licence applies (score 0)
    • Not applicable - we only build new structures, no demolition or renovation of pre-2004 buildings (score 5)

    If a weak option is selected: Friable asbestos: Class A licence. Non-friable over 10m²: Class B. Under 10m² non-friable can be handled without a removalist licence IF the worker is competent, trained, and follows safe methods - but many commercial contracts and insurers require licensed removal regardless. Verify the removalist's licence at engagement - expired licences are common. Document in your job file. PCBU commissioning removal is liable for the work being done correctly.

48. Q48 (ASB, weight 2): Do you sight written clearance certificates before any worker re-enters an area where asbestos was removed?

    • Yes - always on file before re-entry (score 5)
    • Usually (score 3)
    • Trust the removalist's verbal confirmation (score 1)
    • Not aware this is our duty (score 0)
    • Not applicable - no asbestos removal on our work sites (score 5)

    If a weak option is selected: A licensed asbestos assessor (Class A) or competent person (Class B) must issue a written clearance certificate before any re-occupation or next-trade work. No certificate, no re-entry - and you need to sight it, not just trust the removalist. A PCBU commissioning removal must ensure the clearance happens. Certificates stay in your job record. This single step is the #1 asbestos-related defence you have in a WHS investigation.

49. Q49 (ASB, weight 2): Do you have asbestos awareness training for all field staff (induction and 2-yearly refresh)?

    • Yes - induction training + refreshers (score 5)
    • Training at induction only (score 3)
    • Informal awareness (score 1)
    • No formal training (score 0)

    If a weak option is selected: Asbestos awareness training (typically CPCCDE3015 or equivalent, 1-day course) teaches identification, ACM types, safe handling, legal duties. Mandatory for any worker who may encounter asbestos - which on renovation/demolition work is effectively everyone. Keep training records; refresh every 2–3 years. Cost is modest ($150–$300/person); audit exposure is substantial.

50. Q50 (ASB, weight 2): Do you use licensed asbestos disposal facilities and retain disposal dockets with the job record?

    • Yes - licensed facility only, dockets filed (score 5)
    • Usually licensed, records informal (score 3)
    • Sometimes enters general waste (score 0)
    • Not clear on disposal rules (score 0)
    • Not applicable - we don't handle asbestos on our sites (score 5)

    If a weak option is selected: Even small amounts of non-friable asbestos (under 10m², no removalist licence required) still must go to a licensed asbestos disposal facility. No general waste, no kerbside skips, no unlicensed fill sites. Environmental regulators audit disposal trails in complaints investigations. Keep every docket with the corresponding job record - at least 7 years.

51. Q51 (CYB, weight 3): When a supplier invoice shows new or updated bank details, do you verify by phone on a previously-known number before paying?

    • Yes - always, using a number from a past invoice or their website (score 5)
    • Usually - but occasionally trust the new details (score 1)
    • We just process it (score 0)
    • We've been caught out before (score 0)

    If a weak option is selected: This single control stops most Business Email Compromise attacks. AFP issued a specific October 2025 warning about BEC scams targeting construction. Documented Australian cases: Inoteq/Mobius ~$235K (court-ordered repayment), NSW construction $41.8K, Pure Glass WA $50K, private Sydney hospital $3M+. NEVER call the number on the new invoice - verify using a previously known number from an older invoice or the supplier's official website.

52. Q52 (CYB, weight 3): Is multi-factor authentication enforced on your business email, banking, and accounting software across every staff account?

    • Yes - handled in-house, and we verify it (reports, logs, or checks) (score 20)
    • Yes - outsourced to our IT provider, verified (they send us reports) (score 20)
    • Yes - in-house, but not formally verified (score 15)
    • Yes - outsourced, but we assume rather than verify (score 15)
    • Partial or inconsistent across staff/devices (score 8)
    • No, or don't know (score 0)

    If a weak option is selected: Email is the primary BEC attack surface - compromise the email account and the attacker watches real invoice traffic for weeks, then strikes at the perfect moment with a spoofed payment request. MFA on email (Microsoft 365 / Google Workspace) stops 99% of email account takeovers. Banking MFA is usually enforced; accounting software MFA (Xero, MYOB, QuickBooks) is a settings toggle often off by default. If your IT provider handles it, ask for a quarterly MFA-coverage report naming any account still without MFA.

53. Q53 (CYB, weight 2): Do staff handling invoices or payments receive cyber awareness training at least annually?

    • Yes - annual training with realistic scenarios (score 5)
    • Once at induction, never refreshed (score 2)
    • Informal briefings (score 1)
    • No cyber training (score 0)

    If a weak option is selected: Every staff member is a target. The documented Australian construction BEC cases all traced back to staff who didn't recognise the signs. Annual training with realistic scenarios (phishing simulations, verification role-plays) is low-cost and high-leverage. Options: ACSC Cyber Wardens (free), HIA/MBA cyber modules, paid phishing simulation services (~$10–15/user/month). Test, not just teach.

54. Q54 (CYB, weight 2): Do all staff use a business password manager with unique, strong passwords for every business account?

    • Yes - handled in-house, and we verify it (reports, logs, or checks) (score 20)
    • Yes - outsourced to our IT provider, verified (they send us reports) (score 20)
    • Yes - in-house, but not formally verified (score 15)
    • Yes - outsourced, but we assume rather than verify (score 15)
    • Partial or inconsistent across staff/devices (score 8)
    • No, or don't know (score 0)

    If a weak option is selected: Reused passwords mean one breach anywhere becomes a breach everywhere. Password managers (1Password, Bitwarden, Dashlane) solve this - unique 20-character random passwords for every account, accessible with one master password and MFA. Shared logins are a particular red flag for auditors and insurers. If your IT provider deploys the password manager, ask for an adoption report (vaults created, weak-password warnings still outstanding).

55. Q55 (CYB, weight 2): Do you have a documented incident response plan for a suspected cyber incident (bank fraud, email compromise, ransomware)?

    • Yes - written, tested, everyone knows the steps (score 5)
    • We'd figure it out (score 1)
    • No plan (score 0)
    • It's happened before and we have learnings (score 3)

    If a weak option is selected: The first hour after a BEC matters most. Process: (1) Call the bank immediately - funds can sometimes be recalled if reported within hours. (2) Report to ReportCyber (cyber.gov.au). (3) Change affected passwords. (4) Notify your insurer. (5) Check for lateral compromise. Have phone numbers and logins ready in an offline document prepared in advance. Test the plan with a tabletop exercise annually.

56. Q56 (CYB, weight 2): Are critical systems and devices (phones, laptops, routers, accounting software, project management tools) kept patched and up to date on a managed schedule?

    • Yes - handled in-house, and we verify it (reports, logs, or checks) (score 20)
    • Yes - outsourced to our IT provider, verified (they send us reports) (score 20)
    • Yes - in-house, but not formally verified (score 15)
    • Yes - outsourced, but we assume rather than verify (score 15)
    • Partial or inconsistent across staff/devices (score 8)
    • No, or don't know (score 0)

    If a weak option is selected: Unpatched systems are the entry point for ransomware. ASD Essential Eight lists patching applications and operating systems as fundamental controls. Enable auto-updates on phones, laptops, routers, and accounting software. If a piece of equipment is too old to get patches, it's time to replace it. If your IT provider handles patching, ask for a monthly patch-compliance report - 'everything is up to date' without evidence is the same as 'we hope it is'.

57. Q57 (CYB, weight 2): Are business-critical data backups (project files, accounting, contracts) stored offsite AND tested against actual restoration at least annually?

    • Yes - handled in-house, restore-tested, and evidence retained (score 20)
    • Yes - outsourced to our IT provider, restore-tested and verified by provider report (score 20)
    • Yes - in-house backups exist, but restore testing/evidence is informal (score 15)
    • Yes - outsourced to our IT provider, but we assume rather than verify (score 15)
    • Partial, incomplete, or not covering all critical systems (score 8)
    • No reliable backup and restore process, or don't know (score 0)

    If a weak option is selected: Ransomware cases routinely cost small builders 2–3 weeks of operating data and significant reputational harm. Effective backup: cloud-native (Microsoft 365 / Google Workspace retention), plus independent backup (Druva, Backblaze, Veeam), plus an annual restore test. A backup you haven't tested is a hope, not a plan. Project management software (Buildxact, Procore) should also be backed up - don't rely on the vendor alone. If your IT provider runs the backup, ask for the dated restoration-test report.

58. Q58 (AML, weight 3): Have you enrolled with AUSTRAC under the Tranche 2 regime (enrolment opened 31 March 2026, closes 29 July 2026, commencement 1 July 2026)?

    • Yes - enrolled, AUSTRAC Online account active (score 5)
    • In progress - enrolment started (score 3)
    • Aware but not enrolled yet (score 1)
    • Not aware enrolment applies to us (score 0)

    If a weak option is selected: From 1 July 2026, AUSTRAC's Table 5 designated services capture builders who 'plan or execute a transaction for the purchase, sale or transfer of real estate, in the course of carrying on a business selling real estate'. Spec builders, developers, and H&L businesses are captured. Enrolment opened 31 March 2026 and CLOSES 29 July 2026. Missing enrolment before trading in a designated service is a civil penalty offence with significant fines. Enrol via AUSTRAC Online immediately.

59. Q59 (AML, weight 3): Have you conducted (or commissioned) an ML/TF risk assessment for your business?

    • Yes - completed risk assessment covering customer types, products, geography, channels (score 5)
    • Partially - identified main risks informally (score 2)
    • Have not started (score 0)
    • Not sure what an ML/TF risk assessment involves (score 0)

    If a weak option is selected: The AML/CTF program starts with a documented ML/TF risk assessment covering: customer types (Australian residents, foreign buyers, trusts, companies, PEPs), products/services (off-the-plan, H&L, luxury, bulk sales), geography (high-risk jurisdictions), and delivery channels (direct, through agents). This drives everything else. AUSTRAC's Real Estate Program Starter Kit explicitly EXCLUDES developers who sell their own property - you need your own risk assessment, not a template.

60. Q60 (AML, weight 3): Have you developed and documented an AML/CTF program (Part A policies, Part B customer due diligence procedures)?

    • Yes - Part A and Part B written, approved by governing body (score 5)
    • Drafting in progress (score 2)
    • Plan to use AUSTRAC starter kit (score 1)
    • Haven't started (score 0)

    If a weak option is selected: Every reporting entity must have a written AML/CTF Program with Part A (oversight, risk assessment, officer, training, review) and Part B (customer due diligence procedures). Note: AUSTRAC's Real Estate Starter Kit is designed for small agents brokering only - it explicitly EXCLUDES property developers who sell their own property. Builders and developers need their own program, often via legal advice from a firm with AUSTRAC experience (Hall & Wilcox, Gadens, Corrs).

61. Q61 (AML, weight 3): Have you conducted (or are you ready to conduct) customer due diligence (KYC) on buyers BEFORE contract signing?

    • Yes - CDD process in place, verification methods tested (score 5)
    • Understanding but no process yet (score 2)
    • Expect the real estate agent does this (score 0)
    • Not familiar with CDD requirements (score 0)

    If a weak option is selected: CDD (Customer Due Diligence / KYC) on property buyers is the most visible operational change. Before any contract for a designated-service transaction, you must: verify identity (driver licence, passport, or equivalent), establish beneficial owner (for companies and trusts), obtain source-of-funds information for higher-risk customers, and apply enhanced due diligence for Politically Exposed Persons or high-risk jurisdictions. AUSTRAC expects this IN ADDITION to whatever the real estate agent does - not instead of.

62. Q62 (AML, weight 2): Have you appointed a named AML/CTF Compliance Officer with appropriate authority and independence?

    • Yes - appointed, with written role description and access to the board (score 5)
    • Likely to be the Director / Owner (score 3)
    • Not appointed yet (score 1)
    • Not familiar with the role (score 0)

    If a weak option is selected: Every reporting entity must appoint an AML/CTF Compliance Officer with appropriate seniority, access to the governing body, and independence. For small businesses this is typically the owner/director, but must be formally appointed with a role description. Responsibilities include program oversight, suspicious-matter reporting, staff training, and annual program review. Document the appointment - AUSTRAC will ask.

63. Q63 (AML, weight 2): Do you have a training plan for staff involved in customer-facing work (sales, contracts, admin) on AML/CTF obligations?

    • Yes - training plan in place, first sessions scheduled (score 5)
    • Plan to organise closer to 1 July 2026 (score 2)
    • Haven't started (score 0)
    • Only the owner will handle this work (score 2)

    If a weak option is selected: AML/CTF training for relevant staff is a Part A program requirement. Staff involved in customer-facing work (sales, contracts, settlement admin) need awareness training on: identifying suspicious matters, correct CDD process, record-keeping requirements, and reporting lines. Initial training before 1 July 2026, then ongoing for new starters and refreshers at intervals set in your program. Industry bodies (HIA, Master Builders, Property Council) are developing modules.

64. Q64 (AML, weight 2): Do you understand the record-keeping obligations (7 years from last service) and the suspicious-matter reporting process?

    • Yes - record-keeping integrated with job management, SMR process documented (score 5)
    • Aware of the 7-year rule, SMR process informal (score 3)
    • Not familiar with SMR process (score 1)
    • Haven't looked at record-keeping rules (score 0)

    If a weak option is selected: AML/CTF record-keeping obligations require retention for 7 years from the date of the transaction OR the last provision of service to the customer, whichever is later. Covers: CDD records, transaction records, program review records, training records. Suspicious Matter Reports (SMRs) must be lodged via AUSTRAC Online within 3 business days for ML/TF suspicions or 24 hours for terrorist financing. Threshold Transaction Reports (TTRs) apply to $10K+ cash; most property transactions are not cash so TTRs are rarer.

Guidance

Disclaimer