AML/CTF checklist for real estate agents

Real estate agents who broker the sale, purchase or transfer of real estate have been reporting entities under the AML/CTF Act since 1 July 2026. In August 2026 AUSTRAC began sending section 167 information requests to businesses that appear to provide designated services but have not enrolled, and on 30 September 2026 it announced that it had begun issuing infringement notices to businesses it believes failed to enrol.

This checklist sets out the ten things an agency needs in place, in roughly the order they fall due. Use it to check the program you already have, or to prepare before you start providing a designated service. It is general information, not legal advice.

Last reviewed: 27 October 2026

1. Confirm you provide a designated service

Brokering the sale, purchase or transfer of real estate for a customer, in the course of carrying on a business, is a designated service. In practice that captures seller’s agents and buyer’s agents, and a developer that sells its own property without engaging an independent agent provides a designated service of its own.

Some property work is outside the definition. Real estate does not include leases of 30 years or less, easements and restrictive covenants, or mortgagee interests, so services relating only to those interests are not real estate designated services. Property management and rent collection are generally not designated services either: our guide to property management and AML/CTF explains where the line sits.

AUSTRAC’s check if you may be regulated page is a good starting point. If your business provides other designated services as well, such as conveyancing, include them in everything that follows.

2. Enrol with AUSTRAC

You must apply to enrol no later than 28 days after the day you first provide a designated service (section 51B). For a business that was already providing real estate designated services before 1 July 2026, and no other designated services, the deadline was 29 July 2026.

If that date has passed and you have not applied, apply now. The obligation continues until you do, and each day from the deadline is a separate contravention. Our guide to missing the AUSTRAC enrolment deadline explains how to apply late and how an infringement notice works.

3. Designate your AML/CTF compliance officer

Designate an AML/CTF compliance officer no later than 28 days after you start providing a designated service (section 26K), and notify AUSTRAC within 14 days after the designation (section 26M). If you were already providing real estate designated services before 1 July 2026, and no other designated services, the deadline to notify is the later of 29 July 2026 and 14 days after your name was entered on the Reporting Entities Roll (AML/CTF Transitional Rules 2026, section 19).

The compliance officer must be employed or otherwise engaged at management level and have sufficient authority, independence and access to resources and information to do the job (section 26J(2)). To be eligible they must also be a fit and proper person and, if you provide services through a permanent establishment in Australia, a resident of Australia (section 26J(3)).

AUSTRAC’s real estate program starter kit says the person who customises the program will usually be the compliance officer and, for real estate agencies, typically the licensee in charge.

4. Complete your ML/TF risk assessment

Your ML/TF risk assessment identifies and assesses the money laundering, terrorism financing and proliferation financing risks your business may reasonably face in providing its designated services (section 26C). It must have regard to the kinds of services you provide, your customers, your delivery channels, the countries you deal with and any risk information AUSTRAC gives you.

You must not start providing a designated service without an up-to-date risk assessment (section 26E). Review it before a significant change that is within your control, as soon as practicable after one that is not, and in any event at least once every 3 years (section 26D). Our guide to the real estate AML risk assessment covers what to assess.

5. Develop, document and approve your AML/CTF policies

Under the Act, your AML/CTF program is two things: your ML/TF risk assessment and your AML/CTF policies (section 26B). Your policies are the procedures, systems and controls that manage and mitigate the risks you identified and make sure you meet your obligations (section 26F).

Among other things, the policies must deal with:

carrying out customer due diligence
keeping your governing body informed of your ML/TF risks
designating the compliance officer, and the senior managers who approve the policies and the risk assessment
due diligence on, and training for, staff whose work is relevant to your obligations
independent evaluations of the program, at least once every 3 years.

Document the risk assessment and policies before you first provide a designated service (Rules section 5-15), have a senior manager approve them (section 26P), and then follow them: failing to comply with your own policies is a civil penalty contravention (section 26G).

AUSTRAC’s real estate program starter kit is designed for small agencies with specific characteristics, including providing only the brokering service and having 15 or fewer personnel. If your agency does not have all of them, AUSTRAC says you must assess whether the kit is appropriate and identify the changes you need. Our plain-English guide to the AML/CTF program explains each part.

6. Run customer due diligence before you act

Before you start providing a designated service to a customer, you must establish on reasonable grounds (section 28(2)):

who the customer is
anyone acting for them, and their authority to act
anyone on whose behalf they are receiving the service
the beneficial owners, if the customer is not an individual
whether any of those people is a politically exposed person or designated for targeted financial sanctions
the nature and purpose of the business relationship or transaction.

For an individual, that includes taking reasonable steps to establish that they are who they claim to be.

When you broker a sale, the Act treats both the seller and the buyer as your customers (section 6, table 5, item 1). The Rules allow CDD on the party you are not acting for to follow the start of the service, but only if every condition in section 29 of the Act is met: the Rules permit it in the circumstances, starting first is essential to avoid interrupting the ordinary course of business, any additional ML/TF risk from the delay is low, and your policies provide for completing it and manage that risk. It must then be completed as soon as reasonably practicable, and in any case by the earlier of 28 days after exchange of contracts and 3 days before the initially agreed day for settlement (Rules section 6-32).

If the party you are not acting for will not cooperate, a matter is taken to be established once you have taken all reasonable steps to establish it, recorded those steps and the difficulties you met, and recorded your consideration of whether a suspicious matter reporting obligation arises (Rules section 6-33(2) and (3)). Their failure to cooperate is itself something you must take into account in deciding whether you have reasonable grounds for a suspicion (Rules section 9-4A).

We recommend running the sanctions check on the other party as soon as you have their details, even where the rest of their CDD can follow: your policies must deal with not making assets available to, or dealing with the assets of, a person designated for targeted financial sanctions (Rules section 5-3).

Three situations come up often:

someone signing for the owner, such as an executor or an attorney: see who the customer is when someone else signs
a client who cannot provide standard ID: see your options when a client can’t provide standard ID
a company, trust or SMSF as buyer or seller: see beneficial ownership in property transactions.

7. Set up reporting, and keep reports confidential

Report a suspicious matter to AUSTRAC within 3 business days after you form the suspicion, or within 24 hours if it relates to terrorism financing (section 41). Report a threshold transaction, a transfer of $10,000 or more in physical currency, within 10 business days (section 43).

Your policies must provide safeguards against tipping off (Rules section 5-13). It is an offence to disclose that you have given, or are required to give, a suspicious matter report, or information from one, where the disclosure would or could reasonably be expected to prejudice an investigation (section 123).

You must also lodge an annual compliance report. AUSTRAC’s reporting period runs with the financial year, with lodgement between 1 July and 30 September, so the first report for the period starting 1 July 2026 is due by 30 September 2027.

8. Screen and train your people

Your policies must deal with due diligence on the people you employ or engage whose work is relevant to your AML/CTF obligations, and with training them on your ML/TF risks and your obligations (section 26F(4)). Keep a record of who was screened, who was trained, when and on what.

9. Keep the records

Keep the records that let you reconstruct each transaction for 7 years from the day the record is made (section 107). Keep your customer due diligence records, including what you collected and the decisions you made, until 7 years after the business relationship ends or the occasional transaction completes (section 111). Keep records showing how you met your program obligations for 7 years after they stop being relevant (section 116).

The AML/CTF Act does not require you to copy identity documents, though another law might. AUSTRAC’s record-keeping guidance says that under the Act you aren’t required to make copies of identification documents provided as part of CDD; instead, you must keep records of what you did to identify the customer and the information they provided. It adds that you may have a legal responsibility to copy them outside the Act.

10. Plan the reviews and the independent evaluation

Diarise the reviews the Act builds in: the risk assessment at least every 3 years and when a trigger occurs (section 26D), the policies at least every 3 years (section 26F(3)), an independent evaluation of the program at least every 3 years (section 26F(4)), and a report from the compliance officer to the governing body at least every 12 months, unless your compliance officer is also your governing body or your business is an individual (Rules section 5-7). The independent evaluation report goes to the governing body and to the senior manager who approves the program (Rules section 5-10).

If you were already providing real estate designated services before 1 July 2026, and no other designated services, your first independent evaluation meets the frequency requirement if it is conducted before 30 June 2029, 31 December 2029, 30 June 2030 or 31 December 2030, depending on the last two digits of your enrolment identifier (AML/CTF Transitional Rules 2026, section 17).

If you are behind

AUSTRAC’s May 2026 statement of expectations expects newly regulated businesses to be enrolled, to have an AML/CTF program and a compliance officer, to have trained their staff, and to be ready to report a suspicious matter. It expects “effort, not perfection” during 2026-27, and it said it would take early enforcement action against businesses that fail to enrol.

If you are already providing designated services without an up-to-date risk assessment or AML/CTF policies, deal with that gap now: you must not start providing a designated service without them (sections 26E and 26F), and each service provided without them is a separate contravention. Work through steps 2 to 5 first, and get legal advice about any gap you already have. If you have received a notice from AUSTRAC, read our guide to what to do with a section 167 notice, and our explainer on how AUSTRAC enforcement works.

How AML Guard helps

AML Guard is built for Australian real estate agencies and other Tranche 2 businesses. Guided wizards produce your ML/TF risk assessment, AML/CTF program, customer acceptance policy and training manual, and can pre-fill later documents from your risk assessment. Identity checks, screening and officer review sit in one case record, which records each identity check, screening result and officer decision against the case.

AML Guard isn’t self-service: firms start with a demo.

FAQ

Do real estate agents need to enrol with AUSTRAC?

Yes, if they provide a designated service, such as brokering a sale or purchase of real estate. The application is due no later than 28 days after the agency first provides one. For agencies already providing real estate designated services before 1 July 2026, and no other designated services, the deadline was 29 July 2026.

When does an agency need its AML/CTF program?

Before it provides a designated service. The risk assessment must be up to date and the AML/CTF policies developed and documented before that first service, and a senior manager must approve both. Providing a designated service without them is a civil penalty contravention for each service provided.

Can a small agency use AUSTRAC’s program starter kit?

AUSTRAC designed its real estate starter kit for small agencies with set characteristics, such as providing only the brokering service and having 15 or fewer personnel. AUSTRAC says an agency without all of them must assess whether the kit is appropriate and identify the changes it needs.

How long do agents keep AML/CTF records?

Seven years, measured from different points. Transaction records run from the day they are made. Customer due diligence records run from when the business relationship ends or the transaction completes. You must record what you did to identify a customer, but the AML/CTF Act does not require you to copy their identity documents (another law might).

What if we missed the enrolment deadline?

Apply to enrol now: the obligation continues, and each day late is a separate contravention. AUSTRAC has issued infringement notices to businesses it believes failed to enrol. Check your compliance officer designation too: the Act requires one within 28 days of starting to provide a designated service.

Sources

See How AML Guard Works

Tranche 2 obligations are now in force.
Book a 20-minute demo to see how AML Guard supports your compliance from the moment your designated service begins.

Book a Demo

AML/CTF Compliance Checklist for Real Estate Agents