A common misunderstanding about AML/CTF compliance is that it means running identity checks on your clients. It does not. Identity checks are one step inside customer due diligence, and customer due diligence is one of the things your AML/CTF program has to deal with.
Since 1 July 2026, a real estate business that provides a designated service must have that program in place before it provides the service. This guide explains what the program is under the AML/CTF Act, what goes in it, who is responsible for it, and how a small agency can get one in place.
Last reviewed: 27 October 2026
What the Act says an AML/CTF program is
Under the Act, an AML/CTF program is two things: your ML/TF risk assessment and your AML/CTF policies (section 26B). If you have seen older material describe a “Part A” and “Part B” program, that structure no longer applies.
AUSTRAC’s program overview sums up what that means in practice. Your program must be in place before you start providing a designated service, clearly documented in writing, approved by a senior manager, and complied with. You must also review and update it as circumstances change, have it independently evaluated from time to time, and keep records.
Part 1: the ML/TF risk assessment
The risk assessment identifies and assesses the money laundering, terrorism financing and proliferation financing risks your business may reasonably face in providing its designated services (section 26C). It must have regard to:
- the kinds of designated services you provide
- the kinds of customers you deal with
- the delivery channels you use, including any new technologies
- the countries you deal with
- risk information AUSTRAC gives you.
You must not start providing a designated service without an up-to-date risk assessment (section 26E). Review it before a significant change that is within your control, as soon as practicable after one that is not, when AUSTRAC gives you risk information, and in any event at least once every 3 years (section 26D). Our guide to the real estate AML risk assessment covers what an agency should assess.
Part 2: the AML/CTF policies
Your AML/CTF policies are the policies, procedures, systems and controls that appropriately manage and mitigate the risks in your risk assessment and make sure your business complies with the Act, the Rules and the regulations (section 26F(1)). They must be appropriate to the nature, size and complexity of your business.
The Act and the Rules list matters your policies must deal with. For a real estate agency, the main ones are below. Some apply only in certain circumstances, and the list is not exhaustive:
| Your policies must deal with | Where it comes from |
|---|---|
| Identifying significant changes in your services, customers, delivery channels and countries, and in risk information from AUSTRAC | Section 26F(3)(a) |
| Carrying out customer due diligence | Section 26F(3)(b) |
| When you will collect, or collect and verify, a customer’s source of wealth and source of funds | Rules section 5-2 |
| Senior manager approval before you start acting for a customer where the customer, a beneficial owner or a person on whose behalf the customer receives the service is a foreign politically exposed person, or a domestic or international organisation politically exposed person and the risk is high | Rules section 5-5 |
| If you delay customer due diligence, completing it as soon as reasonably practicable and within the period the Rules set, and managing the added risk | Section 29 |
| If you take part in a real estate arrangement under which another business collects and verifies KYC information before settlement, how you will verify it yourself if you do not receive it | Rules section 5-20 |
| Reviewing and updating the policies, including at least once every 3 years | Section 26F(3) |
| Keeping the governing body informed of your ML/TF risks, if your business is not an individual | Section 26F(4) |
| Designating the AML/CTF compliance officer, and the senior managers who approve the policies and risk assessment | Section 26F(4) |
| Due diligence on, and training for, people whose work is relevant to your obligations | Section 26F(4) |
| Independent evaluations of the program, at least once every 3 years | Section 26F(4) |
| Not dealing with the assets of people designated for targeted financial sanctions | Rules section 5-3 |
| Reports from the compliance officer to the governing body, at least every 12 months, unless the officer is also the governing body or your business is an individual | Rules section 5-7 |
| Reviewing potential suspicious matters in time, and keeping reports complete and accurate | Rules sections 5-11 and 5-12 |
| Safeguards against tipping off | Rules section 5-13 |
Once the policies exist, you must follow them. Failing to comply with your own AML/CTF policies is a civil penalty contravention (section 26G), so a policy that sits in a drawer while staff do something else is a liability, not a protection.
Who is responsible for what
The Act gives the program to three roles. In a small agency one person can hold more than one of them.
- The governing body must exercise appropriate ongoing oversight of your risk assessment and your compliance, and take reasonable steps to make sure the business manages its ML/TF risks and complies (section 26H). AUSTRAC says that for smaller businesses the governing body may be the business owner.
- A senior manager must approve the risk assessment and the policies, and any updates to either (section 26P). Updates to the risk assessment must also be notified in writing to the governing body as soon as practicable.
- The AML/CTF compliance officer oversees and coordinates day-to-day compliance and the operation of your policies, and communicates with AUSTRAC (section 26L). You must designate one within 28 days of starting to provide a designated service (section 26K) and notify AUSTRAC within 14 days after the designation (section 26M); an agency already providing real estate designated services before 1 July 2026, and no other designated services, had until the later of 29 July 2026 and 14 days after its name was entered on the Reporting Entities Roll (AML/CTF Transitional Rules 2026, section 19). The officer must be at management level, with sufficient authority, independence and access to resources and information, and must be a fit and proper person (section 26J).
Document, approve, follow, review
The cycle the Act sets is simple to state:
- Document. Document your risk assessment and policies before you first provide a designated service, and document the program as updated within 14 days after any update (section 26N and Rules section 5-15).
- Approve. Have a senior manager approve the risk assessment and policies, and each update (section 26P).
- Follow. Apply the policies in daily work (section 26G), and keep the records that show how you met your program obligations (section 116).
- Review. Review the risk assessment and the policies at least every 3 years and when a trigger occurs, and have the program independently evaluated at least every 3 years (sections 26D and 26F). The evaluation must test whether you comply with your policies and whether you are managing your risks, and produce a written report for the governing body and the approving senior manager (Rules section 5-10). For an agency already providing real estate designated services before 1 July 2026, and no other designated services, the first evaluation meets the frequency requirement if it is conducted before a date between 30 June 2029 and 31 December 2030 set by its enrolment identifier (AML/CTF Transitional Rules 2026, section 17).
AUSTRAC can also ask for the documents. It can request your program documentation by written notice (section 26Q), and if it is satisfied a program is missing, out of date or inadequate, it can require you to undertake or update the risk assessment and policies within a period it specifies (section 26R).
AML checks versus an AML/CTF program
| AML checks | AML/CTF program |
|---|---|
| Verifying a customer’s identity | A documented ML/TF risk assessment |
| Screening for politically exposed persons and sanctions | AML/CTF policies approved by a senior manager |
| Collecting KYC information for one customer | Procedures that decide what to collect, from whom and when |
| A point-in-time result | Ongoing customer due diligence, reviews and evaluations |
| Can be done with the help of a provider | Obligations that stay with your business |
| One input into customer due diligence | Must be in place before you provide a designated service |
A tool that runs identity checks and screening covers the left column. The right column is your business’s responsibility, whatever software you use to manage it.
Can you outsource parts of it?
You can use providers for parts of the work, such as identity verification, screening or a compliance platform, but the obligations in the Act sit with your business as the reporting entity. Outside the Act’s reliance provisions, a provider that gets something wrong does not take the obligation off you.
The Act lets you rely on another person’s collection and verification of KYC information, under conditions (sections 37A and 38). Reliance covers that collection and verification (section 28(3)(c) and (d)); you still identify the customer’s ML/TF risk and establish each matter in section 28(2), and the record-keeping obligations in Part 10 stay with you. Entering a reliance agreement needs a senior manager’s approval (Rules section 5-5(1)(f)), and the agreement must be assessed at intervals of not more than 2 years that take your ML/TF risks into account, and again after any significant change in circumstances that may affect it, with a written record of each assessment within 10 business days (section 37B and Rules section 6-30). Our guide to CDD reliance explains the conditions.
Can a small agency use AUSTRAC’s starter kit?
AUSTRAC publishes a real estate program starter kit for small real estate and buyer’s agencies. It includes a risk assessment covering common industry risks, policies, processes and forms. AUSTRAC designed it for businesses that, among other things:
- provide only one designated service, brokering the purchase, sale or transfer of real estate
- have 15 or fewer personnel, including administrative staff
- mostly deal with individual customers who are Australian residents, and don’t regularly deal with high-risk customers
- don’t broker overseas property or sell property they own themselves
- don’t offer fully remote self-service options.
If your business has all of AUSTRAC’s listed characteristics, AUSTRAC says the kit is suitable. If it doesn’t, AUSTRAC says you must assess whether the kit is appropriate for your business and identify the changes you need, and that you cannot rely on the kit to meet its expectations of an appropriate program. Either way, the kit only becomes your program once you customise it to your business. Our guide to choosing an AML/CTF program template compares the options.
What happens if you don’t have a program
Providing a designated service without an up-to-date risk assessment, or without AML/CTF policies, is a civil penalty contravention, and each service you provide is a separate contravention (sections 26E and 26F). The Federal Court can order a civil penalty of up to 100,000 penalty units for a body corporate and 20,000 for any other person (section 175). Our explainer on how AUSTRAC enforcement works covers the rest of the toolkit.
Beyond penalties, a business without a program has no documented basis for its decisions about customers, and nothing to show a reviewer or an independent evaluator.
How AML Guard helps
AML Guard is built for Australian real estate agencies and other Tranche 2 businesses. Guided wizards produce your ML/TF risk assessment, AML/CTF program, customer acceptance policy and training manual, and can pre-fill later documents from your risk assessment. Identity checks, screening and officer review sit in one case record, which records each identity check, screening result and officer decision against the case.
AML Guard isn’t self-service: firms start with a demo.
FAQ
What must an AML/CTF program contain?
Two parts: an ML/TF risk assessment and AML/CTF policies (section 26B). The policies must deal with matters set by the Act and the Rules, including customer due diligence, the compliance officer, senior manager approvals, staff due diligence and training, reporting, tipping-off safeguards and independent evaluation.
Do I need an AML/CTF compliance officer?
Yes. You must designate one within 28 days of starting to provide a designated service and notify AUSTRAC within 14 days after the designation; the Transitional Rules gave some agencies already active before 1 July 2026 more time to notify. The officer must be at management level, a fit and proper person and, for Australian operations, an Australian resident.
Can I outsource AML/CTF compliance?
You can use providers for parts of the work, such as identity verification or a compliance platform, but the obligations stay with your business. Under its reliance provisions, the Act lets you rely on another person’s collection and verification of KYC information, subject to conditions; the rest of customer due diligence and your records stay with you.
Can I use AUSTRAC’s program starter kit?
AUSTRAC’s real estate starter kit is designed for small agencies with set characteristics, such as providing only the brokering service and having 15 or fewer personnel. If your agency lacks any of them, AUSTRAC says you must assess whether the kit is appropriate and identify the changes you need.
What is the difference between AML checks and an AML/CTF program?
AML checks, such as identity verification and screening, are steps within customer due diligence. The AML/CTF program is the documented risk assessment and policies that decide how those checks are done, when, by whom and how they are reviewed. The Act requires the program.
What is the difference between an AML program and KYC?
KYC, or know your customer, is the information you collect and verify about a customer during customer due diligence. The AML/CTF program is the framework of risk assessment and policies that governs how KYC is collected, verified, recorded and reviewed across the business.
Sources
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 | Federal Register of Legislation
- Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 | Federal Register of Legislation
- Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026 | Federal Register of Legislation
- Your AML/CTF program overview | AUSTRAC
- Governing body | AUSTRAC
- AML/CTF compliance officer | AUSTRAC
- Step 3: Manage and mitigate your risks, AML/CTF policies | AUSTRAC
- Step 5: Conduct an independent evaluation | AUSTRAC
- Real estate program starter kit: getting started | AUSTRAC
See How AML Guard Works
Tranche 2 obligations are now in force.
Book a 20-minute demo to see how AML Guard supports your compliance from the moment your designated service begins.
Related Reading
- AML/CTF Compliance Checklist for Real Estate Agents
- Beneficial Ownership in Property Transactions
- When Does AML Compliance Actually Start in a Property Transaction?
- Which AML/CTF program template should you use in 2026?