Privacy and AML/CTF in Australia for Tranche 2

If your business is a reporting entity under the AML/CTF Act, the Privacy Act 1988 applies to the personal information you handle for AML/CTF purposes, whatever your annual turnover. Tranche 2 obligations for real estate, legal, accounting, and trust and company service providers commenced on 1 July 2026, so the two regimes now sit side by side in your daily customer due diligence (CDD). This guide explains where they meet, what each requires, and how to build one process that satisfies both.

TL;DR

• Reporting entities must comply with the Australian Privacy Principles (APPs) for AML/CTF activities even if they would otherwise be exempt as a small business with a turnover of $3 million or less.
• Collect only what CDD reasonably needs (APP 3), give a collection notice (APP 5), use the information for that purpose or as the law requires (APP 6), and keep it secure (APP 11).
• Biometric information used for automated verification is sensitive information and generally needs consent, unless the AML/CTF Act or Rules require or authorise the collection. AUSTRAC does not require you to keep copies of ID documents.
• Keep CDD records for seven years from the end of the business relationship or the completed occasional transaction (section 111), then destroy or de-identify what you no longer need. Section 123 makes tipping off an offence, which limits what you tell a customer.
• A data breach is both a privacy event under the Notifiable Data Breaches (NDB) scheme and an AML/CTF risk, so plan your response before you need it.

Table of Contents

• Why the Privacy Act applies to every reporting entity
• Where the two laws meet: the Australian Privacy Principles in CDD
• Biometric information and consent
• Identity documents: record the details, not the copy
• Retention: seven years, then destruction or de-identification
• Notifiable data breaches
• Tipping off and transparency
• A privacy-aware CDD process, step by step
• Our perspective: one record, two regulators
• See how a privacy-first CDD workflow runs
• Common mistakes to avoid
• FAQ
• Sources

Why the Privacy Act applies to every reporting entity

Most small businesses, defined by the OAIC as those with an annual turnover of $3 million or less, are outside the Privacy Act. Many boutique real estate agencies, sole-practitioner conveyancers and small accounting practices fall into that group for their ordinary work.

Becoming a reporting entity changes that. The OAIC’s privacy guidance for reporting entities explains that a small business covered by the Act because it is a reporting entity continues to carry Privacy Act responsibilities for its AML/CTF activities, even where AUSTRAC has granted an exemption from some obligations. The OAIC announced that from 1 July 2026 Tranche 2 entities are brought into the Privacy Act, and its guidance for reporting entities is updated from time to time, so check the date on the page.

The most common error for newly regulated businesses is to assume a small turnover provides an exemption. It does not, for anything you do under your AML/CTF program. In practice, that means your privacy policy, collection notices and security settings need to be part of the program from the first customer you onboard, not added later.

Where the two laws meet: the Australian Privacy Principles in CDD

The Australian Privacy Principles set the standard for how personal information is collected, used, stored and disclosed. Four of them shape CDD more than the rest.

Collect only what CDD needs (APP 3)

Data minimisation and comprehensive record keeping can look like they pull in opposite directions. They do not, provided you can explain your reasoning. If you can show why a particular piece of information was necessary to assess the money laundering and terrorism financing (ML/TF) risk of that customer, you meet the AML/CTF requirement to be thorough and the privacy requirement to be reasonable. That recorded rationale is also what a supervisor looks for in a review.

The practical consequence is that a standard individual customer and a high-risk customer will not generate identical files. Enhanced due diligence justifies additional collection, such as source of funds or wealth, because the risk assessment calls for it. A low-risk customer does not.

Give a collection notice (APP 5)

A collection notice tells the individual who you are, why you are collecting their information, which law requires it, who you may disclose it to, and how to reach your privacy policy. For AML/CTF, the notice should name the AML/CTF Act as the authority for collection and mention that information may be disclosed to AUSTRAC.

Give the notice at the point of collection. In a digital intake, that means before the customer uploads a document or starts a biometric check, not in a footer. Keep a record of when the notice was shown.

Use it for that purpose, or as the law requires (APP 6)

Where the AML/CTF Act or Rules require or authorise you to use or disclose information, you may do so without consent. That covers reports to AUSTRAC. It does not cover reusing CDD data to market a property service, to cross-sell, or to feed other business systems that have no need of it.

This is where CRM design matters. Passport details do not belong in a contact record that every salesperson can open. Our guide to storing KYC in a CRM under Australian law sets out what to keep where.

Keep it secure (APP 11)

AUSTRAC expects you to store sensitive records, such as customer identification details and suspicious matter reports, securely and to limit access to authorised staff. Stored CDD information is attractive to criminals, and AUSTRAC notes that breaches involving personal information increase the risk of identity crime, fraud and cyber-enabled crime. Reasonable steps are an ongoing duty, so review access rights when staff join, change roles or leave, and test your controls on a schedule.

Biometric information and consent

Biometric information used for automated biometric verification or identification is sensitive information under the Privacy Act, and it receives a higher level of protection. Under APP 3, you generally cannot collect sensitive information without the individual’s consent, unless the collection is required or authorised by law.

For a face-match or liveness check, three practical points follow:

1. Ask for consent separately and plainly. Say what is captured, why, and how long it is kept. Do not bundle it into general terms.
2. Offer an alternative where you can. A customer who declines a biometric check should still have a route to verification, such as an officer-reviewed check of documents.
3. Keep the consent record. Store the time, the wording shown and the outcome alongside the verification result.

The UK has its own regime, but a UK perspective on keeping identity verification private illustrates the same themes of consent and purpose limitation that Australian reporting entities must apply under the APPs.

Identity documents: record the details, not the copy

Many businesses assume AML/CTF law obliges them to hold a scan of every passport and driver licence. It does not. AUSTRAC’s record keeping overview says you are not required to make copies of identification documents provided as part of CDD. You must instead keep records of what you did to identify the customer and what information they provided, such as the passport details used to verify identity. The OAIC has been direct on this: following its updated guidance, businesses should not retain copies of full ID documents for AML/CTF record-keeping purposes. That applies from 31 March 2026 for existing reporting entities and from 1 July 2026 for Tranche 2. The OAIC’s privacy guidance for reporting entities treats copies made before 31 March 2026 differently: they are records under the Act, and entities may keep them for the seven-year period.

The reasoning is simple. A copy of a passport you do not need is a liability: it adds to your breach exposure without improving your compliance. Once you have verified the customer and recorded what the Act requires, take reasonable steps to destroy or de-identify the copy unless another lawful purpose requires you to hold it.

Retention: seven years, then destruction or de-identification

Retention runs in two directions. Under section 111 of the AML/CTF Act, you must keep CDD records for seven years from the end of the business relationship, or from the completion of an occasional transaction. Transaction records run for seven years from the day the record is made (section 107). AUSTRAC’s record keeping overview describes record keeping as creating full and accurate records and storing and managing them securely.

The Privacy Act then pulls the other way. When the retention period ends, information you no longer need should be destroyed or de-identified. Holding records indefinitely is not a safe default.

That gives you three clocks to manage:

• Start: for CDD records, the end of the business relationship or the completion of the occasional transaction; for transaction records, the day the record is made.
• End of the AML/CTF period: seven years later.
• Disposal: destruction or de-identification once no other lawful purpose remains.

For a closer look at how these periods interact, including the different starting points for different records, see AML record keeping: the seven-year clocks.

Notifiable data breaches

The NDB scheme sits in Part IIIC of the Privacy Act. It requires covered entities to notify affected individuals and the Commissioner about data breaches that are likely to cause serious harm. Because reporting entities are covered for their AML/CTF activities, the scheme applies to the CDD information you hold.

Two points catch people out:

• Suspicion is enough to trigger an assessment. You do not need certainty that harm occurred. If you have reasonable grounds to suspect an eligible data breach, you must assess it, and promptly.
• Remedial action can prevent notification, but only if it genuinely removes the likelihood of serious harm.

AUSTRAC also publishes live guidance on data breaches and AML/CTF considerations. It is worth reading alongside the OAIC material, and checking it periodically because it is updated as the regime matures. A written response plan should name who assesses a suspected breach, who contacts the OAIC and affected customers, and how the incident is recorded in your AML/CTF program.

Tipping off and transparency

Privacy law pushes you towards openness. AML/CTF law, in one narrow area, requires silence. Section 123 of the AML/CTF Act creates the tipping off offence. A reporting entity, or its officers, employees and agents, commits it by disclosing that a suspicious matter report has been, or is required to be, given, or by disclosing the report or what it says (including the formation or existence of a suspicion), where the disclosure would or could reasonably be expected to prejudice an investigation. The same applies to an AUSTRAC notice to give information or produce documents.

The two can be reconciled. You are generally expected to be transparent in your privacy policy and collection notices, but the OAIC says you do not need to provide information in a collection notice where that would be inconsistent with your tipping off obligations.

In practice:

• Keep collection notices general. They should say that information may be disclosed to AUSTRAC, without referring to any particular customer.
• Train staff on what they can say when a customer asks why more information is needed. “We are required by law to verify identity” is accurate and safe. Speculation about suspicion is not.
• Restrict access to SMR material to the people who need it, and keep it out of general CRM notes.

Our guide to suspicious matter reports for Tranche 2 firms covers the reporting workflow in more detail.

A privacy-aware CDD process, step by step

1. Show the collection notice before any information is requested.
2. Decide what is necessary from the customer’s risk rating, and record the reasoning.
3. Obtain consent before any biometric check.
4. Receive documents through a secure channel, not by email attachment.
5. Verify, record the document details, and do not keep the copy unless there is a separate lawful reason.
6. Restrict access to CDD records to those who need them for the task.
7. Schedule retention and disposal from the date the relationship ends.
8. Rehearse the breach response at least once, with real names against each role.

Our perspective: one record, two regulators

We built AML Guard for Australian Tranche 2 entities, and the same pattern appears in nearly every agency we speak to: the AML/CTF program and the privacy program are written by different people, at different times, from different templates. A supervisor reading both finds that the policies promise one thing and the intake form does another.

Our view is that privacy should be built into CDD rather than layered on top. That is why documents in AML Guard arrive by secure upload through the client intake portal, and your REX CRM receives status only, never CDD data. Sensitive material stays in the controlled environment, and the salespeople who need to know whether a customer is cleared see that outcome without seeing the passport behind it.

The same logic applies to records. Because risk scoring records its reasoning, you can show why you collected what you did. Because an officer reviews each determination, judgement stays with your people, and the platform handles the lookups and record keeping. AML Guard’s tamper-evident audit trail holds records for 8 years, above the Act’s seven-year minimum, so it can show how records were handled across the Act’s retention period.

Software does not make you compliant on its own. Your officer still decides, and you still need a privacy policy and breach plan that fit your business. What good tooling does is stop the two laws from contradicting each other in your files.

See how a privacy-first CDD workflow runs

If you want to see secure intake, officer review and the audit trail working together, you can book a demo of AML Guard. Pricing for the platform subscription and for individual and company or trust checks is set out on the pricing page.

Common mistakes to avoid

• Relying on the small business exemption for AML/CTF activities.
• Keeping scanned ID documents by default in shared drives or CRM notes.
• Burying biometric consent in general terms and conditions.
• Treating the retention period as a minimum with no end, and never disposing of data.
• Discussing a suspicion with the customer in the course of asking for more information.
• Writing a breach plan that no one has read, or that does not mention the OAIC.

FAQ

Does the Privacy Act apply to my small real estate agency?

Yes, for your AML/CTF activities. A business with a turnover of $3 million or less is normally exempt, but that exemption does not extend to a reporting entity handling personal information for its AML/CTF obligations. You must follow the APPs for that work from the day your obligations began.

Do I need consent to collect identity information for CDD?

Not always. Where the AML/CTF Act requires or authorises the collection, consent is not the basis, though you must still give a collection notice. Biometric information used for automated verification is sensitive information, so you should obtain consent before collecting it unless a legal requirement or authorisation applies.

How long must I keep CDD records, and what happens after?

Section 111 requires you to keep them for seven years from the end of the business relationship, or from the completion of an occasional transaction. After that, you should destroy or de-identify the information you no longer need, unless another lawful purpose applies.

Can I tell a customer why I have asked for more information?

You can explain that the law requires you to verify identity and understand the customer. Do not tell a customer that you have given, or must give, an SMR, or what it says. Section 123 makes that tipping off, an offence where the disclosure could reasonably be expected to prejudice an investigation, so do not test where the line is. If you are unsure what to say in a specific case, ask your AML/CTF compliance officer before replying.

What should I do if I suspect a data breach?

Assess it promptly and objectively under the NDB scheme. If it is likely to cause serious harm and remedial action has not removed that likelihood, notify the OAIC and affected individuals. Consider AUSTRAC’s data breach guidance too, and seek advice from a privacy lawyer where the facts are complex.

Sources

• Privacy guidance for reporting entities under the AML/CTF Act, OAIC
• Know your privacy obligations under the AML/CTF Act, OAIC
• Small business, OAIC
• Read the Australian Privacy Principles, OAIC
• Part 4: Notifiable Data Breach (NDB) Scheme, OAIC
• Data breaches and AML/CTF considerations, AUSTRAC
• Record keeping overview, AUSTRAC

Recommended

• AML/CTF Compliance Checklist for Real Estate Agents: What You Need Before 1 July 2026
• AUSTRAC reporting: SMRs, TTRs and annual reports
• Tranche 2 customer due diligence in Australia
• Tranche 2 AML Australia: your compliance obligations explained