Real Estate CDD Checklist: Run It on Every File

Customer due diligence (CDD) for a real estate transaction is a sequence you repeat on every file: check the client you act for before the service starts, deal with the other party within the delayed-CDD window, trace the people behind any company or trust, apply enhanced CDD where it is required, and record what you checked and decided. This checklist follows that order, so you can run it from instruction to settlement under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the AML/CTF Rules 2025, which have applied to real estate since 1 July 2026.

It is a per-transaction list. If you are still building your agency’s program (risk assessment, policies, training), start with our program set-up checklist for real estate and come back here for the file-by-file routine.

TL;DR

• Complete initial CDD on the client you act for before you provide any designated service, including PEP and targeted financial sanctions checks on the client, any beneficial owner and anyone acting for them.
• When you act for the seller, CDD on the buyer may be delayed to the earlier of 28 days after exchange or 3 days before the initially agreed settlement day, but only if the conditions in Rules section 6-32 are met.
• For companies, trusts and SMSFs, identify beneficial owners by ownership (25% or more) and by control, and follow the chain until you reach individuals.
• Apply enhanced CDD where section 32 of the Act requires it, and obtain senior manager approval before you start where Rules section 5-5 calls for it, for example for a foreign PEP.
• Keep a record of what was checked, the risk rating and the decision, as section 111 requires.

Table of Contents

• Who this checklist is for and how to use it
• Step 1: The client you act for
• Step 2: The other party
• Step 3: Companies, trusts and SMSFs
• Step 4: Enhanced CDD where section 32 requires it
• Step 5: The record
• The per-file checklist at a glance
• Our perspective: why file-level discipline beats a good manual
• Where AML Guard fits
• FAQ
• Sources

Who this checklist is for and how to use it

It is written for principals, licensees, property managers and compliance officers at agencies that broker the sale, purchase or transfer of real estate, and for buyers agents working alongside them. Print it, or build it into your file opening process, and tick it off on each matter. The steps stay the same on every file. What changes is the depth: AUSTRAC’s real estate program starter kit explains that your program scales controls to customer risk, so a low-to-medium risk customer needs fewer steps than a high-risk one.

Two cautions before you start. First, this article is general information, not legal advice. Your own AML/CTF program, approved by your governing body, sets the exact procedures you must follow, and your AML/CTF compliance officer or a lawyer should settle any edge case. Second, quote the live Rules, not a summary. The delayed-CDD timeframe for counterparties was extended from 15 days to 28 days after exchange, as AUSTRAC’s starter kit update notes record, so older guides may carry the earlier figure.

Step 1: The client you act for

The client you act for is, in most listings, the seller. On a buyers agent engagement it is the buyer. Either way, the rule is the same: initial CDD must be complete before you start providing a designated service to that person, apart from the narrow delays that section 29 of the Act allows and your program has to spell out (Step 2 sets them out for the other party). AUSTRAC’s page on delayed initial CDD confirms that a seller or transferor you act for must be fully checked first. In practice that means before the appraisal turns into a signed agency agreement and certainly before marketing begins.

What to establish on reasonable grounds

AUSTRAC’s initial CDD guide for individuals refers to sections 28 and 32 of the Act and lists the matters to establish. Use it as your reference for the exact list. In a real estate file the working checklist looks like this:

1. Identity of the customer, verified from reliable and independent documents or electronic data. Capture the document, the date and who reviewed it.
2. Anyone acting on the customer’s behalf, such as an attorney under a power of attorney, a solicitor or a family member signing for an owner. Establish who they are and that they are authorised.
3. Whether the customer is acting for someone else, including a nominee or a trustee.
4. PEP status of the customer, any beneficial owner and any person acting for them. Ask the question directly at intake and screen independently rather than relying on the answer alone. Foreign PEPs call for particular care, and AUSTRAC’s foreign PEP example shows how an intake answer about a close associate of an overseas official changes the process.
5. Targeted financial sanctions: whether the customer, a beneficial owner or a person acting for them is designated. A positive match is not a file note, it is an escalation to your compliance officer.
6. Purpose and nature of the business relationship, and the source of the property being sold where your risk assessment calls for it.

Getting the screening right

The same AUSTRAC guide says a PEP screening service you use could reflect the definition of PEP in the Act and Rules and allow effective searching despite minor discrepancies or errors in the data entered. For sanctions it notes that names can have variant spellings, so you may need to check alternatives. A search for “Mohammed” that misses “Muhammad” is a gap in your control, not a clean result. Record how a potential match was cleared, not just that it was.

Step 2: The other party

A selling agent’s customers include the buyer. That surprises many agencies, because the buyer never signs your agency agreement. Under Rules section 6-32, however, you may delay CDD on the party you are not acting for.

When you act for the seller, the Rules let you complete initial CDD on the buyer by the earlier of:

• 28 days after the exchange of contracts, or
• 3 days before the initially agreed day for settlement.

The Rules themselves set this out in Division 9, section 6-32, and AUSTRAC’s delayed CDD guidance restates it. The delay is permission, not a default, and it has conditions. Under section 6-32 the service must be brokering the sale, purchase or transfer, provided at or through a permanent establishment in Australia, and you must already have started providing a designated service to the other party (here, the seller). Section 29 of the Act adds more: you must decide on reasonable grounds that starting before CDD is essential to avoid interrupting the ordinary course of business and that any additional ML/TF risk is low, and your AML/CTF policies must say how you will complete CDD as soon as reasonably practicable and manage the risk until then. Write those conditions into your procedure.

Practical points on the delay

• Diarise both dates the day contracts exchange. The earlier date governs, and a short settlement can make the 3-day limit the binding one.
• Start early anyway. Sending the buyer’s intake link at the offer stage removes the scramble before settlement.
• Do not delay for a higher-risk buyer. An overseas buyer, a buyer paying through a complex structure or one raising PEP concerns is a reason to complete CDD sooner. Our note on buyer due diligence for real estate agencies walks through that decision, and the overseas buyer guide covers the extra checks.
• Reverse the roles for a buyers agent. When you act for the buyer, that buyer is your client and must be checked before service starts, while the seller’s side runs on its own clock. The buyers agent explainer sets out the two customers and two clocks.

If a buyer cannot be verified within the window, your program should say what happens next, including whether your compliance officer considers a suspicious matter report. Decide that in advance, not on the day.

Step 3: Companies, trusts and SMSFs

Many property buyers are not individuals. They are companies, family trusts, SMSFs or a trustee company acting for one of them. For these, identifying the entity is only the start. You must also determine who stands behind it.

AUSTRAC’s guidance on ownership and control structures defines a beneficial owner as an individual who directly or indirectly owns 25% or more of the customer, or who controls it. Ownership is a stake; control is influence. You need both lenses on every entity file.

By ownership

1. Obtain the entity’s details, such as company name and ACN, and check them against ASIC records.
2. List every shareholder or interest holder at 25% or more.
3. Where a shareholder is itself a company or trust, move up a level and repeat. AUSTRAC’s guidance requires following the chain until you reach the individuals.
4. Record each individual, the percentage and the evidence.

By control

Ask who can direct the entity’s decisions, whatever the shareholding. That can include directors, a person with veto rights, an appointor of a trust or someone who instructs the nominal decision makers. A person holding 10% who in practice runs the entity may be a beneficial owner.

Trusts and SMSFs

For a trust, work out the trustee, the appointor or controller and the beneficiaries or class of beneficiaries as your program requires, and read the trust deed. Where the trustee is a company, that corporate trustee is itself an entity whose owners and controllers you need to determine. Our guide to tracing beneficial owners in property transactions covers common structures. Treat unexplained layers, offshore holding entities or a refusal to provide the deed as risk indicators, not mere paperwork delays.

AUSTRAC’s initial CDD guide for bodies corporate, partnerships and unincorporated associations lists the matters to establish for these customer types, and is the page to keep open while you work.

Step 4: Enhanced CDD where section 32 requires it

Standard CDD is not enough in every case. Section 32 of the Act requires enhanced CDD, appropriate to the customer’s ML/TF risk, where the customer’s ML/TF risk is high; where a suspicious matter reporting obligation has arisen and you propose to continue the service; where the customer, a beneficial owner, a person on whose behalf the customer is receiving the service or a person acting for the customer is a foreign PEP; where any of those people is physically present in, or formed in, a high risk jurisdiction for which the FATF has called for enhanced due diligence; where the service is part of a nested services relationship; and where the customer is of a kind the Rules specify. A foreign PEP also brings the extra PEP steps in Rules section 6-23 (the source of the PEP’s wealth and source of funds), as does a domestic or international organisation PEP where the customer’s ML/TF risk is high. AUSTRAC’s overview of CDD says you must conduct enhanced CDD when the customer’s ML/TF risk is high or in other specified circumstances, and its enhanced CDD guidance describes the additional measures, such as collecting and verifying source of funds and source of wealth, and escalating issues to senior management under your policies.

Common triggers on a property file

• A foreign PEP, or a family member or close associate of one.
• Payment in significant physical currency, or funds arriving from unrelated third parties.
• Complex ownership with no commercial reason, or a purchaser whose profile does not fit the price.
• A purchase that makes little sense for the customer, such as a rapid resale or an unexplained change of buyer.
• A sanctions or adverse media hit that cannot be cleared.

Source of funds and source of wealth

These are often confused. Source of funds is the origin of the money in this transaction, such as salary, sale proceeds, business income or an inheritance. Source of wealth is how the customer accumulated their net worth over time. AUSTRAC’s page on source of funds and source of wealth explains the difference. A bank statement may answer the first question, but only a fuller picture, such as business records or sale of earlier assets, answers the second.

Approval before you proceed

Enhanced CDD ends with a decision by someone senior enough under your program to make it. Rules section 5-5 requires your program to have a senior manager approve before you start providing the designated service where the customer, a beneficial owner or a person on whose behalf the customer is receiving the service is a foreign PEP, or is a domestic or international organisation PEP and the customer’s ML/TF risk is high. Write down who approved, when, and on what reasoning. If the answer is no, you also need a documented path for declining the service and assessing whether a suspicious matter report is warranted.

Step 5: The record

A check that is not recorded is, to a supervisor, a check that did not happen. Section 111 requires you to keep customer due diligence records, including the data you collected and any analysis or decision-making, so a defensible file shows three things:

1. What was checked: documents sighted, databases searched, screening results, dates and the person who did each step.
2. The risk rating: the rating given to the customer and the reasoning behind it, tied to your business-wide risk assessment.
3. The decision: proceed, proceed with enhanced CDD, delay under section 6-32, or decline, with the name of the person who made it.

CDD records are kept for 7 years from the end of the business relationship, or from the completion of an occasional transaction (section 111). Transaction records are kept for 7 years from the day the record is made (section 107). Keep them retrievable: if AUSTRAC asks for a file, you should be able to produce the whole story without reconstructing it from emails.

The per-file checklist at a glance

Our perspective: why file-level discipline beats a good manual

Most agencies we speak to have, or are getting, an AML/CTF program on paper. The harder test is whether the thousandth file looks like the first. A supervisor reviewing a sample will compare your risk assessment, your policies, your training and what your staff actually did on the file. Where those four disagree, the finding is about consistency, not about any single check.

That is why we build the program documents from one set of answers, so that the policies match the risk assessment and the training manual matches the policies. It is also why we put the file routine in front of the agent: a client intake portal that collects identity and entity details, with the check fee payable by the client if the agency chooses, and only a compliance status passed to REX, not the CDD detail itself. We believe an officer should approve each determination, such as a beneficial ownership result, before CDD proceeds. The platform handles lookups and record keeping. Judgement stays with your people, where the law puts it.

Where AML Guard fits

If you would rather not run this checklist from spreadsheets and inboxes, AML Guard is built for Australian Tranche 2 reporting entities. It covers identity verification with document capture and biometric liveness, sanctions, PEP and adverse media screening with ongoing re-screening, ACN-based beneficial ownership determination, enhanced CDD, risk scoring with recorded reasoning and an 8-year tamper-evident audit trail, and it integrates with REX CRM. Plans and per-check fees are on the pricing page, and you can book a demo to see a file run from intake to record.

FAQ

What is a CDD checklist for real estate?

It is a list of the customer due diligence steps you complete on each transaction: verifying identity, checking PEP and sanctions status, determining beneficial owners, applying enhanced CDD where required and recording the outcome. It sits beneath your AML/CTF program and makes the program’s rules operational on each file.

When must I complete CDD on the buyer if I act for the seller?

The Rules allow initial CDD on the buyer to be completed by the earlier of 28 days after exchange or 3 days before the initially agreed settlement day, subject to the conditions in section 6-32. Confirm those conditions in the live Rules and in your program before relying on the delay.

Does every customer need enhanced due diligence?

No. Controls scale to risk, and lower-risk customers can be managed with less. Enhanced CDD applies where section 32 requires it, for example where a customer is rated high risk or the customer, a beneficial owner or someone acting for the customer is a foreign PEP.

What counts as a beneficial owner of a company buying property?

An individual who directly or indirectly owns 25% or more of the company, or who controls it. If a shareholder is itself a company or trust, you follow the chain up until you reach individuals.

Sources

• Legislation: Anti-Money Laundering and Counter-Terrorism Financing Act 2006
• Legislation: Anti-Money Laundering and Counter-Terrorism Financing Rules 2025
• AUSTRAC: Delayed initial customer due diligence
• AUSTRAC: Updates to the real estate program starter kit
• AUSTRAC: Step 2, Use your real estate program
• AUSTRAC: Initial CDD for individuals
• AUSTRAC: Foreign PEP example
• AUSTRAC: Determining ownership and control structures
• AUSTRAC: Initial CDD for body corporate, partnership or unincorporated association
• AUSTRAC: Overview of customer due diligence
• AUSTRAC: Enhanced customer due diligence
• AUSTRAC: Source of funds and source of wealth

Recommended

• Real estate AML obligations: when CDD starts
• AML/CTF Compliance Checklist for Real Estate Agents: What You Need Before 1 July 2026
• Buyer due diligence for real estate agencies