Do real estate agents need to comply with AML in Australia?

By Brad Dack, Four Foxes · AML/CTF Consultant

Yes, in most cases. On 1 July 2026, Australian real estate agents were brought under the Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) Act as part of the "Tranche 2" reforms. If your agency helps clients buy, sell, or transfer real estate, this generally means you're providing what the law calls a designated service - which brings specific, ongoing obligations to the regulator, AUSTRAC. It's worth confirming this against your own activities, since scope can vary agency to agency.

If that's the first you've heard of it, you're not behind the pack - most small, boutique and medium-sized agencies are working through exactly the same thing right now. Unlike the big franchise groups, you probably don't have a dedicated compliance team to hand this to - which is exactly who this guide is written for. It explains, in plain terms, who's captured, what you actually have to do, when, and what happens if you don't.

What if you haven't started yet?

Both of the dates that mattered have now passed. The obligations for real estate professionals commenced on 1 July 2026, and for entities providing a designated service from that commencement date the AUSTRAC enrolment deadline was 29 July 2026. If you're reading this without a program or a verification process in place, the practical answer is to work through the catch-up in order rather than trying to do everything at once.

1. Enrol with AUSTRAC. Enrolment is the entry point for the rest of it, so it goes first.
2. Get your AML/CTF program documented. Your Part A risk framework and Part B customer due diligence procedures, right-sized to how your agency actually operates. A short program you follow is worth more than a long one you don't.
3. Start running CDD on new customers. Apply the process from your next engagement onwards, so the gap stops widening while you finish the rest.

Being late is far better than being absent, and it's very achievable to catch up. The order matters more than the speed: enrol, write down how you manage the risk, then apply it consistently to every new transaction.

Which real estate agents are covered?

The reforms extend AML/CTF obligations beyond banks and casinos to "Tranche 2" professions - including real estate. In broad terms, this designated service generally applies where an agency brokers the sale, purchase, or transfer of real estate on behalf of a client.

That typically includes:

• Residential and commercial sales agents
• Buyers' agents acting for a purchaser
• Agencies handling the transfer of property on a client's behalf

There's a related but separate designated service for property developers and vendors selling real estate without an independent agent. If that's you, it's worth checking your own position rather than assuming "agent" doesn't apply to you - based on general AUSTRAC guidance, the same core obligations can still apply.

Property management and leasing generally sit outside this designated service. If your agency is purely a rent roll - ordinary residential or commercial leasing - AUSTRAC's guidance generally points to no obligation under these real estate provisions. AUSTRAC excludes leases of 30 years or less from what counts as "real estate" for this purpose, and the designated service itself covers brokering a sale, purchase or transfer, not leasing or managing a property on an owner's behalf.

The one exception worth checking: longer leasehold interests (over 30 years - sometimes relevant with company title or certain land-use arrangements) can still count as "real estate" and bring you into scope. This is rare for most boutique agencies, but if your business has any sales, developer, or long-leasehold activity alongside leasing, it's worth confirming your specific position against current AUSTRAC guidance rather than relying on the leasing exclusion alone.

What are the actual obligations?

Being a "reporting entity" under the Act isn't a single box to tick - it's a small set of ongoing responsibilities. At a high level you need to:

1. Enrol with AUSTRAC as a reporting entity.
2. Have a documented AML/CTF program - the written policies, procedures and controls describing how your agency manages money-laundering risk (this is your Part A and Part B).
3. Carry out Customer Due Diligence (CDD) - verify who your customer actually is before you provide the designated service, and understand the nature of the transaction.
4. Conduct ongoing CDD - keep customer information current and watch for anything unusual.
5. Report to AUSTRAC - submit suspicious matter reports (SMRs) where required, plus any threshold transaction reports and periodic compliance reporting.
6. Keep records - retain your CDD evidence and program documentation for the required period.

The theme across all of it: know who you're dealing with, write down how you manage the risk, and keep the evidence. For a small, boutique or medium-sized agency that's the practical shape of compliance - not a mountain of paperwork, but a repeatable process applied to every transaction.

When did it start?

The obligations for real estate professionals commenced on 1 July 2026. Enrolment and having your program and CDD processes in place are tied to that commencement - so the practical work (writing the program, setting up how you verify clients) needs to be done before you provide designated services, not after.

Within a transaction, the timing isn't the same for every party. Based on general guidance in AUSTRAC's real estate starter kit, there are two different trigger points:

• For your own client - the person who engaged you - initial due diligence is generally expected before you sign the agency or brokering agreement with them.
• For the other party in the deal - the buyer or seller you didn't engage but who's still your customer under the Act - guidance generally points to a later trigger: before exchange of contracts. There's also a recognised delay mechanism that can push this further in practice, since the time between an offer being accepted and contracts being exchanged is often too short to complete full checks. So it's normal, and expected, for CDD on the other party to land later in the process than CDD on your own client.

The common mistake is treating both parties the same way and assuming everything has to be done at the point of engagement. It's worth mapping your own transaction steps - and which trigger point applies to which party - against AUSTRAC's guidance rather than assuming a one-size-fits-all timing.

What happens if you don't comply?

AUSTRAC is the regulator, and the AML/CTF Act carries significant civil penalties for non-compliance. On application from AUSTRAC, the Federal Court can order a civil penalty of up to 100,000 penalty units for a body corporate and up to 20,000 penalty units for an individual - figures designed to get the attention of large institutions, and they apply to reporting entities of all sizes. At the current penalty unit value of $364 (accurate as of 10 July 2026), that's up to approximately $36.4 million for a body corporate and $7.28 million for an individual. Penalty unit values are indexed and change every three years, so the dollar equivalent moves over time; check AUSTRAC's current published rate rather than relying on a fixed figure. Beyond civil penalties, non-compliance can mean enforceable undertakings, remedial directions, infringement notices, and reputational damage that's hard to undo in a referral-driven industry.

The more useful way to think about it: the cost of a right-sized program is small; the cost of ignoring the obligation entirely is not. You don't need enterprise software to be compliant - you need a documented process you actually follow.

What do you actually need to have in place?

A practical path for a small, boutique or medium-sized agency looks like this:

• Confirm your scope - which of your activities are designated services.
• Enrol with AUSTRAC - for entities providing a designated service from commencement, the enrolment deadline was 29 July 2026 (28 days after the 1 July start date).
• Document your AML/CTF program (Part A risk framework + Part B customer due diligence) - right-sized to how your agency actually operates.
• Set up a repeatable way to verify clients - a KYC/KYB process that fits into your existing onboarding rather than bolting on a heavy platform.
• Train your team so the process is followed consistently.
• Keep the evidence - an audit trail for every check.

None of these steps require a large compliance department - which matters, because most boutique and independent agencies don't have one. The agencies that struggle are the ones that try to buy an enterprise system built for banks; the ones that cope well put a simple, documented process in place and apply it every time.

Does this have to be expensive or complicated?

No - and this is the part worth hearing if catching up has you worried. Most AML platforms are built for large groups on long contracts. A small, boutique or medium-sized agency doesn't need that. You need:

• A program that matches your size and risk, and
• A simple, per-use way to verify a client's identity with a proper audit trail.

That's exactly the gap Verify by Four Foxes was built for: pay-per-check KYC/KYB verification with no subscription and no lock-in, sitting alongside a right-sized program rather than replacing your whole workflow.

Frequently asked questions