AML/CTF for real estate agents: your 2026 action checklist (and the privacy trap)

Q: Which dates matter for AML/CTF?

1 July 2026 : the "Tranche 2" reforms commenced. Agencies providing designated property-sale services became reporting entities under the AML/CTF Act 2006. ~29 July 2026 : the practical enrolment cliff. Reporting entities generally must enrol with AUSTRAC within 28 days of first providing a designated service, so agencies that started on 1 July are due by around 29 July. You also need an AML/CTF program in place as you begin providing designated services; it's not something to bolt on later. If those dates apply to your agency, the checklist below is the "what do I actually do" version.

Q: What's on the AML/CTF action checklist?

1. Work out if you're caught : do you provide designated property-sale services? For most sales agencies, yes. 2. Enrol with AUSTRAC : within the enrolment window. 3. Have an AML/CTF program : your written policies and procedures for managing money-laundering and terrorism-financing risk. 4. Do customer due diligence (CDD / KYC) : verify the identity of the people you deal with, before or as you provide the service. 5. Report : submit suspicious matter reports (and other required reports) to AUSTRAC. 6. Keep records for seven years : including the identity information you collect. That's the part most agencies are focused on, and rightly so. But steps 4 and 6 quietly create a second obligation.

Since 1 July 2026, real-estate agencies providing property-sale services are reporting entities under the AML/CTF Act, and most face a hard AUSTRAC enrolment deadline around 29 July 2026. The known checklist: enrol, verify identity, report, keep records. The quieter trap: the moment you collect identity documents for AML, the Privacy Act reaches that data, even if you're under the $3 million turnover threshold.

By Jon Oates, Founder of Privaproof · Last updated 11 July 2026 · Start the free 2-min audit →

General information, not legal advice. Your obligations depend on your circumstances.

Not sure it's you?

Does this apply to you?

Tap what's true for your agency. Nothing is saved.

We collect ID from buyers or sellers Our agency turns over under $3m We keep client records digitally We use a rent-roll or PM CRM

Tap what's true above to see where you stand.

Check the Kit against your setupA$539 / year incl GST · founding price

Orientation only, not a compliance assessment. General information and tools, not legal advice.

Which dates matter for AML/CTF?

1 July 2026: the "Tranche 2" reforms commenced. Agencies providing designated property-sale services became reporting entities under the AML/CTF Act 2006.
~29 July 2026: the practical enrolment cliff. Reporting entities generally must enrol with AUSTRAC within 28 days of first providing a designated service, so agencies that started on 1 July are due by around 29 July.
You also need an AML/CTF program in place as you begin providing designated services; it's not something to bolt on later.

If those dates apply to your agency, the checklist below is the "what do I actually do" version.

What's on the AML/CTF action checklist?

1. Work out if you're caught: do you provide designated property-sale services? For most sales agencies, yes. 2. Enrol with AUSTRAC: within the enrolment window. 3. Have an AML/CTF program: your written policies and procedures for managing money-laundering and terrorism-financing risk. 4. Do customer due diligence (CDD / KYC): verify the identity of the people you deal with, before or as you provide the service. 5. Report: submit suspicious matter reports (and other required reports) to AUSTRAC. 6. Keep records for seven years: including the identity information you collect.

That's the part most agencies are focused on, and rightly so. But steps 4 and 6 quietly create a second obligation.

What's the AML privacy trap?

Every KYC check you run produces a pile of sensitive customer identity: driver licences, passports, proof of address. And here's the catch:

The moment you collect that ID for AML/CTF purposes, the Privacy Act reaches it. Becoming a reporting entity means the small-business exemption many agencies relied on no longer covers this information, even for agencies turning over under $3 million a year.
That brings the Australian Privacy Principles into play for how you collect, store, use, disclose and dispose of that data.

So the AML deadline is as much a privacy problem as an AUSTRAC one. The three questions that matter:

Do your clients know what you're collecting, and why? (A collection notice under APP 5.)
Where does that ID actually live (inbox, desktop, a shared drive), and is it secure? (APP 11.)
When the file's closed, what's your plan to dispose of it safely? (Retention and destruction.)

None of this is hard. But "we'll sort the privacy side later" is exactly how a small breach becomes a big problem, and it's the half of Tranche 2 that doesn't come with an AUSTRAC reminder.

What are the three privacy documents you need?

For most agencies the privacy step comes down to a few practical documents, kept current:

A privacy policy (APP 1) that reflects the AML identity data you now hold.
Collection notices (APP 5) at the points you collect ID, so people know what you're taking and why.
A data-breach response plan and a retention/destruction schedule, so the ID doesn't sit around forever or leak.

These are templates you tailor to your agency: general information and tools, not legal advice.

Common questions

When do real estate agents have to enrol with AUSTRAC?

Reporting entities generally must enrol with AUSTRAC within 28 days of first providing a designated service, so agencies that started on 1 July 2026 are due by around 29 July 2026. Confirm your exact date with AUSTRAC.

What's on the AML/CTF action checklist for a real estate agency?

Work out whether you're caught, enrol with AUSTRAC within the window, have an AML/CTF program, do customer due diligence (verify the identity of the people you deal with), report suspicious matters to AUSTRAC, and keep records for seven years.

What's the "privacy trap" in AML Tranche 2?

The moment you collect ID for AML/CTF purposes, the Privacy Act reaches it. Becoming a reporting entity means the small-business exemption many agencies relied on no longer covers this information, even for agencies turning over under $3 million a year.

What privacy documents does an agency need for its AML data?

A privacy policy (APP 1) that reflects the AML identity data you now hold, collection notices (APP 5) at the points you collect ID, and a data-breach response plan plus a retention and destruction schedule so the ID doesn't sit around forever or leak.

Find your privacy gaps in about two minutes

Privaproof is an Australian privacy-compliance product for real-estate agencies. The free self-audit maps your agency against the Australian Privacy Principles (including the AML identity data now in scope) and shows the gaps to fix first. The Kit then gives you the collection notices, privacy policy and breach plan to close them, all fourteen reviewed by Matthew Hodgkinson, an Australian practising solicitor (Papillon Lawyers), and kept current as the rules change.

Start the free 2-minute self-audit →

This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice, and it does not assess your AML/CTF obligations, which are administered by AUSTRAC. Sources: AUSTRAC: real estate professionals; OAIC: Australian Privacy Principles; AML/CTF Act 2006 (Cth); Privacy Act 1988 (Cth).