What the 1 July 2026 AML/CTF (Tranche 2) changes mean for real estate agents
Since 1 July 2026, real-estate agencies that provide designated services, mainly buying and selling property, are reporting entities under the AML/CTF Act as the "Tranche 2" reforms take effect. That brings new anti-money-laundering duties (customer checks, record-keeping, reporting), and, via the Privacy Act's s 6E(1A), brings the personal information collected for those checks under the Privacy Act, even for agencies under the $3m threshold.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What does AML/CTF Tranche 2 ask of an agency?
If your agency provides the designated services, expect obligations such as:
| Obligation | In plain terms |
|---|---|
| Customer due diligence (KYC) | Verify the identity of the parties you deal with |
| Record-keeping | Keep those records (commonly ~7 years) |
| Reporting | Report suspicious matters and certain transactions to AUSTRAC |
| Enrolment | Enrol with AUSTRAC by 29 July 2026 if you were already providing designated services on 1 July 2026 (AUSTRAC). Start later, and your own clock runs from that date |
| AML/CTF compliance officer | Appoint one within 28 days of first providing a designated service, and notify AUSTRAC by the later of 29 July 2026 or 14 days after enrolling (AUSTRAC) |
The exclusion most property managers never hear: ordinary leasing is not caught. AUSTRAC's designated services for real estate cover brokering the sale, purchase or transfer of real estate, and selling or transferring it without an independent agent (developers, house-and-land, off-the-plan). The definition of "real estate" turns on ownership or ownership-like interests and expressly excludes leases of 30 years or less. A standard residential tenancy is nowhere near that, so a rent roll and the leasing side of an agency are not designated services. It runs the other way for the long tail: a leasehold of more than 30 years is real estate, which picks up 99-year ACT leases, crown and pastoral leases, and residential site agreements beyond 30 years (AUSTRAC: real estate designated services). So a sales-and-property-management agency is usually a reporting entity for its sales side only, and a property-management-only business may not be one at all.
Whether a particular agency is a reporting entity depends on the specific designated services it provides.
How far does the privacy link actually reach?
Under s 6E(1A) of the Privacy Act, a small reporting entity is treated as covered by the Privacy Act only for the personal information it handles for its AML/CTF obligations, even if it turns over less than $3m. That is wider than the licence copy: customer due diligence under s 28(2) also reaches beneficial owners, politically-exposed-person and sanctions screening, and s 111(3) requires you to keep the risk assessment you recorded about a named customer. It does not bring the rest of your agency (rent rolls, general marketing) under the Act.
In practice, because you'll be collecting and holding more sensitive ID data for longer, privacy risk rises regardless, so many advisers suggest adopting Privacy-Act-standard practices across the board.
What doesn't Tranche 2 change?
This is separate from the proposed reform that would remove the small-business exemption entirely; that is not law as at 2026, and has no commencement date.
Common questions
Which real estate agencies are caught by AML/CTF Tranche 2?
Real-estate agencies that provide designated services, mainly buying and selling property, are reporting entities under the AML/CTF Act as the Tranche 2 reforms take effect. Whether a particular agency is a reporting entity depends on the specific designated services it provides.
Does becoming a reporting entity bring my whole agency under the Privacy Act?
No. Under section 6E(1A) of the Privacy Act, a small reporting entity is treated as covered by the Privacy Act only for the personal information it handles for its AML/CTF obligations, which covers more than the identity documents: beneficial-ownership and screening records and your documented customer risk assessment sit inside it too, even if it turns over less than $3 million. It does not bring the rest of your agency, such as rent rolls or general marketing, under the Act.
What AML obligations does Tranche 2 create for an agency?
The main duties are customer due diligence (verifying the identity of the parties you deal with), record-keeping (commonly around seven years), reporting suspicious matters and certain transactions to AUSTRAC, and enrolling with AUSTRAC.
Does Tranche 2 remove the small-business exemption from the Privacy Act?
No. That is separate from the proposed reform that would remove the small-business exemption entirely; that reform is not law as at 2026 and has no commencement date.
Check where your agency stands: free 2-minute self-audit →
General information, not legal advice, and does not assess your AML/CTF obligations, which are administered by AUSTRAC. Sources: OAIC; AUSTRAC; Privacy Act 1988 (Cth).