What the 2026 AML/CTF (Tranche 2) changes mean for real estate agents
Since 31 March 2026, real-estate agencies that provide designated services, mainly buying and selling property, are reporting entities under the AML/CTF Act as the "Tranche 2" reforms take effect. The AML/CTF duties themselves (customer checks, record-keeping, reporting) started on 1 July 2026, and s 6E(1A) of the Privacy Act applies that Act to the agency's AML-related activities, even for agencies under the $3m threshold.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What does AML/CTF Tranche 2 ask of an agency?
If your agency provides the designated services, expect obligations such as:
| Obligation | In plain terms |
|---|---|
| Customer due diligence (KYC) | Verify the identity of the parties you deal with |
| Record-keeping | Keep customer due-diligence records for 7 years after the business relationship ends (s 111(2)) |
| Reporting | Report suspicious matters and certain transactions to AUSTRAC |
| Enrolment | Enrol with AUSTRAC by 29 July 2026 if you were providing designated services at any time before 1 July 2026: that date is fixed by the amending Act (Sch 3 Pt 4 item 12), not counted from your start date. Start after that and s 51B(1) gives you 28 days from your first designated service (AUSTRAC) |
| AML/CTF compliance officer | Appoint one within 28 days of first providing a designated service, and notify AUSTRAC by the later of 29 July 2026 or 14 days after enrolling (AUSTRAC) |
The exclusion most property managers never hear: ordinary leasing is not caught. AUSTRAC's designated services for real estate cover brokering the sale, purchase or transfer of real estate, and selling or transferring it without an independent agent (developers, house-and-land, off-the-plan). The definition of "real estate" turns on ownership or ownership-like interests and expressly excludes leases of 30 years or less. A standard residential tenancy is nowhere near that, so a rent roll and the leasing side of an agency are not designated services. It runs the other way for the long tail: a leasehold of more than 30 years is real estate, which picks up 99-year ACT leases, crown and pastoral leases, and residential site agreements beyond 30 years (AUSTRAC: real estate designated services). So a sales-and-property-management agency is usually a reporting entity for its sales side only, and a property-management-only business may not be one at all.
Whether a particular agency is a reporting entity depends on the specific designated services it provides.
How far does the privacy link actually reach?
Under s 6E(1A) of the Privacy Act, a small reporting entity is treated as an organisation "in relation to the activities carried on ... for the purposes of, or in connection with, activities relating to" the AML/CTF Act, even if it turns over less than $3m. That is wider than the licence copy: it takes in customer due diligence under s 28(2), which reaches beneficial owners, politically-exposed-person and sanctions screening, and the s 111(3) record of the risk assessment you made about a named customer. It does not bring the rest of your agency (rent rolls, general marketing) under the Act.
Table 5 item 1 names both the seller and the buyer as customers of the brokering service, so ID checks run only on the vendor cover half the transaction. Does your AML pack collect on both sides, and does it say how long those records are kept?
What doesn't Tranche 2 change?
This is separate from the proposed reform that would remove the small-business exemption entirely; that is not law as at 2026, and has no commencement date.
Common questions
Which real estate agencies are caught by AML/CTF Tranche 2?
Real-estate agencies that provide designated services, mainly buying and selling property, have been reporting entities under the AML/CTF Act since 31 March 2026, when Tables 5 and 6 commenced; the AML/CTF obligations themselves started on 1 July 2026. Whether a particular agency is a reporting entity depends on the specific designated services it provides.
Does becoming a reporting entity bring my whole agency under the Privacy Act?
No. Under section 6E(1A) of the Privacy Act, a small reporting entity is treated as an organisation in relation to the activities it carries on for the purposes of, or in connection with, activities relating to the AML/CTF Act, even if it turns over less than $3 million. That reaches more than the identity documents: beneficial-ownership and screening records under s 28(2), and your documented customer risk assessment under s 111(3), sit inside it too. It does not bring the rest of your agency, such as rent rolls or general marketing, under the Act.
What AML obligations does Tranche 2 create for an agency?
The main duties, which started on 1 July 2026, are customer due diligence (verifying the identity of the parties you deal with), record-keeping (customer due-diligence records for seven years after the business relationship ends, s 111(2)), reporting suspicious matters and certain transactions to AUSTRAC, and enrolling with AUSTRAC.
Does Tranche 2 remove the small-business exemption from the Privacy Act?
No. That is separate from the proposed reform that would remove the small-business exemption entirely; that reform is not law as at 2026 and has no commencement date.
Check where your agency stands: free 2-minute self-audit →
General information, not legal advice, and does not assess your AML/CTF obligations, which are administered by AUSTRAC. Sources: OAIC; AUSTRAC; Privacy Act 1988 (Cth).