What does AML and privacy compliance cost a conveyancer?
There is no single sticker price, because the range is wide: free government templates and DIY at one end, software subscriptions and consultants in the middle, a bespoke lawyer at the other. Our own Conveyancer Kit sits in the middle: thirteen documents, A$449 a year incl GST, no lock-in. The bigger point: compliance is ongoing, not a one-off purchase, so the real cost is keeping it current.
By Jon Oates, Founder of Privaproof · Last updated
‹ Conveyancer privacy compliance hub
General information, not legal advice. Your obligations depend on your circumstances.
Why is there no single number?
Two firms can spend very differently and both be compliant, because cost is driven by choices, not by a fixed price tag. The main variables are:
- How you resource it: do-it-yourself from templates, buy software, engage a consultant, or pay a lawyer to draft bespoke.
- AML and privacy are two workstreams. The AML side is enrolment, a compliance program and customer due diligence. The privacy side is an APP 1 privacy policy, APP 5 collection notices and a data breach response plan. Ask any quote you are given which of those three it delivers, because whatever it leaves out is still yours to produce.
- Your size and volume. A sole practitioner and a multi-office firm have different transaction volumes, and where AML tooling is priced per verification or per transaction the bill follows your settlement numbers.
- One-off vs ongoing. A document you buy once is cheaper on day one than a subscription, but it goes out of date the moment the law moves.
The spectrum of options
| Approach | Roughly what it involves | Trade-off |
|---|---|---|
| DIY from free/gov templates | OAIC publishes a template privacy collection notice for AML/CTF reporting entities; you adapt the rest yourself | Cheapest up front; generic, not conveyancer-specific, and yours to keep current |
| Off-the-shelf template pack | A paid, sector-worded set of documents; ours is the Conveyancer Kit, thirteen documents at A$449/year incl GST | Faster and tailored; check whether it's kept updated and who stands behind it |
| Compliance software / subscription | Ongoing tooling, often for the AML checks (CDD, screening) | Handles volume; usually priced per check/transaction; ask which APP documents, if any, are included |
| Consultant | Someone to set up your AML program (and sometimes audit it) | Hands-on; higher cost; scope varies |
| Bespoke lawyer | Documents drafted for your firm | Highest assurance and highest cost; slower; not self-serve |
The two also combine: software for the AML customer checks, plus a separate step for the privacy documents.
Which cost is easiest to underestimate?
The cost that gets missed is the second year, because compliance is not a one-time purchase. The rules move on dated schedules: the automated-decision-making disclosure rule commences on 10 December 2026 (APP 1.7, inserted by the Privacy and Other Legislation Amendment Act 2024 Sch 1 Pt 15), AUSTRAC guidance evolves, and privacy reform continues. A privacy policy that was correct in July can be out of date by December.
So the honest way to think about cost isn't "what does the document cost"; it's "what does it cost to stay compliant." Being current is the obligation, not a nicety: APP 1.3 requires a "clearly expressed and up-to-date" privacy policy, and breaching APP 1.3 is one of the contraventions s 13K makes a civil penalty provision, capped at 200 penalty units, five times that for a body corporate, on a court order the Commissioner applies for. Where the Privacy Act reaches your practice, and for most conveyancers s 6E(1A) reaches the activities you carry on for your AML/CTF obligations, a stale policy is the breach itself.
How should you scope your compliance spend?
- Separate the two workstreams: budget for the AML side and the privacy side, and don't assume an AML product covers privacy.
- Prefer solutions that are kept current, not just cheap today.
- Match the tool to your volume: per-transaction pricing rewards low-volume firms and adds up for busy ones.
- Get professional advice where the stakes are highest. Retention is the usual one: your AML record-keeping period and your state's conveyancing rules run on different clocks, and both apply to the same file.
For what the privacy documents actually are, see Do conveyancers need a privacy policy in 2026? and Privacy policy vs collection notice. For the AML side, see AML Tranche 2 for conveyancers.
Common questions
Is there a free option?
Partly. The OAIC publishes a template privacy collection notice for AML/CTF reporting entities, and you can adapt documents yourself; the "cost" is your time, the risk of a generic fit, and keeping everything current as the law changes.
Why is some AML software priced per transaction?
Per-check and per-verification pricing tracks the thing that scales with your workload. Where a tool is priced that way it rewards low-volume firms and adds up for high-volume ones, so it is worth modelling against your settlement numbers.
Does buying AML software make me privacy compliant too?
Not by itself. AML software performs the customer due diligence; the APP 1 privacy policy, APP 5 collection notices and breach response plan are separate documents, and s 6E(1A) applies the Privacy Act in relation to the activities you carry on for your AML/CTF obligations. Open your product's document list and count how many of those three are in it.
Is a one-off template cheaper than a subscription?
On day one, yes. Over time a one-off document that isn't updated goes stale as the law moves, and APP 1.3 requires the policy to be up to date, so the meaningful comparison is the cost of staying compliant. The Conveyancer Kit is A$449 a year incl GST with no lock-in, and the updates we make while your membership is active are included.
Is it any different for WA settlement agents?
Not on the Commonwealth side. A WA settlement agent providing the property-transfer designated service is a reporting entity and comes under the Privacy Act the same way, so the same spectrum of options and the same "keep it current" point apply. What differs is the state layer underneath, including record-keeping: WA runs 6 years from the date the money was received (Settlement Agents Regulations 1982 r 6F(1)(b)), NSW 7 years from when the record was made. See our guide for WA settlement agents.
Written and kept current by the Privaproof team. This is general information, not legal advice, and not financial or procurement advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice, and it does not assess your AML/CTF obligations, which are administered by AUSTRAC. Sources: Privacy Act 1988 (Cth), ss 6E(1A), 13K and APP 1.3 (Compilation No. 104); OAIC, privacy guidance for reporting entities under the AML/CTF Act; OAIC, template privacy collection notice for AML/CTF reporting entities; AUSTRAC, professional designated services.