Skip to content
Join the founding list

Home › Buyers agents › AML kit vs privacy kit: what your buyers-agent AML pack leaves out

AML kit vs privacy kit: what your buyers-agent AML pack leaves out

An AML kit gives you the AUSTRAC-facing side: the money-laundering program, the due-diligence checks, the reporting and enrolment paperwork. It leaves out the Privacy Act side the same 1 July 2026 change switches on. Becoming a reporting entity means Privacy Act s 6E(1A) pulls the client-identity data you collect for those checks under the Privacy Act, which needs a privacy policy, collection notice, breach plan and retention schedule your AML pack does not contain.

By Jon Oates, Founder of Privaproof · Last updated

General information , document templates and tools you tailor, not legal advice. Privaproof is not a law practice and does not assess your AML/CTF obligations, which are administered by AUSTRAC.

One trigger, two sets of documents

If you broker the purchase of real estate on behalf of a buyer, that is a designated service, so from 1 July 2026 you are an AUSTRAC reporting entity (Table 5 item 1, AML/CTF Act s 6(5A)). That single event creates two separate jobs. If your engagement stops short of brokering, for example a search-and-shortlist service where the client negotiates their own purchase, the answer is fact-specific and worth checking against what you actually do.

The same collection of a driver licence, a bank statement or a proof-of-deposit satisfies an AML rule and creates a privacy obligation at the same moment. An AML kit answers the first. It is not written to answer the second.

What an AML kit gives you

A buyers-agent AML pack is genuinely useful, and you do need one. Typically it covers:

AUSTRAC also publishes free real-estate AML guidance and program materials, so the AML half is well served and, in part, free.

Where the AML kit stops

None of the above is a Privacy Act document. An AML kit tells you to collect and verify identity data. It does not tell the client, in the words APP 5 expects, why you are collecting it and what you will do with it. It does not set out, as APP 1 expects, how your practice handles that information as a whole. It does not give you a plan for the day the data is exposed, and it does not reconcile the AML retention floor against the Privacy Act's duty to destroy information you no longer need.

That gap is the privacy half, and it is four documents:

1. A privacy policy (APP 1), written for a buyers agent rather than a selling agency or a generic download, covering the identity, financial-capacity and source-of-funds data you actually hold. Read: the buyers agent privacy policy 2. A collection notice (APP 5), given at engagement, that explains the AML customer-due-diligence collection and covers information you collect about people from third parties. Read: the collection notice you need at engagement 3. A data-breach response plan for the Notifiable Data Breaches scheme, tuned to the concentrated financial data a buyers agent holds. Read: your data-breach response plan 4. A retention and destruction schedule that holds AML records for the mandated period and then disposes of the personal information, reconciling the AML seven-year rule with APP 11.2. Read: how long must a buyers agent keep client records?

Why the gap matters more for a buyers agent

A buyers agent holds few files, but each one is deep: mortgage pre-approvals, bank and savings statements, borrowing capacity, proof of deposit, and, for higher-risk clients under your due diligence, source-of-funds evidence you actively assess. That concentration means a breach is very likely to cause serious harm, which is exactly what makes it notifiable. The AML kit gathers this data. The privacy documents are what govern holding it, and a breach of high-sensitivity buyer data is precisely the event an AML pack has nothing to say about.

Why not just buy a generic privacy template to fill the gap?

Because a generic policy is not written for a buyers agent and does not keep pace as the law changes. Two dates in particular move the target: enrolment falls due around 29 July 2026, and a new automated-decision-making transparency rule commences 10 December 2026 (APP 1.7), which reaches you if you use automated identity, PEP or sanctions screening in a way that significantly affects someone. A one-off download bought this month does not update itself when those land. A kept-current, buyers-agent-specific set does.

A note on scope, because it is easy to overstate. Section 6E(1A) catches the AML customer-due-diligence data, not your whole practice. Your general buyer CRM, your newsletter list and your property alerts stay under the small-business exemption unless a separate trigger applies. The privacy half you need is scoped to the identity data, not a claim that your entire business is now regulated.

So, which do you need?

Both, and they do different work. Keep your AML pack, or use AUSTRAC's free starter kit, for the money-laundering obligations AUSTRAC administers. Add the four privacy documents for the personal information those checks generate. Privaproof builds only that privacy half, buyers-agent-specific and kept current as the law changes. We do not assess or sell the AML side. Read the cornerstone: privacy compliance for Australian buyers agents

Common questions

Does my AML pack already cover the Privacy Act?

Generally no. An AML pack is built for AUSTRAC: the program, customer due diligence, reporting and record-keeping. It is not a privacy policy, collection notice, breach plan or retention schedule, which are what s 6E(1A) expects for the identity data the AML checks collect. The two sets of documents answer different obligations from the same trigger.

If AUSTRAC gives an AML starter kit for free, is the privacy side free too?

No. AUSTRAC's free real-estate starter kit covers the AML half, including for small buyer's agencies. It does not include Privacy Act documents, because privacy is administered by a different regulator (the OAIC), not AUSTRAC. The free kit is a reason to put your paid effort into the privacy half, not a substitute for it.

Can I just download a generic privacy policy to cover it?

You can, but a generic template is not scoped to a buyers agent's identity and source-of-funds data, and it does not update when the law moves, such as the automated-decision-making rule commencing 10 December 2026. A buyers-agent-specific, kept-current set is built for the data you actually hold and stays current as the changes land.

Does the privacy half put my whole CRM under the Privacy Act?

No. Section 6E(1A) reaches the AML customer-due-diligence identity data, not your general buyer database, newsletter list or property alerts, which stay under the small-business exemption unless a separate trigger applies. The privacy documents you need are scoped to that identity data.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. This page does not assess your obligations under the AML/CTF Act itself, which are administered by AUSTRAC. Privaproof's buyers-agent documents are self-authored and are not independently reviewed by a solicitor. The Privacy Act 1988 (Cth) and related guidance change over time, so check you are working from a current version. For advice on your specific circumstances, consult a qualified Australian legal practitioner.