Skip to content
Get the Buyers Agent Kit

Home › Buyers agents › What does 2026 privacy and AML compliance cost a buyers agent?

What does 2026 privacy and AML compliance cost a buyers agent?

There is no single price, and treating it as one number is the mistake this page is written to prevent. Your costs split into two halves: the AML/CTF program AUSTRAC requires, where AUSTRAC's starter kit is free and the paid packs we have priced run from about A$249 one-off to about A$990 a year, and the privacy documents the same 31 March 2026 trigger creates, from free templates to a kept-current subscription. Privaproof covers the privacy half only. In both halves the cost easiest to leave out of a budget is your own time.

By Jon Oates, Founder of Privaproof · Last updated

General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice and does not assess your AML/CTF obligations, which are administered by AUSTRAC.

Why "compliance cost" is really two bills, not one

When you broker the purchase of a property for a buyer-client, you provide an AML/CTF designated service (brokering the purchase of real estate on behalf of a buyer, Table 5 item 1, AML/CTF Act s 6(5A)), which makes you an AUSTRAC reporting entity from 31 March 2026. That single trigger creates two distinct sets of obligations, run by two different regulators:

The two halves are priced and bought separately. An AML pack does not give you the privacy documents, and a privacy kit does not do your AML program. If you budget for one and assume it covers the other, you are half-covered. Read: AML kit vs privacy kit, what your AML pack leaves out.

What the AML half costs (AUSTRAC's domain, not ours)

We do not sell AML/CTF products and we do not assess your AML obligations, so treat this as orientation only, not advice. The headline point is that the floor is free:

So the AML half can cost you nothing but time, or a few hundred dollars if you buy a pack. Either way it is a separate bill from the privacy documents below.

What the privacy half costs

This is the half Privaproof is built for, and here too there is a free floor and a paid ceiling.

The free building blocks. The OAIC publishes a free "Template privacy collection notice for reporting entities under the AML/CTF Act", and generic policy generators (the Lawpath, Sprintlaw, Termly and ComplianceKit tier) sell horizontal privacy policies from around A$79. You can assemble something at low cash cost. The catch is fit: none of these are written for a buyers agent, none scope the documents to the AML/CTF activities that s 6E(1A) brings under the Act, and none reconcile the AML/CTF Act's seven-year record-retention floor (Part 10, for example s 106(3), records kept "for a period of 7 years beginning on the day the record is made") against APP 11.2, which requires personal information to be destroyed or de-identified once it is no longer needed. You buy a document and inherit the job of making it fit.

The real cost is time and currency, not the download fee. A generic policy is cheap to buy and expensive to own: the tailoring is yours to do, you carry the risk that it misdescribes what you actually collect, and it does not update itself when the law moves (for example APP 1.7, the automated-decision disclosure a privacy policy must carry from 10 December 2026). A cheap one-off template that is wrong or stale is not cheaper than a fit-for-purpose one, it just moves the cost onto you.

What a buyers agent's privacy half should actually contain, whichever route you take: a privacy policy (APP 1), collection notices (APP 5, including the AML customer-due-diligence notice at engagement), a data-breach response plan for the NDB scheme, and a retention and destruction schedule. Read: the buyers agent privacy policy, what it must cover and the collection notice you need at engagement.

Where Privaproof fits on the price line

Privaproof covers the privacy half only. Not the AML program, not legal advice: a buyers-agent-specific privacy document set, plain-English and tailorable, and kept current as the law changes rather than sold once and left to go stale. That is the trade against a A$79 generic template: you are paying for sector fit and for someone else carrying the currency job, instead of a one-off download you have to reshape and re-check yourself.

The Buyers-Agent Kit is A$449 per year, including GST. That is one price for the whole document set, with the updates we make as the privacy rules change included for as long as your membership runs. No lock-in, and no separate charge per document. Read: the privacy kit no RE-agency tool covers.

The cost of getting it wrong (kept in proportion)

It is tempting to price compliance against the penalties, but the structure of the Act matters more than the headline numbers. Privacy Act penalties are ceilings, not going rates, expressed in penalty units, and a Commonwealth penalty unit is A$364 for conduct on or after 1 July 2026 (Crimes (Amount of a Penalty Unit) Instrument 2026, made under Crimes Act 1914 (Cth) s 4AA; it was A$330 before that, and it is indexed to the CPI every three years). The routes to a monetary consequence are separate and defined. A determination by the Commissioner under s 52(1) has no penalty limb at all: it can declare that conduct interfered with someone's privacy, order steps so it is not repeated, and award compensation to the complainant. The large serious-interference penalty in s 13G is a civil penalty provision, and the Commissioner must apply to the Federal Court or the Federal Circuit and Family Court for a penalty order (ss 13G(1A), 80U). Separately, for the defined list of breaches in s 13K, which includes failing to have a privacy policy (APP 1.3) and failing to include what APP 1.4 requires, the Commissioner is an infringement officer and can issue an infringement notice without going to court (s 80UB). AML/CTF penalties are separate again, are AUSTRAC's to administer, and carry their own much higher ceilings, which we deliberately do not quantify here because assessing AML exposure is not something Privaproof does. Do not budget off worst-case numbers from either regime.

The other cost line to plan for is a data breach. You hold few files but each is deep: identity documents, mortgage pre-approvals, bank statements, proof of deposit and, for higher-risk clients, source-of-funds evidence. Whether a breach is notifiable is not automatic, and the assessment is yours to make: where you suspect an eligible data breach, the entity must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days (Privacy Act s 26WH(2)). The test is whether a reasonable person would conclude the access or disclosure would be likely to result in serious harm (s 26WE(2)), and the kind and sensitivity of the information are express factors in it (s 26WG). Budgeting for the capability to run that assessment, not only for the documents, is the point. Read: your data-breach response plan.

So, what should you actually budget?

Think of it as three lines, not one:

The mistake to avoid is paying for the AML half and assuming the privacy half came with it. It did not, and the same 31 March 2026 trigger created both. Read the cornerstone: privacy compliance for Australian buyers agents.

Common questions

Is there a fee to enrol with AUSTRAC as a buyers agent?

AUSTRAC does not publish an enrolment fee. The AML cost is your time to enrol and to stand up a written AML/CTF program, plus the optional cost of a paid AML document pack if you would rather not build it yourself. AUSTRAC publishes a free program starter kit that it describes as covering small real estate and buyer's agencies. This is AUSTRAC's area, not Privaproof's, so confirm the current fees and process with AUSTRAC.

Can I just buy a A$79 privacy policy and be done?

You can buy one, but a horizontal generic policy is not written for a buyers agent, does not scope itself to the AML/CTF activities that s 6E(1A) brings under the Act, and does not keep pace as the law changes. The purchase price is low; the ownership cost (tailoring it, checking it is accurate, and updating it) sits with you. A cheap template that is wrong or stale is not actually cheaper.

Does the AML pack I already bought cover my privacy obligations?

Generally no. The AML packs we have reviewed are AML-facing (program, customer due diligence, reporting) and contain little or no Privacy Act content: no privacy policy, no APP 5 collection notice, no NDB breach plan and no AML-versus-APP retention reconciliation. Those are the privacy half, created by the same 31 March 2026 trigger, and they are bought separately.

How much will the Privaproof Buyers-Agent Kit cost?

A$449 per year, including GST. That covers the whole buyers-agent document set and the updates we make to it as the privacy rules change, for as long as your membership runs. Privaproof covers the privacy half only, so it sits alongside your AML program rather than replacing it. No lock-in.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. This page does not assess your obligations under the AML/CTF Act itself, which are administered by AUSTRAC, and the third-party prices mentioned are indicative market figures that change over time. The Privacy Act 1988 (Cth) and related guidance also change over time, so check you are working from a current version. For advice on your specific circumstances, consult a qualified Australian legal practitioner.