What does 2026 privacy and AML compliance cost a buyers agent?

Q: So, what should you actually budget?

Think of it as three lines, not one: 1. AML program: free (AUSTRAC starter kit plus your time) to a few hundred dollars for a paid pack. AUSTRAC's domain, not ours. 2. Privacy documents: free-to-A$79 for generic templates you tailor and maintain yourself, or a buyers-agent-specific, kept-current set where the fit and currency are done for you. 3. Your time: the real cost in both halves, and the one a fit-for-purpose, maintained kit is designed to shrink. The mistake to avoid is paying for the AML half and assuming the privacy half came with it. It did not, and the same 1 July 2026 trigger created both. Read the cornerstone: privacy compliance for Australian buyers agents .

There is no single price, and treating it as one number is where most agents go wrong. Your costs split into two halves: the AML/CTF program AUSTRAC requires, where the starter kit is free and paid packs run roughly A$250 to A$500, and the privacy documents the same 1 July 2026 trigger creates, from free templates to a kept-current subscription. Privaproof covers the privacy half only. The largest cost is usually your own time.

By Jon Oates, Founder of Privaproof · Last updated 22 July 2026

General information , document templates and tools you tailor, not legal advice. Privaproof is not a law practice and does not assess your AML/CTF obligations, which are administered by AUSTRAC.

Why "compliance cost" is really two bills, not one

When you broker the purchase of a property for a buyer-client, you provide an AML/CTF designated service (brokering the purchase of real estate on behalf of a buyer, Table 5 item 1, AML/CTF Act s 6(5A)), which makes you an AUSTRAC reporting entity from 1 July 2026. That single trigger creates two distinct sets of obligations, run by two different regulators:

The AML/CTF half, administered by AUSTRAC: enrolment, a written AML/CTF program, customer due diligence and reporting.
The privacy half, administered by the OAIC: because becoming a reporting entity switches on Privacy Act s 6E(1A) for the client-identity data you collect for those checks, even under A$3 million turnover.

The two halves are priced and bought separately. An AML pack does not give you the privacy documents, and a privacy kit does not do your AML program. If you budget for one and assume it covers the other, you are half-covered. Read: AML kit vs privacy kit, what your AML pack leaves out.

What the AML half costs (AUSTRAC's domain, not ours)

We do not sell AML/CTF products and we do not assess your AML obligations, so treat this as orientation only, not advice. The headline point is that the floor is free:

AUSTRAC's free real-estate AML guidance and program materials are published for the sector. Enrolment itself has no fee. So the genuine minimum AML cost is your time to enrol and to stand up a program.
Paid AML document packs exist if you want them done for you. As a rough guide to the market: a buyers-agent-specific AML pack sits around A$249 (roughly ten AML documents, no privacy content), and broader AML kits sit around A$497 one-off or near A$990 a year for a founding subscription. These are AML-facing documents and, in the packs we have reviewed, contain little or no Privacy Act content.

So the AML half can cost you nothing but time, or a few hundred dollars if you buy a pack. Either way it is a separate bill from the privacy documents below.

What the privacy half costs

This is the half Privaproof is built for, and here too there is a free floor and a paid ceiling.

The free building blocks. The OAIC publishes a free "Template privacy collection notice for reporting entities under the AML/CTF Act", and generic policy generators (the Lawpath, Sprintlaw, Termly and ComplianceKit tier) sell horizontal privacy policies from around A$79. You can assemble something at low cash cost. The catch is fit: none of these are written for a buyers agent, none scope the documents to the s 6E(1A) identity data specifically, and none reconcile the AML seven-year record floor against the Privacy Act's "destroy when no longer needed" principle. You buy a document and inherit the job of making it fit.

The real cost is time and currency, not the download fee. A generic policy is cheap to buy and expensive to own: you spend hours tailoring it, you carry the risk that it misdescribes what you actually collect, and it does not update itself when the law moves (for example the 10 December 2026 automated-decision-making transparency rule). A cheap one-off template that is wrong or stale is not cheaper than a fit-for-purpose one, it just moves the cost onto you.

What a buyers agent's privacy half should actually contain, whichever route you take: a privacy policy (APP 1), collection notices (APP 5, including the AML customer-due-diligence notice at engagement), a data-breach response plan for the NDB scheme, and a retention and destruction schedule. Read: the buyers agent privacy policy, what it must cover and the collection notice you need at engagement.

Where Privaproof fits on the price line

Privaproof covers the privacy half only. Not the AML program, not legal advice: a buyers-agent-specific privacy document set, plain-English and tailorable, and kept current as the law changes rather than sold once and left to go stale. That is the trade against a A$79 generic template: you are paying for sector fit and for someone else carrying the currency job, instead of a one-off download you have to reshape and re-check yourself.

The Buyers-Agent Kit is not on sale yet, so there is no checkout and no price to quote today. You can join the founding list to be told the price and the opening date when it is set. Read: the privacy kit no RE-agency tool covers.

The cost of getting it wrong (kept in proportion)

It is tempting to price compliance against the penalties, but honesty matters more than fear here. Privacy Act penalties are ceilings, not certainties, expressed in penalty units (A$364 each from 1 July 2026), and most matters resolve with no fine at all. The regulator's usual first response to a small operator is engagement, not a maximum penalty. AML/CTF penalties are separate again, are AUSTRAC's to administer, and carry their own much higher ceilings . We do not assess AML exposure and you should not budget off worst-case numbers from either regime.

The more realistic "cost of getting it wrong" for a buyers agent is a data breach. You hold few files but each is deep: identity documents, mortgage pre-approvals, bank statements, proof of deposit and, for higher-risk clients, source-of-funds evidence. A breach of that concentrated, high-value data is very likely to cause serious harm, which makes it notifiable, and the notification, remediation and reputational cost dwarfs the price of the documents that would have helped you handle it. Read: your data-breach response plan.

So, what should you actually budget?

Think of it as three lines, not one:

1. AML program: free (AUSTRAC starter kit plus your time) to a few hundred dollars for a paid pack. AUSTRAC's domain, not ours. 2. Privacy documents: free-to-A$79 for generic templates you tailor and maintain yourself, or a buyers-agent-specific, kept-current set where the fit and currency are done for you. 3. Your time: the real cost in both halves, and the one a fit-for-purpose, maintained kit is designed to shrink.

The mistake to avoid is paying for the AML half and assuming the privacy half came with it. It did not, and the same 1 July 2026 trigger created both. Read the cornerstone: privacy compliance for Australian buyers agents.

Common questions

Is there a fee to enrol with AUSTRAC as a buyers agent?

Enrolment itself does not carry a fee. The AML cost is your time to enrol and to stand up a written AML/CTF program, plus the optional cost of a paid AML document pack if you would rather not build it yourself. AUSTRAC also publishes a free starter kit that covers buyer's agencies. This is AUSTRAC's area, not Privaproof's, so confirm the current process with AUSTRAC.

Can I just buy a A$79 privacy policy and be done?

You can buy one, but a horizontal generic policy is not written for a buyers agent, does not scope itself to the s 6E(1A) identity data, and does not keep pace as the law changes. The purchase price is low; the ownership cost (tailoring it, checking it is accurate, and updating it) is where the real spend sits. A cheap template that is wrong or stale is not actually cheaper.

Does the AML pack I already bought cover my privacy obligations?

Generally no. The AML packs we have reviewed are AML-facing (program, customer due diligence, reporting) and contain little or no Privacy Act content: no privacy policy, no APP 5 collection notice, no NDB breach plan and no AML-versus-APP retention reconciliation. Those are the privacy half, created by the same 1 July 2026 trigger, and they are bought separately.

How much will the Privaproof Buyers-Agent Kit cost?

It is not on sale yet, so there is no price to quote today. Privaproof covers the privacy half only, as a kept-current, buyers-agent-specific document set. Join the founding list to be told the price and the opening date when they are set, at no cost or obligation.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Privaproof's buyers-agent documents are self-authored and are not independently reviewed by a solicitor. This page does not assess your obligations under the AML/CTF Act itself, which are administered by AUSTRAC, and the third-party prices mentioned are indicative market figures that change over time. The Privacy Act 1988 (Cth) and related guidance also change over time, so check you are working from a current version. For advice on your specific circumstances, consult a qualified Australian legal practitioner.