Making AML/CTF Part of the Way You Do Business

Since 1 July 2026, Australian real estate professionals providing designated real estate services have been brought within Australia’s AML/CTF regime.
The challenge now is making sure it works when real customers, real properties and real deadlines are involved.
Your first 90 days are where that starts to happen.

Days 1–30: Turn the program into a working process

By 1 July 2026, newly regulated real estate businesses were expected to be enrolled with AUSTRAC, have an AML/CTF program and have an AML/CTF compliance officer in place.

Your program is the foundation; it details your policies, procedures, systems and controls for managing and mitigating the risk your business faces of money laundering. It requires an active, hands-on approach to ensure it is up to date, and that the AML team are familiar with it.

During the first month, focus on whether staff understand the program and what it means for their jobs.
Who starts customer due diligence? What happens when the customer is a company or trust? What happens when information can’t be verified? Who decides whether something needs to be escalated?
Most importantly, can staff follow the process while still doing their normal jobs?
Take a recent transaction and walk it through your AML/CTF process from beginning to end. You’ll quickly discover where the practical gaps are.

Train staff on the bigger picture and your processes

It is important for all staff with AML duties, as well as the board/senior management to understand the ‘Why’ behind the AML/CTF legislation. While the AMLCO is responsible for overall AML compliance, they rely on colleagues to help meet obligations. Understanding the bigger picture helps drive:

• Successful adoption of AML policies, procedures, systems, and controls internally

• Conversations with clients, especially those who push back on CDD

• Compliance with the legislation’s obligations

When required to undertake your independent evaluation (which is required at least once every three years), strong staff training will make a difference in the outcomes.

With appropriate, role-specific training, a salesperson will also have the knowledge to recognise when the AML/CTF process requires them to do something more. 

That could happen when:

• a purchaser changes from an individual to a company or trust

• someone begins acting on behalf of the customer

• information about ownership or control is unclear

• a transaction changes materially from what was originally explained

• an unexpected third party becomes involved.

These situations are all examples where staff need to follow the process laid out in your AML/CTF program, collect further information, or escalate the matter. Training is vital to the successful adoption of this.

At a minimum, it should help them answer three questions: what should they notice, what should they do next, and who should they speak to when they’re unsure?

Get customer due diligence happening at the right time

Customer due diligence, or CDD, is one of the biggest practical changes for real estate businesses.
At its simplest, CDD helps you understand who you’re dealing with and the money laundering/terrorism financing (ML/TF) risk associated with providing a designated service to that customer.

The general rule is that initial CDD must be completed before you commence providing a designated service.
The AML/CTF Rules provide specific circumstances in which certain real estate services can begin before all initial CDD has been completed. Those provisions have conditions and time limits, thus, your  AML/CTF policies should tell staff what process applies.

Consider a company selling a commercial property. Depending on the circumstances, your CDD process may involve establishing matters such as the company’s identity, its beneficial owners, anyone acting on its behalf and their authority to act.

An important distinction is: the customer and the beneficial owner aren't necessarily the same person. A company can be your customer. A beneficial owner is an individual (a natural person) who ultimately owns or controls that entity.

Days 31–60: See what happens when the transaction changes

By the second month, you’ve probably discovered that real transactions don’t always follow the script.

Imagine a buyer tells you the property purchase will be funded from personal savings. A few weeks later, the arrangement changes and money will instead come from a company controlled by a relative.

This is not necessarily suspicious behaviour, however, the change must be considered in light of your understanding of the customer and the transaction to see if it makes sense.

Thus, you may need to ask why the arrangement changed, understand the relationship between the parties, and consider whether the explanation is consistent with the other information you hold.
That’s the risk-based approach in practice.

Days 61–90: Move beyond onboarding

By the third month, another habit will be taking shape: paying attention after the customer has been onboarded.

Australia’s AML/CTF framework requires ongoing customer due diligence in relation to the provision of designated services. Where you have an ongoing business relationship, that includes keeping your understanding of the customer and their risk appropriately under review and updating relevant KYC information where appropriate.

For example, a property developer sold several housing units through your agency, and plans to sell 50 more with you over the next three years. After a year has passed however, they begin selling commercial property through your agency, too. The switch from housing units to commercial property means the nature and purpose of the business relationship has changed, along with the potential risks for ML/TF. Therefore it’s a trigger for ongoing CDD. 

Know when risk requires more

Your first two months are also the time to make sure your staff understand the circumstances where additional risk-based measures are required in customer onboarding.

For example, you onboard a couple who are looking to sell their home to move to a bigger house. When you conduct a Politically Exposed Persons (PEP) check, you find that the wife has a confirmed match. This is a trigger for Enhanced Customer Due Diligence (enhanced CDD) because the risk has increased, requiring the provision of Source of Wealth / Source of Funds (SOW/SOF), and / or shorter review periods if relevant.

Another example may be, an 18-year old wishes to purchase a $1.2 million property from you, but your typical customer in this price bracket consists of families and retired couples. As it is unusual for your agency to transact with someone of this age and with those resources, the risk level increases and enhanced CDD is triggered. On collecting SOF, you learn that the funds come from a recent inheritance from grandma, which is a plausible explanation.  

The circumstances in which enhanced CDD are required are outlined in your AML/CTF Program, and it is the responsibility of the AML Compliance Officer to ensure staff understand when it must be implemented.


By day 90: Look for evidence that the system is working

After three months, ask yourself: could you demonstrate how your AML/CTF program operates in practice?

You should be building a record of the processes and decisions behind your compliance. This includes customer information, individual risk ratings, verification records, training records, escalations, and file notes explaining how decisions were reached.

This is important because “if it’s not written down, it didn’t happen.” Maintaining records of your AML/CTF activities is a legislative requirement and serves as proof to AUSTRAC that you are working to meet your obligations. 

Having clear records of your AML/CTF also helps you improve in managing your compliance by answering questions like: are staff struggling with company or trust customers? Is CDD happening at the right time? Are the right documents being collected? Are unusual situations being escalated in a timely fashion? Do staff understand why they’re collecting information?

When you understand the answers to these questions you can look at what needs to change, where additional training is required, and if any internal systems or processes should be adjusted.

AUSTRAC has recognised that 2026–27 is an implementation period for newly regulated businesses and has emphasised an outcomes-focused, risk-based approach. That shouldn't be confused with a grace period as your obligations have commenced.
The opportunity during these early months is to identify problems, address them and demonstrate that your business is genuinely working to manage its ML/TF risks.


Do you provide a designated service and need help with your AML? Contact AMLHUB today to book a demo or discuss how we can help your organisation transition seamlessly into the new regime.