AML for Real Estate Agents: A Practical Tranche 2 Onboarding Guide

Which agency activities are covered

This guide assumes you know the outline of the reform. In short, the AML/CTF Act now covers real estate professionals, and the full background, dates and other sectors are in our Tranche 2 overview. What follows is the practical part: who you must check, in what order, and what to watch for.

AUSTRAC groups real estate professionals as agents, buyer's agents and property developers. The designated service that matters to most agencies is brokering the sale or purchase of real estate for someone else. If your agency negotiates or arranges a sale or purchase on a client's behalf, that is the activity that triggers the obligations. Check the exact wording of the designated services with AUSTRAC before relying on an exclusion, particularly for activities at the edges such as rental management, auctions run by third parties, or off-the-plan developments.

This page is general information based on AUSTRAC's published real estate guidance. It is not legal advice.

Who your customer is

The question catches most agencies out, because the intuitive answer ("the person paying my commission") is not what the guidance says. In AUSTRAC's real estate guidance, if you act for the seller and broker the successful sale, your customer is both the buyer and the seller. If you act for the buyer and broker the successful purchase, your customer is also both the buyer and the seller.

The buyer side is the part that changes day-to-day work most. Previously an agent might never have asked a buyer for identification beyond what the contract needed. Now the buyer's identity and the source of their funds can be part of what you are expected to understand before you broker the sale.

Onboarding an individual vendor, step by step

AUSTRAC's customer lifecycle is the best template for the workflow. Adapted for a vendor who is an individual, it looks like this:

1. Identify the kind of customer and the service. An individual selling a property they own is the simplest case. Record what you are being engaged to do.
2. Collect the information. Full name, date of birth and residential address, plus the details of the property and how the vendor holds title. Use one onboarding form rather than ad hoc emails.
3. Verify the information. Check the identity against a government-issued photo ID, an electronic data source or both, and compare the person to the document photo where you can. Remote vendors need a remote-safe method.
4. Screen the vendor. Check for politically exposed person status and for sanctions against persons designated for targeted financial sanctions.
5. Rate the risk. Use your program's risk factors (see below) to set the customer as low, medium or high, which decides how much more you need to do.
6. Look for triggers. Inconsistent details, unusual behaviour or a higher-risk indicator should be escalated according to your policy.
7. Decide how to proceed. Proceed, apply additional controls, escalate or report, or decline. You can generally only provide the service once the required checks are complete and identified risks addressed, unless your program meets the criteria for delayed CDD.
8. Record everything. Keep the evidence, the risk rating and the decision with the date.

Company, trust and other entity vendors

When the vendor is an entity, the work grows, because you must understand who ultimately owns and controls it. AUSTRAC publishes separate initial CDD guides for individuals, sole traders, bodies corporate, partnerships and unincorporated associations, trusts, and government bodies, so use the one that matches.

• Company: confirm the legal entity and its registered details, who the directors are, and who the beneficial owners are. Then verify the individuals who act for it and the people who ultimately own or control it, applying the same checks as for an individual vendor.
• Trust: obtain the trust deed or equivalent, identify the trustees, and understand who the beneficiaries are and who controls the trust. Trusts are a classic way of obscuring ownership, so a trust vendor with a vague answer about who benefits deserves another look.
• Anyone acting on a vendor's behalf: a solicitor, a family member or a power of attorney is not the customer, but you need to know they are authorised and who the person behind them is. AUSTRAC lists a third party that is not enrolled with AUSTRAC representing the customer as a medium-risk factor.

Every layer of ownership you cannot see through is a reason to ask more questions, and an unwillingness to explain the structure is itself information.

Setting the risk rating

AUSTRAC's real estate guidance gives concrete factors for scaling your checks. They are a useful starting point for your risk assessment, but your own assessment should still reflect your market and customers.

Two points stand out for agents. A purchase over A$1.5 million without a mortgage is a medium-risk factor on its own, so asking early how a purchase is being funded should be part of your standard conversation. And remote-only dealing is a medium factor, so verifying vendors without ever meeting them has to be paired with a solid identity method, not a lighter one.

Red flags specific to property

No single item proves wrongdoing, but together they are the pattern that should trigger a closer look and, if a suspicion is formed, a report.

• Cash and unusual payments: large cash deposits, deposits paid by unrelated third parties, or funds arriving from jurisdictions unconnected to the buyer.
• Rushed or flexible settlement: pressure to settle unusually fast, repeated settlement-date changes, or a buyer who does not mind overpaying.
• Mismatch of means and purchase: a buyer's stated occupation or income does not fit the price, or wealth is described but cannot be explained.
• Unexplained third parties: someone other than the named buyer drives the negotiation, supplies funds or signs documents.
• Opaque structures: a newly formed company or trust with no clear business reason, or a layered structure that hides the owner.
• Offshore buyers with thin documentation: overseas identity documents that are hard to verify, or a refusal to meet or provide proof of funds.
• Quick turnaround trading: buying and re-selling the same property at an unexplained price change.

Treat the list as prompts for a conversation with your compliance officer, not as an automatic accusation. If you do form a suspicion, AUSTRAC's real estate guidance says a suspicious matter report is due within 3 business days, or 24 hours if it relates to terrorism financing. Cash transactions of A$10,000 or more need a threshold transaction report within 10 business days.

Fitting checks into the listing process

Checks fail when they feel like an extra step bolted onto a campaign. A few design choices avoid that.

• Verify at engagement, not at contract. Make identity verification part of signing the agency agreement. By the time photography and marketing are underway, the vendor is already checked.
• Send a link, not a form. A mobile link that guides the vendor through document and selfie capture takes minutes, and it works for vendors who live interstate or overseas.
• Run checks in parallel. Verification, screening and the risk rating can run while the property is being prepared for market.
• Sort by risk early. Most vendors are low risk and clear in one pass. Time goes to the few that do not, so build the escalation path before you need it.
• Set expectations in the first conversation. Tell clients the checks are a legal requirement for every agency, not a judgement about them. That avoids most friction.
• Prepare for the buyer. Decide who collects buyer information and how it reaches the person responsible for the file.

A worked example with ScreenlyyID

Here is how a mid-sized agency might run a vendor check with ScreenlyyID. It is an illustration of the workflow, not a case study.

1. A listing is signed. The agent triggers a verification request from the agency's system to the vendor's phone.
2. The vendor captures their identity document and a selfie. ScreenlyyID authenticates the document and confirms a live person matches the photo.
3. Where the vendor lacks a suitable document or is overseas, a data-source match through electronic identity verification can confirm identity where coverage exists.
4. The same record is screened through AML screening for sanctions and PEP status.
5. The result comes back as a structured record. The agent applies the agency's risk rating, and a clean, low-risk vendor goes straight to marketing while any hit goes to the compliance officer.

For a company vendor, the same flow runs for each individual who acts for or owns the entity, which keeps the evidence consistent across a file. The point is that the agency has a dated, reviewable record of exactly what was checked, which is what you need if AUSTRAC asks.

Keeping checks current during a campaign

Customer due diligence does not end when the agency agreement is signed. AUSTRAC expects ongoing due diligence for as long as you provide the service, which on a long campaign can be months. Triggers worth building into your file notes:

• the vendor changes, or someone new starts instructing you;
• the sale structure changes, for example from an individual to a company, or a trust is introduced late;
• a buyer appears whose profile does not match the price, or the funding source changes between offer and contract;
• the deal moves unusually fast or an unexpected third party becomes involved;
• screening data changes, such as a person later becoming a PEP or being added to a sanctions list.

Each trigger should lead to a short, dated note: what changed, what you checked, and what you decided. That note is what turns a suspicious feeling into a defensible decision.

What goes in your onboarding form

A single, consistent form beats ad hoc emails and makes review easy. As a minimum for each customer, capture:

• the customer type (individual, company, trust or other) and the service you are providing;
• identity details and the evidence used to verify them, with the date and method;
• for entities, the structure, beneficial owners, controllers and authorised representatives;
• PEP and sanctions screening results;
• how the transaction is being funded and, where risk requires it, the source of funds and wealth;
• the risk rating, who set it and why, and any approvals;
• escalations, reports made to AUSTRAC, and the decision to proceed.

AUSTRAC's real estate starter kit includes customer forms that you can adapt. If you build your own, test it on one low-risk and one high-risk file before rolling it out.

Training the people who meet customers

The people most likely to see a red flag are the agents, property managers and administrators who deal with vendors and buyers every day. Obligations include AML/CTF training and personnel due diligence for anyone in an AML/CTF role. Keep it practical: walk through the red flags above, the escalation route, what not to say to a customer under suspicion (AUSTRAC's guidance covers tipping off), and a short list of questions to ask routinely. Record who was trained and when.

Records you need to keep

AUSTRAC says records are usually kept for seven years. For a sale, that normally means the onboarding form, the evidence used to verify identity, the screening results, the risk rating and any escalation notes, as well as transaction records. Your program should say where each is stored and who can access it.