Are you in scope?
The short version. From 1 July 2026, you are a reporting entity under the AML/CTF Act if you provide a designated service. For real estate the designated services are assisting in the buying or selling of real estate and assisting in transferring a leasehold interest. The definition is deliberately wide. Sales agents, leasing agents and property managers handling sales adjacent activity are all in.
Practical filter that catches almost everyone: if your office would issue an invoice or commission against a property settlement, you are in scope. The franchise question is separate. A franchise group might centralise some of the obligations, but each office still has to enrol with AUSTRAC, maintain its own program, and keep its own records.
The two groups that are usually NOT in scope: pure long-term residential leasing agencies that never touch a sale, and commercial agents whose sole activity is brokering business assets unrelated to real property. If either describes your office cleanly, you may have a narrower set of obligations. Confirm with a lawyer before you decide you are out.
The 11 obligations, mapped to a real estate agency
AUSTRAC publishes its obligations as a tidy list. Real-world implementation is messier because most of them touch the same customer file at different points in the transaction lifecycle. Here they are in the order a typical office runs into them.
Enrol with AUSTRAC within 28 days
Submit your enrolment within 28 days of the first time you provide a designated service. Practically, get the enrolment lodged before 1 July 2026. AUSTRAC issues you an AUSTRAC reference number; you will need it on every subsequent report.
Conduct an ML/TF risk assessment
A documented assessment of money-laundering and terrorism-financing risk in your business. Covers customer types, geographies, transaction types and delivery channels. For an agency dealing with mostly local owner-occupier sales, the assessment is short. For an agency with overseas investor exposure, it is longer.
Maintain an AML/CTF Program
Part A: how your business identifies and mitigates risk. Part B: how you verify customer identity. Both parts must be approved by your governing body. For a sole-trader practice the governing body is you, but the approval still has to be documented.
Run customer due diligence (KYC) before providing service
Verify identity of every party in the transaction before you provide the designated service. For individuals: name, date of birth, address, photo ID. For companies: incorporation details, beneficial ownership down to a 25 percent threshold. The verification has to happen before settlement, not after.
Screen for sanctions and PEPs
Check every customer against the consolidated DFAT sanctions list and the EU and UN lists, plus PEP (politically exposed person) lists. New hits get an enhanced due diligence (EDD) workflow. Re-screening cadence depends on the customer's risk rating: high every 6 months, medium yearly, low every 3 years.
Detect and report Suspicious Matters (SMRs)
If you form a suspicion about money laundering, terrorism financing, or proceeds of crime, lodge a Suspicious Matter Report with AUSTRAC. Within 3 business days normally, 24 hours if you suspect terrorism financing. SMRs are confidential; do not tell the customer.
Report Threshold Transactions (TTRs)
Cash transactions of A$10,000 or more, within 10 business days. Real estate rarely sees cash this size directly, but TTRs apply to physical currency you receive in your capacity as a reporting entity. Most agencies file zero TTRs in a year. The obligation still exists.
Report International Funds Transfer Instructions (IFTIs)
Cross-border instructions you give or receive as part of a designated service, within 10 business days. Foreign buyer wiring deposit funds from offshore directly to your trust account is the canonical example. Foreign seller wiring proceeds offshore after settlement is another.
Keep records for 7 years
Customer identity records, transaction records, AML/CTF Program versions, training records, independent review reports. Seven years is the floor; some records (audit trail of changes) are sensible to keep longer. Records must be retrievable on AUSTRAC request, normally within a defined window.
Train your staff
Every member of staff exposed to designated services must complete AML/CTF training and have it documented. New hires get trained before they handle a designated service. Existing staff get refreshers periodically (annually is the de facto standard).
Annual independent review
Your AML/CTF Program reviewed annually by someone independent of day-to-day program operation. Floor in the rules is every 3 years; annual is the safer cadence. For a sole-trader practice the reviewer is typically an external auditor or a peer-practice principal.
Records and retention
Seven years is the headline figure but the seven years starts from different events depending on the record type. Customer identity records run from the date the customer relationship ends. Transaction records run from the transaction date. AML/CTF Program versions run from the date the version was superseded. Get the start date wrong and you can be technically compliant today but under-retained when AUSTRAC asks in 2032.
Two practical implications. First: do not delete anything. The obligation is to retain, so soft-delete (mark archived but keep the row) is safer than hard-delete. Second: when you offboard a customer, set the retention clock explicitly so a future you knows when it is safe to purge.
Penalties for getting it wrong
AUSTRAC has both criminal and civil penalty powers under the AML/CTF Act. Civil penalty units for body corporates run into the tens of millions for the most serious breaches. Individuals can be personally liable. AUSTRAC has historically pursued large institutions for systemic failures (Westpac, CBA, Star, Crown) rather than small practices for technical oversights, but enforcement priorities will shift once the Tranche 2 cohort is live.
The most pragmatic read: AUSTRAC will not be looking to make an example of a 3-agent suburban office that lodged its enrolment late by two weeks. They will care if your program is missing entirely a year in, if you ignored a suspicious matter, or if you lost a customer file you were obliged to keep. The difference is intent and consistency, not perfection.
What to do this quarter
Concrete sequence for an independent agency that has done nothing yet. None of these steps require external help if your office is small.
- Read the AUSTRAC starter materials for real estate (one evening).
AUSTRAC publishes starter guidance specifically for new Tranche 2 cohorts. Get the vocabulary down before you spend money on tooling or consultants.
- Score your readiness honestly (15 minutes).
Twelve-question self-assessment. Free, no signup. The result is a numbered score, a band, and a specific list of gaps to close.
Try the readiness check - Cost it out (15 minutes).
Whatever you pick (Caltury, a competitor, a consultant, internal time), get a realistic dollar figure on the page so you can budget.
Open the cost calculator - Decide build, buy, or hire by 30 June 2026.
You have three options. Build it in spreadsheets and Word docs (cheap, painful, fragile under audit). Buy software (recurring cost, less custom). Hire a consultant (high cost, dependent on their availability). The Tranche 2 deadline does not move; the decision should be made well before June 2026 to give whichever path you pick time to settle.
- Enrol with AUSTRAC by the end of June 2026.
Even if your program is not finalised, get the enrolment in. Penalty for late enrolment is greater than penalty for an early enrolment with a thin program.
Common questions
Do I need an AML/CTF compliance officer?
Yes. The AML/CTF Program names a compliance officer who is responsible for day-to-day operation. For a sole-trader or owner-operator practice, that is usually the principal. The role does not require an external certification; it requires that the named person actually knows the program and is contactable by AUSTRAC.
Can my franchisor do all this for me?
Not entirely. A franchise head office can provide a Part A template, training materials and central support, but each office is its own reporting entity. Each office enrols separately with AUSTRAC, runs its own customer due diligence, files its own reports and keeps its own records. Centralised tooling is fine; centralised liability is not.
What if my agent is also a sole-trader subcontractor?
Each subcontracted sales agent who provides a designated service in their own right may be a separate reporting entity. The simpler structure (and the one most franchise groups are landing on) is for the licensed office to own the AML/CTF program and have subcontracted agents operate under it. Worth a 30-minute call with your accountant to confirm where the responsibility sits in your specific structure.
How does it work for off-the-plan and developer sales?
Developer and off-the-plan sales involve more parties (developer, exclusive marketing agent, sub-agents, buyer's introducer). Each party that helps the buyer or seller transact in a designated-service capacity is captured. The buyer's identity verification and source-of-funds checks have to happen before the contract becomes unconditional, not at settlement.
Foreign buyer paying deposit from overseas. What changes?
The deposit is an IFTI (International Funds Transfer Instruction) you are involved in as part of a designated service, so you report it. The buyer is also a higher-risk customer for sanctions and PEP screening purposes; you almost certainly want enhanced due diligence rather than the standard customer process. Source-of-funds questions become harder; documented evidence is the answer.
My trust account is at a bank. Does the bank's AML do the work for me?
No. The bank does its own AML/CTF on its banking relationship with you. That is separate from your obligations as a reporting entity providing real estate designated services. You both have parallel obligations on the same money flow.
How fast does Caltury actually go live?
Self-serve trial is 14 days, no credit card. Enrolment wizard, program builder and customer onboarding are usable on day one. Most independent agencies have the core program drafted within a week of starting and switch to live customer onboarding once their existing book is migrated (CSV import). No call required, no demo, no consultant.
Caltury is AML/CTF software built specifically for independent Australian practices entering Tranche 2. Founded by Ben Horne (ex-ADF, sole trader, ABN 49 452 393 782, Torquay VIC). Sydney hosted on Supabase + Vercel. Async written support, no calls or demos. If you found this guide useful and want the walkthrough applied to your specific situation, the readiness assessment is the right next step.
This guide is general information about Australian AML/CTF obligations. It is not legal advice. AUSTRAC has not reviewed this content. For situations specific to your practice consult an Australian-qualified lawyer or AML/CTF adviser.