KYC and AML checks for Australian real estate

From 1 July 2026, specified real estate services with an Australian geographical link are subject to AML/CTF obligations. The focus is on brokering a sale, purchase or transfer as part of a business, and on certain businesses selling or transferring their own real estate without an independent agent. The legal scope turns on the activity and interest involved, not simply on whether a business describes itself as a real estate agency.

• Seller’s agents and buyer’s agents will commonly provide the brokering designated service when acting as an intermediary for consideration.
• A property developer may be covered when it sells house-and-land packages, off-the-plan apartments or subdivided land using in-house sales staff rather than an independent agency.
• For brokering, both the seller or transferor and buyer or transferee are customers for AML/CTF purposes, even though only one side appointed the agent.
• Leases of 30 years or less, incidental disposals by a business and private residential sales are examples that may fall outside these specific real estate designated services; apply AUSTRAC guidance to the facts.

The point at which the designated service begins is different for the appointing customer and the counterparty. Build triggers into listing, buyer-agency, offer and contract workflows so the right customer is invited at the right time, rather than sending every person the same request as soon as they enquire about a property.

• A seller’s agent generally begins serving the seller when the agreement to broker the sale or transfer is signed.
• The same seller’s agent generally begins serving the buyer when the transaction is reasonably expected to proceed, typically when the offer is accepted and the sale or transfer contract is signed.
• A buyer’s agent generally begins serving the buyer when the agreement to find or identify property is signed, and the seller when the transaction is reasonably expected to proceed.
• A developer or business selling without an independent agent generally begins the designated service when there is a commitment to sell or transfer, typically when the agreement is entered.

An individual purchaser or vendor usually needs an individual KYC workflow. A company, trust, partnership or other organisation requires additional information about the entity or arrangement and the people connected to it. A single document upload cannot answer all of those questions, so the workflow should branch before verification begins.

• Use the KYC Check to verify an individual’s identity where AML screening is not part of the selected service scope.
• Use the combined KYC and AML Check when identity, PEP and sanctions screening need to be recorded together for an individual.
• Use the KYB Check to verify organisation information and identify directors, controllers, trustees, partners, beneficial owners or other relevant persons for follow-up checks.
• Where somebody acts for a customer, separately record who the underlying customer is, who the representative is and the reliable evidence supporting their authority.

AUSTRAC’s CDD framework requires reporting entities to establish on reasonable grounds whether customers and other specified persons are PEPs or designated for targeted financial sanctions before providing a designated service. Screening is an important input, but useful outcomes depend on accurate identifiers and a documented review method.

• Collect complete names, dates of birth, countries and other available identifiers to reduce ambiguity in screening results.
• Treat PEP status as a factor requiring the risk-based measures in your program, not as evidence of criminal conduct.
• Compare potential matches using multiple identifiers and document whether each result was cleared, confirmed or remained unresolved.
• Escalate sanctions concerns promptly. A technology result does not replace legal assessment of ownership, control, asset restrictions or reporting requirements.

Real estate transactions often involve customers outside the agency’s office, including interstate sellers, overseas investors and buyers represented by another person. A digital workflow can make evidence collection more consistent, but remote delivery can change the risk profile and should be addressed in the agency’s own assessment and procedures.

• Send the verification invitation through a controlled channel and explain why information is required, how it will be used and what happens if the check cannot be completed.
• Use the identity-verification method selected by your program and route document or identity discrepancies for human review.
• Check a representative’s identity and authority independently of the underlying buyer or seller instead of using the representative’s details as a substitute.
• Retain the outcome, timestamp, evidence references and review notes with the property matter, subject to your privacy, security and record-retention controls.

At auction, the successful buyer may not be known until the hammer falls and the contract may be signed immediately. AUSTRAC recognises that delayed initial CDD may be available where completing it would disrupt the ordinary course of business, but its use is conditional rather than a blanket auction exemption.

• Document why normal pre-service CDD could not be completed and why the legal conditions for delay are satisfied in that matter.
• Assess the additional ML/TF risk created by the delay and apply the controls required by your program.
• Complete sanctions screening without assuming that all CDD steps can be deferred on the same basis.
• Finish the permitted delayed steps within the required period and preserve the ability to stop or restrict the service if the customer falls outside risk appetite.

AuthNTick can help collect and verify identity or entity information, screen selected datasets and produce a point-in-time record. The agency still needs to interpret that evidence inside its AML/CTF program and decide what additional work is required for the customer and transaction.

• Combine check results with the agency’s own customer, service, delivery-channel, geographic and transaction risk factors.
• Apply enhanced CDD when the customer is high risk or another prescribed circumstance arises, including any appropriate source-of-funds or source-of-wealth work.
• Monitor customer interactions and relevant transaction behaviour through the business relationship and update KYC or risk information when required.
• Keep AUSTRAC enrolment, regulatory reporting, staff training, program review and independent evaluation in the agency’s broader compliance operating model.