On 1 July 2026, real estate agencies across Australia came under the Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) regime for the first time. The lead time was long, and the obligations were clear. Four months later, the picture is mixed.
What does the law require of agencies?
Enrolment with AUSTRAC. Any agency providing a designated service must be on AUSTRAC’s register. It’s the first step, and the easiest for the regulator to check.
A working AML/CTF program. This is a documented program setting out how the agency identifies, manages and reports money laundering risk. It has to reflect how the business actually runs, not a template filed away in a drawer.
A trained team. Principals, sales agents, property managers and admin staff all need to recognise a red flag and know what to do about it. Compliance fails if only one person understands it.
The law doesn’t require software. In practice, though, identity checks, risk assessments and record keeping across a busy office are very hard to evidence without a system behind them.
What’s actually happened since 1 July?
Enrolment is lagging. As of mid September 2026, only around 45% of businesses newly covered by the rules, including real estate agencies, had enrolled with AUSTRAC. But enrolment is only the first step, and it’s the next steps where agencies are coming unstuck.
Rushed decisions are catching up with agencies. According to APLYiD, agencies are reporting that they chose whatever was quickest to set up under deadline pressure, and are now finding it doesn’t fit how they work. Some are already looking for a second system.
AUSTRAC has moved to enforcement. Since 30 September 2026, the regulator has been issuing infringement notices to businesses that haven’t enrolled, with penalties of up to $21,840.
AUSTRAC CEO Brendan Thomas has been clear: “The time for preparation has passed. Businesses covered by Australia’s AML/CTF laws should already be working on managing their risks and meeting their obligations.”
Where are agencies struggling?
Too many manual steps. A single client can involve 15 to 20 manual steps: entering details by hand, chasing ID documents by email, attaching files and ticking boxes. It’s slow, errors creep in, and the audit trail ends up with gaps.
Spreadsheets. A spreadsheet can’t verify an identity, flag a risk or prove to a regulator when a check was done.
Tools built for someone else. Some agencies bought systems designed for banks. They pay for features nobody uses, and staff avoid the tool because it’s hard to use.
Unpredictable costs. When every check carries a fee, some teams start rationing checks to control the bill. That’s a compliance risk in itself.
Too many vendors. Separate providers for ID checks, policy and training leave the agency joining the dots between systems that don’t talk to each other.
Tools that stop at ID. Some cheaper options handle verification only, leaving risk assessments, ongoing monitoring and reporting with the agency.
What do agencies that are doing well have in common?
They aren’t necessarily the biggest or the best resourced. They’ve made a few sensible choices.
Their compliance matches their size. Their tools are built for a real estate office, not scaled down from a bank or stripped back to the bare minimum.
Their program and their practice line up. Onboarding, verification, risk assessment, policy and training are connected, so what’s written down matches what happens day to day.
AML runs inside their existing workflow. When checks happen inside the CRM or property management software the team already uses, compliance becomes part of the job rather than an extra one.
They know what it costs. Predictable costs mean every check that should happen does happen.
They can produce a record on demand. If AUSTRAC asks about any client, they can hand over a complete, timestamped record the same day.
What should agencies do now?
Test your setup against four questions:
- Is your whole team actually using it?
- Does it work inside the software you use every day?
- Do you know exactly what it will cost each month?
- Could you hand AUSTRAC a complete record for any client tomorrow?
If the answer to any of these is no, it’s time to rethink your setup. Good compliance is the kind your team hardly notices, because it’s built into the way they already work.
If you haven’t enrolled, do it today, because AUSTRAC has stopped sending reminders and started issuing penalties.
Book a free 15-minute AML health check. We’ll run your current setup against the four questions above and show you where the gaps are.
APLYiD is a no-nonsense compliance platform built for real estate agencies across Australia, New Zealand and the UK, integrating with MRI, Rex, PropertyMe and other leading industry software.