What is an AML/CTF program? A plain-English guide for Australian real estate

Every reporting entity. If your real estate business provides designated services — selling or listing property for owners, acting for buyers, or selling your own developments — you became regulated on 1 July 2026, and the program obligation applies to you. Enrolment with AUSTRAC is step one; the program is step two. They are separate obligations, and enrolling does not create a program. Not sure you're regulated? Run the free two-minute check.

Two documented parts. First, an ML/TF risk assessment: an honest look at how your specific business could be misused to launder money or finance terrorism (including, under the reformed rules, proliferation financing), considering your customers, services, delivery channels and locations. Second, AML/CTF policies: the procedures your business follows to manage the risks you identified — customer due diligence, staff roles and training, record keeping, and reporting suspicious matters to AUSTRAC. You also appoint a compliance officer, and the program isn't set-and-forget: it must be kept current, with periodic independent evaluation over time.

Before you provide designated services. AUSTRAC has been explicit that regulated businesses must have and implement a program focused on identifying, managing and mitigating the risks they reasonably face — this is not a "get to it later" obligation that waits behind enrolment.

For many small agencies, yes — and that's AUSTRAC's position, not ours. AUSTRAC publishes a free, sector-specific program starter kit for real estate, and has stated that for businesses matching the characteristics the kit describes, the risk assessment and policies in it are appropriate for the common risks those businesses face — its regulatory engagement will focus on how you apply the program, not on demanding a fancier document. Start there today: AUSTRAC's real estate program starter kit. The honest caveat: the kit is a template, and the work is making it true for your agency — assessing your actual risks, naming your actual people, and running it day to day.

Providing designated services without a compliant program is a breach of the AML/CTF Act and can attract civil penalties, and AUSTRAC has indicated that failing to manage risk is a serious regulatory concern. The practical takeaway isn't fear — it's sequence: enrol, then build your program from the starter kit before business as usual continues.

KirriVault's program builder is in development. It will guide you through a risk assessment for your agency, produce a program document built on AUSTRAC's starter-kit structure, and keep it current when AUSTRAC updates its guidance. No launch date promises — when it's ready, the people on the list hear first.

Want the background first? Return to the landing overview of what comes after enrolment.

Based on AUSTRAC's published guidance, last verified 14 July 2026. View the source ->