efex
AML/CTF and the Privacy Act · Legal and conveyancing
Obligations commenced 1 July 2026

Managing identity records under AML/CTF, Privacy, VOI and professional obligations

AML/CTF requirements affect what identity records must be collected and retained. Depending on the services your firm provides, those same records may also be subject to privacy, conveyancing and professional confidentiality obligations. How those records are stored, accessed, retained and disposed of is now subject to obligations alongside their collection.

Start the checklist now to understand how your practice's systems and controls support the management, protection and retention of identity records.

  • Hold securely
  • Restrict access
  • Manage retention
  • Prepare for breach response
  • Evidence the controls
Start here
When you verify a client's identity, what happens to the document?
Start the checklist

13 questions, about 3 minutes. No client files or documents are required.

Services that may be captured

Your firm may already meet VOI requirements, but the new rules extend beyond conveyancing.

Conveyancing and property transfers
Company or trust formation
Handling or transferring client money
Acting on the sale or purchase of a business

If any of these apply, here is what the legislation now requires of your firm.

WHAT THE LEGISLATION SAYS - YOUR NEW REQUIREMENTS

AML/CTF, privacy, VOI and confidentiality obligations all affect how identity records are managed.

The AML/CTF reforms require many law firms to identify clients, verify information and retain records. Depending on the services your firm provides, those same records may also be subject to privacy, VOI and professional confidentiality requirements.

In short: Identity records may now be subject to multiple obligations at the same time, affecting how they are collected, stored, accessed, retained and disposed of.

AML/CTF Act

Administered by AUSTRAC

The AML/CTF Act requires reporting entities to identify clients, verify information and retain records that demonstrate compliance.

  • Identify and verify clients
  • Record how identification was carried out
  • Retain required records for seven years
  • Protect suspicious matter reporting information from disclosure
Up to $36.4m maximum civil penalty per contravention of the AML/CTF Act, for a body corporate

Read the legislation: AML/CTF Act 2006 (current compilation) · Amendment Act 2024

Privacy Act

Administered by the OAIC

Privacy obligations govern how personal information is collected, stored, accessed and disposed of.

  • Protect information from loss and unauthorised access
  • Limit collection to what is reasonably necessary
  • Restrict access to authorised personnel
  • Destroy or de-identify information when no longer required, unless retention is required by law
Up to $50m maximum penalty for serious or repeated interference with privacy, for a body corporate — or 30% of adjusted turnover if greater

Read the legislation: Privacy Act 1988

VOI requirements

ARNECC model participation rules, administered by the state and territory land registrars

Verification of identity requirements continue to apply to conveyancing matters and operate alongside AML/CTF obligations.

  • Retain required VOI evidence
  • Keep evidence secure, legible and accessible
  • Demonstrate compliance with the VOI standard

Read the guidance: ARNECC Verification of Identity Guidance

Professional confidentiality

Under the Legal Profession Uniform Law and conduct rules

Identity records are also confidential client information and must be handled accordingly.

  • Restrict access to client information
  • Protect confidential records
  • Manage disclosure carefully and only where permitted or required

Read the rules: Australian Solicitors' Conduct Rules, Rule 9

What this means for your firm

Identity records are no longer just documents collected during client onboarding or to satisfy VOI requirements.

The same document may also be subject to AML/CTF, privacy, record retention and confidentiality requirements.

For many firms, the challenge is understanding what records are held, where they are stored, who can access them and how those controls can be demonstrated if questioned.

Here is a practical sequence for putting that in place.

Action plan

What your business needs to do now

Ten practical steps to ensure your business is ready.

Steps 1–5 are for you and your advisor, steps 6–10 relate to your IT systems. Complete the short checklist to understand where your firm stands against steps 6–10. It's only 13 questions, and takes just 3 minutes to complete. If you'd rather have one of our specialists review your systems with you, book a no obligation consultation with us today.