efex
AML/CTF and the Privacy Act · Real estate
Obligations commenced 1 July 2026

Managing client identity records under AML/CTF, privacy and VOI obligations

AML/CTF requirements affect what identity information real estate agencies must collect, verify and retain. These records may also be subject to privacy and identity verification obligations, creating additional requirements around how information is stored, accessed, shared and disposed of.

Start the checklist now to understand how your agency's systems and controls support the secure management, protection and retention of client identity records.

  • Hold securely
  • Restrict access
  • Manage retention
  • Prepare for breach response
  • Evidence the controls
Start here
When you verify a client's identity, what happens to the document?
Start the checklist

13 questions, about 3 minutes. No client files or documents are required.

Services that may be captured

If your agency acts on the sale or purchase of property, these obligations apply.

Selling or purchasing residential property for a client
Selling or purchasing commercial property
Acting as a buyer’s agent
Brokering the transfer of real estate

If any of these apply, here is what the legislation now requires of your agency.

WHAT THE LEGISLATION SAYS — YOUR NEW REQUIREMENTS

AML/CTF, privacy and state property-agent obligations all affect how identity records are managed.

The AML/CTF reforms require many real estate agencies to identify clients, verify information and retain records. Depending on the transactions your agency handles, those same records may also be subject to privacy and state property-agent requirements.

In short: Identity records may now be subject to multiple obligations at the same time, affecting how they are collected, stored, accessed, retained and disposed of.

AML/CTF Act

Administered by AUSTRAC

The AML/CTF Act requires captured real estate agencies to identify clients, verify information and retain customer and transaction records for seven years.

  • Identify and verify buyers and sellers
  • Record how identification was carried out
  • Retain customer and transaction records for seven years
  • Protect suspicious matter reporting information from disclosure
Up to $36.4m maximum civil penalty per contravention of the AML/CTF Act, for a body corporate

Read the legislation: AML/CTF Act 2006 (current compilation) · Amendment Act 2024

Privacy Act

Administered by the OAIC

Privacy obligations govern how personal information collected during a listing or sale is collected, stored, accessed and disposed of.

  • Protect information from loss and unauthorised access
  • Limit collection to what is reasonably necessary
  • Explain collection clearly, in person and online
  • Destroy or de-identify information when no longer required, unless retention is required by law
Up to $50m maximum penalty for serious or repeated interference with privacy, for a body corporate — or 30% of adjusted turnover if greater

Read the legislation: Privacy Act 1988

State property-agent law

Record-keeping, conduct and trust account obligations under each state and territory

State and territory property-agent laws require agencies to keep agency agreements, trust account records and transaction documents, and to meet agent conduct and licensing obligations. Requirements and retention periods vary by jurisdiction.

  • Keep agency agreements, transaction and trust account records for the periods your jurisdiction requires
  • Meet agent conduct and licensing obligations
  • Maintain trust account records to the standard your jurisdiction requires
  • Store records securely and keep them retrievable
The primary Act in each state and territory:

What this means for your agency

AML/CTF is not simply about collecting identity documents. The same records may be subject to AML/CTF, privacy and state property-agent obligations at the same time. The common thread across all of them is the need for secure storage, controlled access, appropriate retention and evidence of compliance.

Here is a practical sequence for putting that in place.

Action plan

What your business needs to do now

Ten practical steps to ensure your business is ready.

Steps 1–5 are for you and your advisor, steps 6–10 relate to your IT systems. Complete the short checklist to understand where your firm stands against steps 6–10. It's only 13 questions, and takes just 3 minutes to complete. If you'd rather have one of our specialists review your systems with you, book a no obligation consultation with us today.