An opinion piece for Real Estate Principals on AML/CTF compliance, by Phil Rice CPBA

Founder and Chairman, Emerald Group Holdings. Certified Professional Business Advisor with nearly three decades in banking, mortgage and asset finance, and property. Holder of an Australian Credit License. Built Better Business Coach, engaged by the Finance Brokers Association of Australia to deliver its national Broker Academy. This is the same compliance-first lens now trained on real estate.

On 1 July 2026, roughly 80,000 Australian businesses that had never before been regulated for financial crime woke up as AUSTRAC reporting entities. Real estate agents were among them. For the first time in the two-decade history of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, the industry that handles the single largest asset class most Australians will ever transact in was brought inside the regulatory tent. It was overdue — property has long been flagged, including by the Financial Action Task Force, as one of the more attractive vehicles for laundering illicit funds. That is why the reform happened; and the industry wasn't ready for it.

In the run-up to the deadline, the market did what markets under pressure tend to do: it reached for the fastest thing that looked like an answer. A login. A subscription. A form. Something — anything — to say “we did it” before the fines started. I understand the instinct. I do not blame a single principal for it. But I want to say, plainly, as someone who has spent close to two decades in finance compliance before this obligation ever touched real estate: a subscription is not a compliance program, and AUSTRAC will not treat it as one.

Where the industry actually stands right now

Talk to enough principals, and a pattern emerges. Most did something. Very few can tell you, with confidence, whether that something is enough. That uncertainty isn't a failure of the principals/Licensee's — it's a failure of preparation time and clarity. Consider what's still genuinely unresolved for most agencies:

• There is real confusion about adequacy. Almost every office has “a system.” Almost none can say with confidence it meets the standard AUSTRAC actually expects.

• Nobody has clearly defined what “adequate” looks like in practice. AUSTRAC's guidance describes a written program, a designated compliance officer, risk-based due diligence, ongoing monitoring, reporting, and independent review — but translating that into “is my office okay” is left almost entirely to the business.

• There is little transparency on consequences. Principals know penalties exist. Very few know what actually triggers an audit, what a review looks like, or what happens to a license if a file doesn't stack up.

• The real costs are already blowing out. Identity verification (VOI) is charged per check, and a failed or repeated verification — a blurry scan, a name mismatch, an expired document — means paying again. Multiply that across every buyer and seller and the “cheap” plan stops looking cheap.

• The hidden costs are the ones nobody budgeted for — program reviews, staff training and its documentation, independent audits, reputational exposure if something goes wrong publicly, and the simple, quiet frustration of not knowing whether you're actually protected.

Here is the part that deserves saying without dressing it up: for months, the only thing on offer to most of the industry was software — a login and a tick-box. That is not a criticism of the technology itself. It's a criticism of the idea that technology alone equals compliance. An identity check answers one part of one obligation. It does not write your risk-tailored program, it does not hold legal accountability for your compliance decisions, it does not monitor a client relationship as it evolves, and it does not conduct an independent review of itself. AUSTRAC has been explicit that a documented, accountable framework — run by qualified people — is what “compliant” actually means. A dashboard is not a person, and a person is what the law requires.

There is one more misconception I want to correct directly, because I hear it constantly from agents: AUSTRAC does not endorse, approve, or accredit any AML compliance provider. Not one. AUSTRAC's own published guidance states plainly that if a third-party provider claims to be endorsed or approved by AUSTRAC, that claim is false. There is no “AUSTRAC-approved” badge to look for, no government tick of quality control or appropriateness you can rely on to make the decision for you. That responsibility sits with the principal, full stop. Signing up to a platform that markets itself as compliant may only be telling half a story, and your risk is not transferred to that platform — it stays with you, your license, and your business. Which is precisely why the due diligence question above is not optional. Nobody is going to vet your provider for you.

A business advisory view: what to actually do

This is where I want to speak to you not as a vendor, but as an advisor. Step back from the panic of the deadline and ask yourself these questions honestly:

1. Take a step back. The deadline has passed. The real question now is whether what you put in place will hold up under scrutiny and audit — not whether you technically “did something” by 1 July.

2. Look objectively at what you have. Not what the salesperson told you it did. What it actually does, on paper, today - that makes you fully compliant.

3. Ask yourself, honestly: do you feel protected? Not “did I sign up.” Protected.

4. Imagine the email. AUSTRAC asks for a file from a sale twelve months ago, tied to a money-laundering investigation. Is that file complete, defensible, and compliant with AUSTRAC's guidelines — or are you hoping it is?

5. Did you do due diligence on your provider — or take the cheapest option to appear compliant?

That last question is the one that can hurt you. AUSTRAC has shown no tolerance for the idea that a software subscription equals compliance. And here is the part worth sitting with: cost is no longer a reasonable excuse. Compliance cost can be structured as a cost-neutral line item — folded into a vendor administration fee the same way marketing and document preparation already are — so the “it's too expensive” objection largely disappears once you understand the mechanics. With cost effectively off the table, the only question left is the one that actually matters: which option gives your business, your license and your clients the best real protection? Right now, there are very few genuine choices in that category — most of the market is still software wearing a compliance label.

We saw this coming. Because Business Advice Agency has a long-standing footprint in finance compliance alongside real estate, we could see the industry was not being equipped to manage this risk properly. So we built AML HQ — not a bolt-on to an existing platform, but a compliance framework designed specifically for Tranche 2 real estate obligations, with an accountable compliance officer function behind it, not just a login screen. You can review it at amlhq.com.au.

AML compliance is not a tick-and-flick exercise. It is a serious, ongoing legal obligation, and treating it as a box to check is the single most expensive mistake a principal can make this year.

This article is general commentary from a business advisory perspective and does not constitute legal, financial or compliance advice. Principals should seek independent legal and accounting advice regarding their specific AML/CTF obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).