AUSTRAC's Step 2.2: Who is your customer?

Since 1 July 2026, Australian real estate agents who broker the sale, purchase or transfer of property have been regulated under the AML/CTF Act, as part of the reforms known as Tranche 2.

If you broker a successful property sale or purchase, both the buyer and the seller are your customers. Collect and verify their information, rate each as low, medium or high risk, and apply the matching level of due diligence. Keep monitoring throughout the relationship, and report suspicious matters and large cash transactions to AUSTRAC on time.

Who is your customer when you broker a property sale?

AUSTRAC’s real estate program starter kit is clear that your customer is both the buyer and the seller:

• If you act for the seller and broker the successful sale of real estate, your customers are the buyer and the seller
• If you act for the buyer and broker the successful purchase of real estate, your customers are also the buyer and the seller

This matters because your AML/CTF obligations apply to both parties, not only to the person who engaged you. Each customer goes through your program’s customer due diligence process, and each needs a risk rating.

Before collecting any information, you first identify:

• The kind of customer: an individual or an entity, such as a trust or body corporate
• The type of service they want

Together, these determine which customer form applies and what information you need to collect.

How does your AML/CTF program scale to customer risk?

Your AML/CTF program is designed to match your effort to the level of risk. Customers with a low to medium risk need fewer steps. Customers who are more complex or higher risk need additional steps and closer attention.

The risk factors your program uses come from your ML/TF risk assessment, which you complete at Step 1 of AUSTRAC’s starter kit. We cover this in detail in our guide to AUSTRAC’s Step 1.1: Risk assessment .

Many agencies have already built their AML/CTF program using APLYiD’s resources and our AML/CTF policy builder. Your program sets out how to:

• Apply customer due diligence before you provide a service
• Collect customer information and verify it
• Assign each customer a risk rating of low, medium or high
• Detect and respond to risk indicators
• Decide when to escalate activity or report it to AUSTRAC
  
  

What makes a real estate customer high, medium or low risk?

Customer risk falls into three ratings. If your business uses its own custom program, your ratings may differ.

• High risk: one or more high risk factors, such as paying more than A$50,000 in physical currency, paying with cryptocurrency, unexplained wealth, or being a foreign politically exposed person (PEP). Apply enhanced CDD
• Medium risk: two or more medium risk factors, such as buying real estate over A$1.5 million without a mortgage, or dealing with you only through remote channels. Apply initial CDD
• Low risk: no high or medium risk criteria apply. Apply simplified CDD

A single medium risk factor on its own does not make a customer medium risk. You can always rate a customer higher if you identify other reasons for concern.

What happens at each stage of the customer relationship?

AUSTRAC’s starter kit sets out seven stages, from first contact to the end of the relationship:

1. Identify the kind of customer. Confirm whether they’re an individual or an entity, and what service they want
2. Collect customer information. The level of detail depends on the kind of customer, the nature of the service and the ML/TF risk factors
3. Verify customer information. Follow your initial customer due diligence form to confirm that the information can be relied on for AML/CTF purposes
4. Identify and assess triggers. Watch for inconsistencies in information, unusual behaviour that may lead to a suspicious matter report (SMR), and higher risk indicators. Triggers can appear at any point in the relationship
5. Decide how to proceed. Based on your checks, decide whether to proceed, apply additional controls, escalate or report to AUSTRAC, or not provide the service
6. Provide the service. Generally, only once the required checks are complete and the identified risks have been addressed
7. Continue ongoing due diligence. Review changes in behaviour or activity, respond to new triggers and keep customer information up to date

When the relationship ends, your program sets out which records you must keep, how long you must keep them, and how they support future reviews.

How can APLYiD manage customer due diligence for you?

APLYiD takes care of all the customer due diligence work so your team can stay focused on selling property. Working from the policy you built with the AML/CTF policy builder and our expertise in real estate and AML compliance, APLYiD:

• Brings the buyer and the seller into one workflow, so both customers in a transaction are handled together
• Confirms they are who they say they are, so you can rely on their information for AML/CTF purposes
• Flags risks to you, based on the risk factors in your policy, so you know when a customer needs closer attention

You stay in control of the decisions that matter, including whether to proceed and when to report to AUSTRAC. APLYiD gives you the information you need to make those calls with confidence.

Where can you learn more about customer due diligence?

Knowing who your customer is sits at the heart of your AML/CTF program. In practice, it comes down to a few consistent habits:

• Treat both the buyer and the seller as your customers
• Rate each customer’s risk and match your controls to that rating
• Keep monitoring throughout the relationship, and report to AUSTRAC on time

To read the full guidance, visit AUSTRAC’s real estate program starter kit. For questions about your specific obligations, contact AUSTRAC directly, speak to your legal adviser, or simply get in touch with our team at APLYiD.