AML/CTF Tranche 2: what buyer's agents must do
AUSTRAC's AML/CTF Tranche 2 reforms commenced 1 July 2026. If you're a buyer's agent, you are a reporting entity — there's no sole-trader exemption, no size threshold that gets you out of it, and no grace period left to run out. This page is what the obligation actually asks of you, written for a buyer's agent specifically, not adapted from generic "real estate agent" guidance written for the selling side.
Why buyer's agents specifically — and not just "real estate agents"
Most Tranche 2 material is written from the selling agent's seat: verify the vendor, verify the buyer, watch the transaction. A buyer's agent's designated service is different — you act for the buyer. Your customer, for AML/CTF purposes, is the client who engaged you, not whoever's selling the property. That's who your CDD obligation actually runs against, and it starts at the relationship, before you've found a property, not at settlement.
Are you actually captured?
If you provide a designated service as a real estate professional — and acting for a buyer in a property transaction is one — you're a reporting entity under the AML/CTF Act. AUSTRAC has been explicit that this applies regardless of firm size: a solo buyer's agent with one client has the same obligations as a large agency, just scaled to a smaller program.
The four things AUSTRAC requires
- An AML/CTF program. A documented, risk-based program describing how you identify, manage and mitigate money-laundering and terrorism-financing risk in your business. This has to exist before you provide a designated service — not be backfilled after the fact.
- Enrolment with AUSTRAC. The enrolment window opened 31 March 2026; if you were already providing designated services when obligations commenced, you needed to be enrolled by 29 July 2026. If that deadline has already passed you and you haven't enrolled, that's the first gap to close — before anything else on this list.
- AML/CTF training for your team. Anyone client-facing or handling CDD needs training on their obligations and on recognising suspicious activity, kept current, not a one-time induction.
- Ongoing customer due diligence. Verify who your client actually is, assess the risk they present, and keep that assessment current for the life of the relationship — not just at onboarding.
What CDD actually looks like for a buyer's agent
Verify your client before you start acting for them — before the agency agreement, not after you've already found them a property. That means confirming who they are (identity documents), understanding the ownership structure if they're buying through a company or trust, and forming a view on the source of the funds where the risk profile calls for it. Where your client presents higher risk — a complex or offshore ownership structure, cash-heavy funding, urgency with no explanation — the obligation is enhanced due diligence, not a lighter touch.
The trigger for AUSTRAC reporting is suspicion, not proof. You don't need to be certain something is wrong to have an obligation — you need reasonable grounds to suspect it.
When something looks wrong
If you form a reasonable suspicion — about identity, about the source of funds, about anything that points toward money laundering or terrorism financing — you have a Suspicious Matter Report obligation to AUSTRAC. The deadline is short: 3 business days for most matters, 24 hours if terrorism financing is suspected. And critically: you cannot tell your client, or anyone else, that you've filed or are considering filing one. That's the tipping-off prohibition, and breaching it is a separate offence on top of whatever the underlying matter was.
What happens if you don't
AUSTRAC has been clear this isn't a soft launch. Providing a designated service without an AML/CTF program in place carries civil and criminal penalties, and AUSTRAC has shown it will act against businesses of all sizes — not just the large end of the market. "We'll get to it" stopped being a viable position on 1 July 2026.
The quick version
- Confirm you're enrolled with AUSTRAC. If you're not, that's today's task.
- Have a written AML/CTF program, even a lean one, before you take on your next client.
- Verify your client's identity — and beneficial ownership, if they're buying through an entity — before you start acting for them.
- Keep every record for 7 years: who you checked, what you found, when, and what you decided.
- Know the SMR trigger is suspicion, not certainty — and that you can't tell the client if you file one.
Where Trace fits
Trace is the record-keeping layer for this, not the compliance engine. It doesn't certify anyone's identity, doesn't run its own sanctions database, and doesn't lodge anything with AUSTRAC on your behalf — the obligation, and the judgment call, stays yours. What it does is keep the CDD you've captured attached to the client and the deal it belongs to, with a tamper-evident trail of who checked what and when, so six months from now "did we check that" has an answer that isn't your memory.
A generic CRM has no concept of any of this — it wasn't built to. See how Trace compares to a CRM. Dedicated AML/CTF platforms do the regulatory work properly, and they're a different question again: here's where they stop and Trace starts. And if it's specifically the audit-trail question keeping you up — can you prove nobody edited a CDD record after the fact — that's covered in more depth here.
Apply for a founding partner spot
This page is general information, not legal or compliance advice, and it isn't a substitute for AUSTRAC's own guidance or your own AML/CTF adviser. Tranche 2 obligations and AUSTRAC's guidance can change — confirm your position with a qualified adviser before you rely on anything here.