AML Compliance Guide
Log in Create Free Account

ML/TF risk assessment for Real estate agents — 2026 AUSTRAC Guide

If your real estate agency provides a designated service from 1 July 2026, you must complete a written money laundering, terrorism financing and proliferation financing risk assessment. For real estate agents, this is not a box-ticking exercise: AUSTRAC has already flagged the sector as high risk because property can be used to move, hide or legitimise illicit funds. If you do not do this properly, you risk breaching the AML/CTF Act, delaying your program, and exposing the business to civil penalties of up to $33.5 million per contravention.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

Your risk assessment is the foundation of your AML/CTF program. It must be a written document that identifies and rates the ML/TF risks your agency may reasonably face across 4 categories: your customers, the services you provide, the channels you use to deliver those services, and the countries involved. You must complete it before finalising your AML/CTF program, and it needs to reflect how your agency actually operates: residential sales, commercial sales, buyer-side work, auction campaigns, off-the-plan sales, remote onboarding, trust account interactions, and any involvement with overseas buyers or sellers.

What a real estate agency should do

  • Map which of your services are designated services. Do not assume every real estate activity is covered, but assess the ones that are before you start providing them.
  • List the customer types you deal with, such as individual vendors and buyers, companies, trusts, self-managed super funds, foreign purchasers, and buyers represented by relatives, lawyers or buyer’s agents.
  • Assess service risk by looking at matters such as high-value property, rapid on-sales, complex ownership structures, unexplained third-party funding, cash-heavy dealings, and purchases where the client shows little interest in price or inspection.
  • Assess delivery channel risk, including online-only onboarding, clients who refuse to meet in person, instructions through intermediaries, and identity documents provided remotely.
  • Assess geographic risk, including any links to high-risk jurisdictions, overseas source of funds, offshore entities, or cross-border payment arrangements.
  • Rate each risk, document why you gave it that rating, and use the results to build the controls in your AML/CTF program.

When you must update it

You cannot treat the first version as final. Update the risk assessment whenever your business changes materially, including when you introduce a new designated service, start dealing with different customer types, expand into new jurisdictions, increase remote transactions, or receive AUSTRAC risk information relevant to your agency. Keep version history, approval records, and notes showing who reviewed it and why.

For real estate agents, common mistakes are practical rather than legal. Agencies often copy a generic template, describe risks in vague terms, or ignore how deals are actually introduced and funded. Another common error is focusing only on the buyer. Your risk assessment should also consider vendors, beneficial owners behind companies and trusts, people giving instructions under power of attorney, and third parties contributing deposits or purchase funds. AUSTRAC guidance for the sector points to red flags such as luxury property purchases without inspection, complex loans from unclear sources, clients from high-risk jurisdictions, and clients who resist proving identity.

Practical ways to make it workable in an agency

  • Separate your risk assessment by transaction type, for example standard residential sale, prestige property, commercial property, and off-the-plan projects.
  • Use real examples from your pipeline when rating risks, such as foreign purchaser matters, company buyers, trust-owned property, or sales settled with unusual funding arrangements.
  • Involve the principal, sales manager and trust account or operations staff so the document reflects how deals are won, onboarded and settled.
  • Record review triggers in advance, such as expansion into interstate project marketing, more remote client onboarding, or a rise in overseas counterparties.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I need a risk assessment if my agency only sells ordinary residential homes?
Yes, if you provide a designated service. Standard residential sales can still present ML/TF risk, especially where funds come from third parties, companies, trusts, overseas sources or unexplained loans. Your assessment may conclude some matters are lower risk than prestige or complex commercial transactions, but you still need the written assessment.
Can I use an industry template and just add my logo?
No. A template can help you start, but the final document must be tailored to your agency’s actual customers, property types, onboarding methods and geographic exposure. A generic assessment that does not reflect your business is one of the clearest signs the obligation has not been met properly.
What if I do not deal with overseas clients at all?
You should still record that in the assessment rather than ignoring geography. Geography is one of the required risk categories, and you need to state whether your exposure is low, why that is the case, and what would trigger reassessment if that changes. For example, project marketing, interstate referrals or online enquiries may change your risk profile quickly.
Does this risk assessment have to be done before I enrol with AUSTRAC?
No. AUSTRAC enrolment is a separate first step and must be completed by 29 July 2026 for newly regulated businesses, or within 28 days of first providing a designated service if you start later. The risk assessment must be completed before finalising your AML/CTF program, and that program must be finalised by 31 December 2026.
How much should a small suburban agency expect to spend on this?
The law does not set a required spend. A small agency may prepare its own assessment if the principal understands the designated services, the customer base and the property-related red flags, but many agencies will pay for advice or a tailored framework to save time and avoid gaps. The key issue is not cost; it is whether the document is accurate, written, reviewed when the business changes, and usable by your staff.

Related guides