Under the AML/CTF Tranche 2 reforms, Australian real estate agencies that sell, buy or auction property for clients became AUSTRAC reporting entities on 1 July 2026. AI helps agencies meet the new customer due diligence, monitoring and record-keeping obligations at transaction speed, provided every compliance decision stays with a trained person and identity data stays onshore.
This guide is written for principals, operations managers and compliance officers at multi-office agency groups and franchise networks. For the cross-sector overview of who is captured, see our companion piece on AML/CTF Tranche 2 for gatekeeper firms. Here we focus on where the obligations touch an agency's daily workflow and where AI reduces the load without creating audit exposure. This is general information, not legal advice.
Key takeaways
- Selling agents providing designated services under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 are now regulated by AUSTRAC. New reporting entities must enrol within 28 days of first providing a designated service.
- Customer due diligence (CDD) is cheapest when it starts at listing or offer stage. Late verification delays settlements or gets skipped, which is the failure the regime penalises.
- AI can extract and structure identity data, flag beneficial ownership questions, keep risk pictures current and draft suspicious matter reports. A person makes every decision.
- Tranche 2 makes agencies hold more personal information for seven years, so any AI tool must not train on that data and should process it in Australia.
What does AML/CTF Tranche 2 ask a real estate agency to do?
Strip away the acronyms and the obligations become a workflow overlay on the sales process. AUSTRAC expects a captured agency to:
- enrol as a reporting entity
- maintain a documented AML/CTF program
- appoint an AML/CTF compliance officer
- train its staff
- perform customer due diligence, including ongoing and enhanced due diligence where risk is higher
- report suspicious matters
- keep records for seven years
For an agency group with several offices, the hard part is consistency. Every office, every sales team and every agent has to apply the same process, and the evidence has to land in one place.
Which activities does your business perform for clients?
- Selling or auctioning residential, commercial or rural propertyIn scope: selling-agent designated services apply
- Buyer's agent acting to purchase property for a clientIn scope: assess each designated service
- Property development selling directly to purchasersLikely in scope: confirm against AUSTRAC guidance
- Property management and leasing onlyDifferent treatment: confirm current scope carefully
- UnsureDocument the assessment and seek advice
CDD has to happen at the right point in a transaction. You need to identify and verify the parties, understand beneficial ownership where a buyer or seller is a company or trust, and stay alert to patterns that make a transaction suspicious. Do it badly and you either slow every sale or miss the risks the regime exists to catch.
Where does AI help a real estate agency with Tranche 2?
AI adds value in three parts of the compliance workflow: due diligence, monitoring and reporting, and record keeping.
Customer due diligence at transaction speed
CDD inserts an identity step into a process clients expect to be fast. AI-assisted CDD handles the repetitive parts: extracting details from identity documents, checking them for consistency, structuring the information into the record your program requires, and flagging where beneficial ownership needs to be worked through because a party is a company or trust.
- CollectCapture party details at listing or offer stage
- VerifyAI checks ID consistency, structures the record
- AssessFlag higher-risk factors for human review
- RecordStore to a seven-year, audit-ready trail
The boundary is firm: AI structures and flags, a person decides. Whether a customer's identity is satisfactorily verified, or a transaction warrants a closer look, is a compliance judgement for your compliance officer. "The software cleared it" is no substitute for a documented risk decision. Used well, AI removes the data assembly so your people spend their compliance time on judgement calls.
Transaction monitoring and suspicious matter drafting
Sales staff are not trained financial-crime analysts, so suspicious matter reporting is where many agencies feel least confident. AI can surface patterns that commonly warrant attention (unusual payment structures, reluctance to provide identity information, transactions that do not fit a client's stated circumstances) and draft the factual basis of a report for a person to review, correct and decide on.
The decision to lodge a suspicious matter report, and its final content, rests with a person. A clear factual first draft turns a blank-page task into a review task.
| Manual Only | AI-Assisted, Human-Decided | Impact | |
|---|---|---|---|
| Identity data capture and structuring | Rekeyed by hand per party | Extracted and structured | Less rekeying |
| Beneficial ownership on company/trust buyers | Ad hoc, easily missed | Systematically flagged | More consistent |
| Suspicious matter drafting | Blank page, low confidence | Factual first draft to review | Faster, clearer |
| The reporting decision itself | Compliance officer | Compliance officer | Unchanged by design |
Client communication
Tranche 2 adds questions to the client experience. Buyers and sellers will ask why they suddenly need to provide identity documents. Consistent, approved explanations sent at the right stage, plus clear routing of genuine compliance questions to the compliance officer, keep the process moving without every agent improvising answers.
Why does the sequence of due diligence matter?
Consider a 12-office agency group listing residential and commercial property. The temptation is to treat Tranche 2 as a settlement-day checklist. That is the expensive path: late verification either delays settlement or gets skipped under time pressure. Failure to enrol, or to meet core obligations, is a civil penalty matter under the AML/CTF Act.
- CDD started at listing/offer stageAbsorbed into flow
- CDD attempted at settlementDelays and rework
- Net effect of early, AI-assisted CDDFewer settlement delays
This framing is directional. The principle holds: obligations are cheaper to meet when verification is built into the start of a transaction, and AI is most valuable when it makes early verification fast enough that staff actually do it.
How does AI support ongoing due diligence and staff capability?
Ongoing and enhanced due diligence. Verification is not a one-time gate. Your program must account for higher-risk situations that call for enhanced due diligence, such as a party connected to a higher-risk structure, a politically exposed person, or circumstances that do not add up. AI keeps the risk picture current, re-checking parties against updated information and flagging when a routine relationship starts to look different, so enhanced scrutiny is triggered by evidence.
Staff capability. Tranche 2 assumes trained staff. AI supports consistency by prompting the right questions, structuring the record and reducing the chance a busy agent skips a step. It does not discharge your training obligation, and it must never let untrained staff offload judgement onto a tool they do not understand. The design principles for keeping a person in control are covered in our guide to AI agent governance and human override.
What are the privacy risks of using AI for AML compliance?
Tranche 2 requires agencies to collect and retain more personal information than ever, including identity documents kept for seven years. That data is governed by the Privacy Act 1988 and the Australian Privacy Principles, and any AI that processes it inherits those obligations.
Two questions decide whether a tool is safe:
- Does it train on the identity data you feed it?
- Where is that data stored and processed?
An overseas tool that learns from your inputs is a privacy and data sovereignty problem before it is an efficiency gain. Our guide to Privacy Act compliance for AI sets out the vendor questions to ask, and our private AI infrastructure work keeps processing on your own infrastructure in Australia.
Deploying AI across customer verification without a documented position on what the tool does, on what data, with what oversight, is itself a weakness an examiner can probe. A short governance document lets you explain your controls rather than point at software.
Why is seven-year record keeping a systems problem?
AML/CTF records, including identity information and the reasoning behind compliance decisions, must be retained for seven years in a form that survives an AUSTRAC inspection. In agency groups, verification records tend to accumulate in whichever inbox, drive or phone was nearest at the time.
The failure mode is predictable: the verification was done correctly, but two years later nobody can produce the evidence, and an examiner cannot distinguish lost paperwork from work never done. AI helps by capturing verification into a structured, searchable record at the moment it happens. Building that into your CRM and trust accounting workflow from day one is far cheaper than retrofitting it. This is where system integration earns its keep.
A realistic readiness path for agencies
- Step 1Scope and enrolConfirm designated services, enrol with AUSTRAC, appoint a compliance officer
- Step 2Program and trainingDocument the AML/CTF program, train sales and support staff
- Step 3Embed CDD earlyMove verification to listing/offer stage with AI-assisted capture
- Step 4Monitor and reportOngoing monitoring, AI-drafted reports, human decisions
The sequence is obligation first, AI second. You cannot automate your way out of enrolling, appointing a compliance officer or writing a program. AI makes the recurring work (verification, monitoring, report drafting) fast enough to run inside a busy agency group. If your group also handles settlement-adjacent work, see our guide to AI for conveyancers and property settlements.
What are the honest limitations?
AI does not make an agency compliant, and any vendor implying otherwise is selling risk.
- Every decision with legal weight (verifying identity, deciding a matter is suspicious, lodging a report) needs genuine human judgement, because that is what AUSTRAC examines.
- AI trained on the wrong data, or hosted in the wrong place, turns a compliance tool into a privacy breach.
- Output quality depends on input quality. Rushed, incomplete client records produce confident but unreliable results.
Within those limits the fit is strong. Tranche 2 imposes repetitive, high-volume, judgement-adjacent work where AI lifts a trained team. For the reporting side, see automated compliance reporting.
How Solve8 can help
We build CDD capture, monitoring and record-keeping workflows that run on your infrastructure in Australia and connect to the CRM and trust accounting systems your offices already use, with your compliance officer approving every decision. See our process automation service or talk to us about your Tranche 2 workflow.
