In this article
Kooky
Builder of Shaka, the payment router that pays every agent their commission on closing date.
About Kooky and Shaka →Since 1 July 2026, a Queensland real estate agency that brokers the sale or purchase of property has been a reporting entity under the federal Anti-Money Laundering and Counter-Terrorism Financing Act 2006. The public sees one part of that: being asked for identification. Behind the counter sits a larger requirement, a written program that explains how the agency understands and manages the risk that its services could be used to launder money.
This guide is about that program: why property is treated as a risk, which agency activities are covered, and what the law expects the document and the people behind it to do. It is written for principals, for staff who have been handed the job, and for clients who want to understand why the questions are asked. It follows the published summaries of the AML/CTF Rules 2025, the Real Estate Institute of Queensland's toolkit and commentary from law and advisory firms. AUSTRAC's own guidance is the authoritative source, and nothing here replaces it or independent advice.
Sources: AUSTRAC summary of obligations; First AML's summary of the AML/CTF Rules 2025.
Why property is treated as a laundering risk
Money laundering is the process of making the proceeds of crime look legitimate. Property suits it for reasons that have nothing to do with the honesty of the industry. A home holds a large amount of value in a single asset. It tends to keep that value. It can be bought in the name of a company or a trust, so the person who benefits need not appear on the title. It can be rented, which produces income with an innocent explanation. And once it is sold again, the proceeds arrive from a solicitor's trust account with every appearance of being clean.
Related readMoney sent to the wrong account: the first hours and who to tellAUSTRAC's national risk assessment in 2024 rated the domestic real estate sector as a "very high and stable" money laundering vulnerability, according to a bulletin on the reforms published by the advisory firm KordaMentha. The same bulletin reports that real estate made up 65 per cent of the $352 million in assets restrained by the Australian Federal Police in the year it examined. The compliance firm VinciWorks, writing on the day the regime began, cites an AUSTRAC estimate that more than $1 billion is laundered through Australian property each year.
Banks have been covered by the law since 2006. The professions that arrange property transactions were not, which left a gap between the first conversation about a purchase and the moment a bank saw the money. The agent is often the first professional to meet a buyer and to hear how they intend to pay. That position is the reason the law now reaches the agency.
Which agency activities are covered
The regime attaches to services, not to licences. KordaMentha's bulletin lists the designated services for the sector: brokering the sale, purchase or transfer of residential or commercial property on behalf of a client; selling property directly as a developer, including house-and-land packages and off-the-plan apartments, where no independent agent is involved; and acting for a buyer to find or source property.
The same bulletin lists what is left out. Property management, residential tenancy agreements and commercial leasing are not designated services. Auctioneering alone is not, unless it is combined with brokering the sale. A private sale between two people without an agent is outside the regime altogether.
Related readPayment redirection scams in property sales: the checks that stop themFor a typical Queensland agency this splits the office. The sales team is covered and the rent roll is not. An agency that only manages rentals has no program to write. An agency that does both needs a program for the sales side, and has to be able to tell the two apart in its own records.
The customer is defined widely. A selling agent's customers are the seller, from the time of appointment, and the buyer, from the time a contract is signed. Both must be identified. A buyer's agent's customer is the buyer who engages them.
The risk assessment comes first
The program rests on one document: the agency's own assessment of its money laundering and terrorism financing risk. First AML's summary of Part 5 of the AML/CTF Rules 2025 puts it first for a reason. The policies that follow have to respond to the risks the assessment finds, and a program copied from another business without that step does not meet the rule.
The assessment asks where this agency, in particular, could be used. The law firm Coleman Greig describes the framework as risk-based, weighing the type of customer, the places involved, the complexity of the transaction and the source of the money. KordaMentha frames the same factors as customer types, the way services are delivered and the jurisdictions involved.
In practice an agency looks at questions such as these. Who are the customers: mostly local owner-occupiers, or a larger share of companies, trusts and overseas buyers? How are they met: across a desk, or entirely by email through an intermediary? What is sold: suburban houses, or off-the-plan stock and prestige property bought sight unseen? Is cash ever received? The answers differ between a two-person office in a regional town and a project marketing firm on the Gold Coast, and the law expects the programs to differ too.
Related readProperty spruikers in Queensland: seminars, commissions and the rulesThe assessment is not written once. It has to be reviewed when the business changes, for example when it starts selling a new kind of property or dealing with a new kind of customer, and when a review or evaluation finds a weakness.
The policies a program must set out
The second part of the program is the set of written policies, procedures, systems and controls that manage the risks identified.
| Area | What the program must provide for |
|---|---|
| Risk assessment | Where the agency could be exploited, kept up to date |
| Customer due diligence | Identifying customers at the start, and again when circumstances change |
| Sanctions | Not providing services to sanctioned people or entities |
| Senior approval | Sign-off for higher-risk customers, including foreign politically exposed persons |
| Governance | A compliance officer who reports to management at least once a year |
| People | Due diligence on staff in AML roles, and training suited to their work |
| Review | Independent evaluation at least every three years |
| Reporting | Accurate reports to AUSTRAC, and no warning to the customer |
A summary, not the text of the Rules. AUSTRAC's guidance sets out each requirement in full.
Customer due diligence is the largest of these. The policy has to say what the agency collects from an individual, a company and a trust, how it verifies it, and when. For property transactions the Rules deal with timing directly. First AML's summary says the customer's identity must be verified before settlement, with provision for relying on another regulated business, such as a law firm, under a written agreement.
The policy also has to cover what staff do when something does not fit. Customer due diligence is described in the Rules as initial and ongoing. If a buyer who was identified as an individual later asks for the contract to be put in the name of a company, the agency's picture of its customer has changed and the checks follow.
The program must be in writing before the agency provides a designated service. According to First AML's summary, changes to it must be documented within 14 days.
The compliance officer and senior management
Every reporting entity must appoint an AML/CTF compliance officer. The Rules require that person to be fit for the role. First AML summarises the test as appropriate skills, integrity and the absence of a disqualifying history.
Related readRental scams in Queensland: the warning signs before you pay a bondIn a small agency the compliance officer will often be the principal or the office manager. The role is not ceremonial. The officer oversees the program day to day, is the person AUSTRAC writes to, and must report to the agency's governing body, at least annually, on whether the policies are being followed, whether the risks are being managed and whether the business is complying with the law.
Responsibility does not stop with the officer. Certain decisions require approval by a senior manager: taking on a customer who is a foreign politically exposed person, or a domestic one assessed as high risk, and entering an arrangement to rely on another business's customer checks. And where an independent evaluation finds a deficiency, the governing body must see that it is dealt with promptly.
The effect is that the principal of an agency cannot delegate the program and forget it. The law places the compliance officer inside the business and makes the people who run the business answerable for what the officer tells them.
Training and the people who do the work
A program is carried out by salespeople and administrators, most of whom did not enter real estate to assess financial crime risk. The Rules require training that is tailored to the work a person does and that teaches practical recognition of risk, not only the existence of the law.
For a sales agent, that means knowing what to collect, when to collect it, and what kinds of circumstances should be passed to the compliance officer. For reception and administration staff it means knowing how identity documents are handled and stored. The Rules also require due diligence on the people who hold AML roles in the business.
Related readTitle fraud: how Queensland's register protects an owner's homeThe Real Estate Institute of Queensland ran a twelve-stop roadshow across the State in February and March 2026 to prepare members, and published a toolkit that arranges the work in four phases: preparing, customising a program before 1 July, using it from that date, and maintaining it. The toolkit calls itself "a map, not advice". AUSTRAC, for its part, has published starter program kits for small businesses in each new sector, which Coleman Greig notes have been available since December 2025.
What has to be reported to AUSTRAC
Three kinds of report matter to an agency.
A suspicious matter report is made when the agency suspects on reasonable grounds that a customer, or a transaction, may be connected with crime, tax evasion, the proceeds of crime or terrorism financing. Coleman Greig points out that the duty applies even where the transaction does not go ahead. The Act sets the deadlines: three business days after the suspicion is formed, or 24 hours where the suspicion relates to terrorism financing.
A threshold transaction report is made when the agency receives $10,000 or more in physical currency in a transaction. Under the Act it is due within ten business days. Cash at that level is uncommon in Queensland residential sales, where deposits are paid by transfer into a trust account, and that is part of why a customer who insists on paying in cash stands out.
The annual compliance report is a return about the agency's own program. KordaMentha gives the usual due date as 31 March.
An agency cannot tell a customer that it has made a report
The Act makes it an offence to disclose that a suspicious matter report has been or may be made, where that could prejudice an investigation. The Rules require the program to include a policy that prevents customers being warned. Staff who raise a concern internally say nothing about it to the customer.
A suspicious matter report is not an accusation, and the agency is not asked to investigate. It records what was observed and why it seemed unusual. What happens next is for AUSTRAC and its partner agencies. VinciWorks reported that AUSTRAC confirmed receiving its first suspicious matter report under the expanded regime on the morning of 1 July 2026.
Related readMoney held by a Queensland agent: trust accounts and the claim fundThe circumstances a program asks staff to notice
Guidance for the sector describes the indicators at a general level, and they are matters of ordinary observation. The purchase does not fit what is known about the buyer's means. The buyer shows no interest in the property itself, its condition or its price. Funds come from a third party with no evident connection to the buyer, or from several sources in a way that has no obvious purpose. The ownership structure is more complicated than the purchase seems to need. A customer is reluctant to provide identification, or wants the name on the contract changed at a late stage without a clear reason. Someone proposes to pay a large amount in cash.
None of these is proof of anything. Each has innocent explanations: parents help children buy, families use trusts, and people change their minds about whose name goes on a title. The program's job is to make sure the circumstance is noticed, that a sensible question is asked, that the answer is recorded, and that anything left unexplained reaches the compliance officer.
Records, review and independent evaluation
Records are how an agency shows that its program is real. The Act requires records of customer identification and of transactions to be kept for seven years. Coleman Greig describes the documents that support identification, due diligence decisions and the risk assessment as what an agency will need to produce in an AUSTRAC review.
The program must also be tested from outside. First AML's summary of the Rules gives the interval as an independent evaluation at least every three years. The evaluator must be independent of the people who designed and run the program, and the findings go to the governing body, which must act on any deficiency.
For an agency that began on 1 July 2026, the first evaluation is therefore due no later than mid-2029. An agency that changes its business sharply before then, or finds its program is not working, would be expected to review sooner.
Enrolment sits alongside all of this. A business must enrol with AUSTRAC within 28 days of first providing a designated service. For an agency already selling on 1 July, that makes the deadline 29 July 2026.
How AUSTRAC says it will supervise
The Act carries heavy civil penalties, expressed in penalty units, of up to 100,000 units for a company and 20,000 for an individual for a serious contravention. Those ceilings apply to every reporting entity, from the largest bank down.
AUSTRAC has described a different approach for small businesses in their first period. VinciWorks reported on 1 July that the regulator signalled its initial stance would be "pragmatic and proportionate", while making clear this is not a formal grace period. Its chief executive, Brendan Thomas, has said the expectation is compliance and the alternative is enforcement, and also that the agency has never penalised a small business for administrative mistakes.
Read together, the statements describe what a regulator looks for in a new sector: enrolment, a program that reflects the actual business, a named officer, staff who have been trained, and records showing the checks being done. The emphasis in the published commentary is on documented, genuine effort.
The identification a client is asked for is the visible part. The program is the reasoning behind it: what this agency thinks could go wrong, and what it does about it.
What clients can expect from an agency with a program
For a seller or a buyer, the program shows up in small ways. The agency asks for identification early. It asks who is behind a company or trust. Occasionally it asks where the purchase money is coming from. It may say that it cannot proceed until a check is complete.
These steps are required of every agency that sells property, in every State, for every customer. They are not a judgment about the person asked, and an agency cannot waive them for a familiar client. The REIQ's chief executive, Antonia Mercorella, described the change, when the Institute's roadshow was announced in February 2026, as substantial for how real estate businesses must operate. The purpose of the program is to make that change orderly: a known set of questions, asked the same way of everyone, with a record kept.
Kooky, from Shaka
Kooky edits Queensland Estate and builds Shaka, the payment router he made for Queensland property professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.
