Sunline Realty Pty Ltd

1AML/CTF Gap Analysis

Every pack opens with this document, written about your business: where you stand against each obligation, the dates derived from your own answers, what is still needed from you, and what to do first. This is the fictional firm’s, exactly as the engine generated it.

Sunline Realty Pty Ltd

What you have, what you are missing, and what to do first

DRAFT FOR REVIEW — not yet in force.

Prepared by Deplexify for Sunline Realty Pty Ltd from the answers given in the engagement questionnaire. This is a draft. Priya Raghavan should read it in full and test it against how the business actually operates, and Grant Alderton must approve it in writing under s26P before it takes effect. We prepare the documents; the reporting entity adopts them as its own.

This is not legal advice. We are not your AML/CTF compliance officer — AUSTRAC permits that person to be external to the business, but it is a standing appointment carrying personal statutory duties and it is not a role we take on. Having prepared these documents we are also disqualified from performing the independent evaluation of them, so that is always a referral.

Anywhere you see Needed from you, we need that answer from you before the document is complete.

1.1Where you stand

The core gap. You do not yet have an ML/TF risk assessment or written AML/CTF policies. Under s26E the risk assessment must be in place before you provide a designated service, and s26G requires you to comply with policies you have not yet written. This pack is the draft of both — the remaining work is your review, your amendments, and a senior manager's written approval.

1.2Your dates — derived from your own answers

These are not generic deadlines. Each one below is calculated from something you told us, and the calculation is shown so you can check it.

• AML/CTF compliance officer notification. You enrolled on 22 July 2026. The compliance officer notification deadline is the later of 29 July 2026 or 14 days after enrolment (5 August 2026) — so 5 August 2026. You notified AUSTRAC on 14 August 2026, which was after that date. Record the reason and make sure your enrolment details are now correct.

• First independent evaluation: 31 December 2030. Your AUSTRAC Account Number ends 67 — second-last digit even, last digit odd — and the transitional rules stagger first evaluations on exactly that basis. This is the date most newly regulated businesses do not know they have. AUSTRAC suggests going earlier, partly because suitably skilled evaluators will be easier to find before the deadline crowd.

• First annual compliance report. Reporting runs on financial years, not on your enrolment anniversary. The period 1 July 2026 to 30 June 2027 is filed between 1 July 2027 and 30 September 2027 (not yet open).

1.3Matters live on your books now

You told us about 4 live matters. Customer due diligence is confirmed complete and recorded on 1 of them.

Priority — customer due diligence not confirmed complete. For each of these the designated service has already started, so the obligation has already attached. This is the most urgent thing in the pack.

We could not classify these. Each needs a role — seller's agent, buyer's agent, developer or professional — because that decides when the designated service started and therefore whether anything is overdue. We are not going to guess in either direction: calling a compliant matter overdue is as wrong as missing a real one.

• Warehouse, 4 Freight Street, Northgate — Needed from you: what was your role?

1.4Could you use AUSTRAC's free starter kit instead?

AUSTRAC publishes a free, editable AUSTRAC real estate program starter kit — a risk assessment, a policy document, a process document and around 25 forms. You should know it exists, and if you qualify it is a legitimate place to start. But eligibility is narrow, and AUSTRAC is blunt about what happens if you do not meet every criterion: "You cannot rely on the starter kit to meet our regulatory expectations."

Tested against your answers:

You do not meet 2 criteria, so you cannot rely on the kit — AUSTRAC says so directly. Specifically: 15 or fewer personnel; does not broker overseas property.

If you have already built from the kit, that is a specific and nameable gap rather than a general worry, and it is one an evaluator will find quickly.

1.5What your risk assessment found

In full in 01_Risk_Assessment, with the derivation behind every rating. In short:

Overall inherent risk: High. The highest factor carries the overall rating — averaging would let a single high factor disappear behind lower ones, and it is the high one that has to be controlled.

1.6Policy areas you told us are not yet in place

11 areas where you told us there is currently nothing, or nothing written down. Each is drafted for you in 02_AMLCTF_Program:

• Spotting significant changes — Nothing formal. New services get discussed at the monthly directors' meeting but there is no link to a risk assessment because there isn't one.
• Reviewing and updating your policies — nothing recorded.
• Sanctions screening — Not done.
• Senior approval for certain customers — Salespeople onboard their own vendors. Nothing is escalated as a matter of course.
• Travel rule monitoring — Not applicable as far as we know — no transfers of value pass through the agency.
• Checking information someone else collected — We assume the purchaser's solicitor has done their own checks. We have never asked to see them.
• Suspicious matter reporting — Nobody has ever made a suspicious matter report. Staff would raise something with the Licensee in Charge but there is no form, no record, and no guidance on tipping off.
• Spotting politically exposed persons — No screening. The one PEP we are aware of was recognised by a salesperson who knew the name.
• Ongoing customer monitoring — nothing recorded.
• Training your people — The Licensee in Charge talked the team through the reforms at a sales meeting in June 2026. No materials, no attendance record.
• Checking the people you hire — New salespeople are checked for a current licence and a reference is taken from their previous agency. Nothing is written down, and administrators are not checked at all.

1.7What we still need from you

• The matters live on your books now — confirm whether the agency signed a buyer's agreement here or was introduced by the Singapore agent — the answer changes when the service started

1.8What we have flagged rather than guessed

Points we would not state without confirming them first. They are checked and completed before the pack is finalised.

• Your AML/CTF compliance officer — whether a police check and open-source search were completed and recorded at appointment, or only the licence check
• What you do for clients — the property management scope conclusion before the pack is finalised

1.9What to do first

1.10What this engagement does not cover

• Enrolment. The transitional window closed on 29 July 2026. If you are not enrolled, do it directly in AUSTRAC Online — the standing rule is 28 days from first providing a designated service, and being enrolled late is a far better position than not at all.
• Acting as your AML/CTF compliance officer. AUSTRAC permits an external officer; it is not a role we take on.
• Your independent evaluation. Having written these documents we are disqualified from evaluating them. We will refer you.
• Running your customer due diligence. We write the procedures; your people run them.
• Legal advice. This is document preparation, led by a Chartered Accountant.

Sources

Prepared from the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (in-force compilation C62, register ID C2026C00274, in force 1 July 2026) and from guidance published by AUSTRAC. AUSTRAC-produced material is © AUSTRAC for the Commonwealth of Australia and is reused under Creative Commons; Commonwealth legislation is reproduced from the Federal Register of Legislation. Deplexify is not affiliated with, endorsed by, or acting on behalf of AUSTRAC.

• AUSTRAC — real estate designated services
• AUSTRAC — real estate program starter kit
• AML/CTF Act 2006, in-force compilation
• AUSTRAC — your AML/CTF program

2Money Laundering and Terrorism Financing Risk Assessment

Sunline Realty Pty Ltd

Prepared under section 26C of the AML/CTF Act 2006 — real estate agency

DRAFT FOR REVIEW — not yet in force.

Prepared by Deplexify for Sunline Realty Pty Ltd from the answers given in the engagement questionnaire. This is a draft. Priya Raghavan should read it in full and test it against how the business actually operates, and Grant Alderton must approve it in writing under s26P before it takes effect. We prepare the documents; the reporting entity adopts them as its own.

This is not legal advice. We are not your AML/CTF compliance officer — AUSTRAC permits that person to be external to the business, but it is a standing appointment carrying personal statutory duties and it is not a role we take on. Having prepared these documents we are also disqualified from performing the independent evaluation of them, so that is always a referral.

Anywhere you see Not yet verified, we have deliberately not stated something we could not confirm from a primary source, and it is checked and completed before the pack is finalised — never guessed.

2.1Purpose and statutory basis

Section 26C requires a reporting entity to undertake an assessment of the money laundering and terrorism financing risks it may reasonably face. Under s26E that assessment must be in place before designated services are provided, and under s26F the AML/CTF policies must be built on it. That ordering is the whole architecture: a control that does not answer a risk identified here has nothing holding it up, and a risk identified here with no control against it is an open gap. This document is therefore the foundation, and it is the document an evaluator reads first.

The assessment must cover both the services you provide and those you plan to provide, and must consider four mandatory risk factors:

1. the kinds of designated services you provide, including any new or emerging technologies related to them
2. the kinds of customers you have
3. your delivery channels, including new or emerging technologies in how services reach customers
4. the countries you deal with

Two further inputs are mandatory: any planned services, customers, channels or countries that could increase risk, and information communicated by AUSTRAC about ML/TF risks relating to your designated services. Sections 7 and 8 deal with those.

AUSTRAC also names two factors that must be considered as a starting point, and says that failing to consider them makes non-compliance likely: whether the services involve high-value transactions, and whether they involve legal structures or arrangements that help customers stay anonymous or disguise source of wealth or funds. Both are built into the derivation rules used throughout this document, and both appear by name in the derivation log at Appendix A.

On method. AUSTRAC's expected method is identify → assess → (optionally) evaluate, and it expects the assessment to cover inherent risk — risk before controls — because that is what makes it possible to demonstrate that the policies actually address the risks. Residual risk assessment is optional. This document therefore rates inherent risk throughout, and offers residual only as a clearly-labelled overlay in section 9.

There is no Part A and no Part B. That structure was replaced by the 2024 reforms. Your AML/CTF program is this risk assessment plus the AML/CTF policies built on it, and independent evaluations now cover the whole program rather than a Part A.

2.21. Nature, size and complexity of the business

AUSTRAC requires four things to be appropriate to the nature, size and complexity of the business: the steps taken to complete this assessment, the AML/CTF policies, the internal reviews of this assessment, and the frequency and conduct of independent evaluations. This section is what the word 'appropriate' is measured against everywhere else in the pack.

How the business actually works. Twenty-two staff across two offices, split between a residential sales team of fourteen and a commercial team of five, with three administrators. Listings are won by individual salespeople who manage their own vendor relationships end to end; the Licensee in Charge sees the agency agreement at signing but not every subsequent step. Deposits are received into a single agency trust account administered centrally at Fortitude Valley. Because salespeople work across two sites and largely autonomously, the compliance officer cannot personally review every transaction and would have to rely on escalation and file sampling.

What that size means for risk. At this size the compliance officer cannot personally see every matter, so the controls in the program rely on escalation routes, file sampling and training rather than direct oversight. That is a deliberate design choice and the sampling approach is stated in the program so it can be evaluated.

2.32. Designated services

Mandatory risk factor 1 — Table 5 (Act s6).

Residential and commercial sales across inner-northern Brisbane, acting for vendors under exclusive agency agreements and, in the commercial team, occasionally for buyers under a buyer's brief. The agency operates a trust account into which deposits are received. It also runs a residential property management portfolio, which the agency understands to sit outside the Table 5 designated services — recorded here so the question is visible rather than assumed. Not yet verified — the property management scope conclusion before the pack is finalised.

Real estate is a widely exploited asset type for money laundering in Australia… by changing property value to quickly launder money [and] using complex ownership structures to hide ownership of property.

— AUSTRAC, Step 2 — identify and assess your risks

RE1 — Brokering the sale, purchase or transfer of real estate

Table 5, item 1. Brokering the sale, purchase or transfer of real estate on behalf of a buyer, seller, transferee or transferor in the course of carrying on a business.

What counts as brokering. Broker means acting as intermediary or agent for another person for consideration, in the course of a business. The common indicator is negotiating on someone's behalf, or finding a counterparty, in return for commission. Consideration is not required for the transaction itself — brokering a transfer for no payment still counts.

Who your customer is. Both the seller or transferor AND the buyer or transferee. Obligations run to both parties of the same transaction, which is the single most commonly missed feature of item 1.

When the designated service starts — and therefore when customer due diligence falls due:

• Seller Agent — To the seller, when the agency agreement is signed. To the buyer, when the transaction is reasonably expected to proceed — typically when the offer is accepted and the contract signed.
• Buyer Agent — To the buyer, when the agreement to find a property is signed. To the seller, when the transaction is reasonably expected to proceed.

You sell by auction. The hammer-to-contract gap is the classic timing problem, and the answer is more precise than it is usually described. Delayed CDD under s29 is only available in circumstances specified in the AML/CTF Rules, and there is no auction-specific circumstance. What actually covers the auction case is Rules s6-32: where you have already commenced providing the item 1 service to the seller and the successful bidder becomes your customer, you may commence before completing CDD on them — and the period to finish ends at the earlier of 28 days after the exchange of contracts, or 3 days before the initially agreed settlement day. On a short settlement the second limb bites first. So this is a timing allowance with a hard, derivable deadline attached to the transaction, not a general allowance for auctions, and it does not permit money to move: it is initial CDD that is deferred, not the obligation.

Why risk arises here:

• Every transaction is high value by nature, so a single successful placement moves a large sum — AUSTRAC names high-value transactions as a mandatory starting-point factor.
• Obligations run to both sides, so the party the agency knows least about — the buyer — is as much its customer as the vendor it signed.
• Ownership can be held through companies, trusts and nominees, which is the second mandatory starting-point factor: structures that disguise who really owns the asset.
• Price is negotiable and partly subjective, so over- or under-valuing a property is a way to move value without moving cash.
• Funds usually arrive through a solicitor's or conveyancer's trust account, so the agency sees the transaction but not always the true origin of the money.

How this rating was reached.

Also considered and did not apply: You accept physical cash; You have received A$10,000 or more in physical currency; Your largest transactions are under A$250,000; You receive or hold client money beyond the transaction itself; You act on complex ownership structures regularly, and this service is where they are built; You deal in virtual assets; You sell property you own, through your own sales staff.

2.43. Customers

Mandatory risk factor 2.

You took on about 147 customers in the last year. By type:

The two customer features AUSTRAC singles out are politically exposed persons and structures that obscure who ultimately benefits. Both are counted above rather than described in general terms, because a number is auditable and an adjective is not.

How often you act on complex ownership structures: Occasionally — mostly corporate and trustee vendors on the commercial side

How this rating was reached.

Also considered and did not apply: PEPs are more than 5% of your customers; Trusts and foreign companies are a significant share of your customers; Non-resident customers are more than 10% of your customer base; You act on complex ownership structures regularly; You deal with higher-risk customers regularly; Almost all your customers are Australian-resident individuals.

2.54. Delivery channels

Mandatory risk factor 3.

How a customer reaches you decides how much of them you can actually see. Someone met in person, whose documents are handled directly, is a different proposition from someone onboarded entirely through a screen.

New and emerging technology. s26C requires new and emerging technologies to be assessed both as part of the designated services and as part of how those services are delivered, and s26D makes their introduction a review trigger — so this assessment must be updated when technology changes, not at the next anniversary.

Live trigger. You have introduced new technology or a new channel: A digital identity verification app adopted in March 2026 for vendors who cannot attend an office. It was adopted as a convenience measure and was not assessed as a compliance change at the time. Under s26D that is a review trigger, and where the change is within your control the review must happen before the change, not after it.

Reliance on others. You rely on someone else to identify or verify customers — in your words: Purchasers' conveyancers and solicitors for anything to do with the buyer side Written agreement in place: Yes. Reliance moves the work but never the obligation — see section 3 of the program.

How this rating was reached.

Also considered and did not apply: A customer can transact with you entirely remotely, with no human contact; Most customers are met in person; Online self-service is a leading channel; That reliance is not covered by a written agreement.

2.65. Countries

Mandatory risk factor 4.

Countries you deal with: Australia; Singapore; New Zealand

Banks and institutions in the chain: CBA — agency trust account and operating account. Purchaser funds normally arrive through the purchaser's solicitor's trust account; in two overseas-introduced transactions during the period, deposits came from offshore accounts.

Sanctions screening: No — No sanctions screening is carried out. Nobody has been made responsible for it.

How this rating was reached.

Also considered and did not apply: You deal with four or more foreign countries; You have connections to sanctioned or high-risk jurisdictions; You have not yet told us which countries you deal with.

2.76. Proliferation financing

s26F(1) and s26F(11).

Proliferation financing must be identified and assessed here and documented in the program even where it is low (s26F(1), s26F(11)). A specific proliferation financing policy is not required where the risk is reasonably assessed as low and existing policies manage it — but the assessment itself still has to exist in writing, which is why this section is here even for a purely domestic business.

How this rating was reached.

Also considered and did not apply: You have connections to sanctioned or high-risk jurisdictions; You act for customers involved in dual-use goods, defence, shipping or export.

Conclusion. Proliferation financing risk is assessed as low. On AUSTRAC's guidance a dedicated proliferation financing policy is not required at this level, provided the existing policies — sanctions screening in particular — manage it. That conclusion is recorded here so the program can point to it.

2.87. Planned services, customers, channels and countries

Mandatory input under s26C — and the one most often left blank.

The assessment must cover services you plan to provide, not only those you provide today, along with planned customer types, channels and countries that could increase risk. A plan disclosed here costs nothing; the same plan discovered by an evaluator in your board minutes, unassessed, is a finding.

The commercial team is exploring taking on off-the-plan project marketing for a local developer from early 2027. No decision made.

2.98. Information communicated by AUSTRAC

Mandatory input under s26C.

s26C requires this assessment to take account of information AUSTRAC communicates identifying or assessing ML/TF risks relating to your designated services — including information communicated to your sector generally, which under s26D is also a trigger to review this assessment.

Not yet verified — whether AUSTRAC has published a sector risk assessment or equivalent risk communication for real estate agencies as at 6 August 2026 is confirmed before this pack is finalised. We do not assert that one exists and we do not assert that none does. What is certain is the standing obligation: when AUSTRAC communicates risk information relevant to your services, this assessment must be reviewed and, where needed, updated.

Practical control. Keep the compliance officer's email address current in AUSTRAC Online — it is the address AUSTRAC uses — and record each AUSTRAC communication received and what was done about it. That record is the evidence that this input was considered.

2.109. Overall assessment

Overall inherent ML/TF risk: High.

The overall rating takes the highest factor rather than an average. Averaging would let a single high factor disappear behind lower ones, and it is the high factor that has to be controlled.

Residual risk — optional overlay

AUSTRAC does not require residual risk to be assessed; inherent risk is what the Act asks for. It is offered here because it is useful to the governing body, and clearly labelled as optional so nobody mistakes it for the statutory rating.

Proposed residual risk: High. Equal to inherent risk. 11 control areas in section E of your questionnaire are not yet in place, and a control that does not exist cannot reduce a risk. Once the policies in this pack are implemented and operating, this can be reassessed.

Compliance officer to confirm: are these ratings right for this business? You know things about your customers and your market that no questionnaire captures. Where you disagree, change the rating and record why — a rating you have reasoned about and adjusted is worth more than one you accepted, and the reasoning is what an evaluator actually examines.

2.1110. Keeping this assessment current

ss26D and 26E.

This assessment must be reviewed at least once every three years, and in addition whenever:

• there is a significant change to your designated services, delivery channels, customer types or the countries you deal with, or to related new or emerging technologies
• AUSTRAC communicates risk information, including to your sector generally
• an independent evaluation makes adverse findings about this assessment

Timing matters and cuts both ways. Where the change is within your control the review must happen before the change. Where it is not, it must happen as soon as practicable after. Adopting a new onboarding tool is within your control; a new AUSTRAC communication is not.

Any update needs senior manager approval, written notice to the governing body as soon as practicable, and documentation within 14 days. Your AML/CTF policies must be reviewed at least every three years as well, after any review of this assessment, and after adverse evaluation findings.

2.12Appendix A — Derivation log

Every rating in this document, the rule that moved it, and the questionnaire field that triggered the rule.

This appendix exists because a risk assessment that cannot show which of your answers produced a rating has not assessed anything — it has printed something. Section 26C requires an assessment of the risks this business may reasonably face, so the test of the document is whether different answers would have produced a different assessment. Here is the machinery, in full, so you and any evaluator can check that they would.

Rules tested that did not apply are listed under each rating in the body of the document. An assessment that shows what it ruled out is worth more to an evaluator than one that shows only what it found.

2.13Approval of this risk assessment

Section 26P requires the AML/CTF program to be approved by a senior manager in writing before designated services are provided, and s26N requires the approval to be documented. AUSTRAC expects the approval to record the approver's name, role and date. This block is that record — it is not a formality and the document is not in force until it is completed.

The ML/TF risk assessment must also be provided to the governing body (Board of three directors, meeting monthly), and any later update relating to new or significantly changed risks must go to them in writing as soon as practicable. Updates to this document must be documented within 14 days.

2.14Version control

Keep this table. s26N requires program updates to be documented within 14 days, and this is where an evaluator will look first for evidence that the program is maintained rather than written once.

Sources

Prepared from the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (in-force compilation C62, register ID C2026C00274, in force 1 July 2026) and from guidance published by AUSTRAC. AUSTRAC-produced material is © AUSTRAC for the Commonwealth of Australia and is reused under Creative Commons; Commonwealth legislation is reproduced from the Federal Register of Legislation. Deplexify is not affiliated with, endorsed by, or acting on behalf of AUSTRAC.

• AUSTRAC — real estate designated services
• AUSTRAC — real estate program starter kit
• AML/CTF Act 2006, in-force compilation
• AUSTRAC — your AML/CTF program

3AML/CTF Policies

Sunline Realty Pty Ltd

The second half of your AML/CTF program, built on your ML/TF risk assessment — prepared under section 26F of the AML/CTF Act 2006

DRAFT FOR REVIEW — not yet in force.

Prepared by Deplexify for Sunline Realty Pty Ltd from the answers given in the engagement questionnaire. This is a draft. Priya Raghavan should read it in full and test it against how the business actually operates, and Grant Alderton must approve it in writing under s26P before it takes effect. We prepare the documents; the reporting entity adopts them as its own.

This is not legal advice. We are not your AML/CTF compliance officer — AUSTRAC permits that person to be external to the business, but it is a standing appointment carrying personal statutory duties and it is not a role we take on. Having prepared these documents we are also disqualified from performing the independent evaluation of them, so that is always a referral.

Anywhere you see To be confirmed, the point is not settled yet; it is listed in your gap analysis and completed before this document is approved. Anywhere you see Not yet verified, we have deliberately not stated something we could not confirm from a primary source, and it is checked and completed before the pack is finalised — never guessed.

3.1What this document is

Your AML/CTF program is two things, and only two things: the ML/TF risk assessment (s26C) and the AML/CTF policies built on it (s26F). This is the second. Together they are the program.

If you have read about a program having a "Part A" and a "Part B", that structure no longer exists. It was replaced by the 2024 reforms. Independent evaluations now cover the entire program rather than a Part A. Any template still using that framing predates the regime you are actually in.

The program must be in place before you provide a designated service (s26E), documented in writing (s26N), approved by a senior manager (s26P), and complied with (s26G).

AUSTRAC applies four tests to policies: they must be targeted, proportionate, ongoing and effective. Targeted means aimed at the risks your own assessment identified — which is why every policy below names the risk it answers. AUSTRAC also says plainly that the mandatory list is not likely to be sufficient on its own, and that further policies must be adopted as necessary.

3.21. Governance

1.1 The governing body

The governing body of Sunline Realty Pty Ltd is Board of three directors, meeting monthly. Under s26H the governing body carries AML/CTF responsibilities in its own right. It must be given the ML/TF risk assessment, must receive written notice of updates relating to new or significantly changed risks as soon as practicable, and must receive the compliance officer's report at least once every 12 months.

1.2 The senior manager who approves the program

Grant Alderton, Managing Director, approves this program under s26P. Approval must be in writing and must record name, role and date. After initial approval, senior manager sign-off is required again for risk assessment updates relating to new or significantly changed risks, and for material changes to how these policies achieve their outcomes.

1.3 The AML/CTF compliance officer

Eligibility (s26J(2)). The compliance officer must be employed or engaged by the business at management level, must be an Australian resident where you provide designated services at or through a permanent establishment in Australia, and must be a fit and proper person. 'Management level' refers to authority rather than headcount — in a smaller business it is the owner, a director, or the person responsible for managing broader risks or operations, and a person can be at management level with no direct reports.

They do not need to be an AML/CTF expert. AUSTRAC says so explicitly. What is required is someone at management level with the general skills to learn the risks, who will build expertise through training and experience.

Fit and proper (s26K(2)). All of the following must be considered and the consideration recorded: competence, skills, knowledge, diligence, expertise and soundness of judgement; good character, honesty and integrity; conviction for a serious offence; adverse findings by a regulatory body; findings of serious misconduct; bankruptcy or a personal insolvency agreement; and any conflict of interest creating a material risk they will not act properly. AUSTRAC names open-source searches, credit checks, reference checks and police checks as the kinds of evidence expected, and expects periodic reassessment.

Duties (s26L). Communicate with AUSTRAC on the business's behalf; oversee and coordinate day-to-day compliance with the Act, Rules and regulations; oversee the effective operation of these policies; and report to the governing body at least once every 12 months.

The 12-monthly report (s116) must be in writing and in English, and must cover compliance with these policies, the extent to which they appropriately manage and mitigate the ML/TF risks the business reasonably faces, and compliance with the Act, Rules and regulations. The compliance officer retains editorial control: significant findings must reach the governing body without other staff removing or amending them, and any recommended changes plus the officer's reasons for accepting or rejecting them must be recorded in writing.

Absence. Someone must always be fulfilling the function, and AUSTRAC must be informed of anyone designated. Short absences do not require a designated replacement, because the role is oversight and coordination rather than personal execution of every check.

Two clocks, and they are different. Appointment is within 28 days of providing designated services (s26J). Notification to AUSTRAC is within 14 days of the appointment (s26M), through the enrolment form in AUSTRAC Online. The same applies if the officer leaves or becomes ineligible.

For this business the transitional notification deadline was the later of 29 July 2026 or 14 days after enrolling on 22 July 2026 — 5 August 2026.

Deplexify is not your AML/CTF compliance officer. AUSTRAC permits the role to be held by someone external to the business, provided they have the authority, resources and expertise. It is a standing appointment carrying personal statutory duties, and it is not a role we take on.

3.32. The policies

Each policy below names the risk it answers, states what actually happens, and says who does it. Where your questionnaire told us a control is not yet in place, the policy is drafted as what will happen and marked so you can see the difference between a description of your business and a plan for it. AUSTRAC's 'targeted' test is why every one of them points back at the risk assessment.

The risks these policies are aimed at, highest first, from your risk assessment:

• Brokering the sale, purchase or transfer of real estate — High. Driven by c3.largest_value_band, c7, c6.overseas.
• Delivery channels — High. Driven by d3.intermediaries_overseas, c10.relies, c11.introduced.
• Customer types — Medium-High. Driven by d2.peps.

2.1 Identifying significant changes to risk factors relating to designated services

Why this is required. You must be able to notice when something significant changes about the services you offer, who you offer them to, how they are delivered, or where your customers are — because that is what triggers a review of the risk assessment under s26D.

Not currently in place. You told us: Nothing formal. New services get discussed at the monthly directors' meeting but there is no link to a risk assessment because there isn't one.

Policy to be implemented. Priya Raghavan keeps a standing list of the business's designated services, customer types, delivery channels and countries, reviewed at least quarterly and whenever someone proposes something new. Anyone proposing a new service, a new type of client, a new way of onboarding, or work connected to a new country raises it with Priya Raghavan before it starts. Where the change is within the business's control, the risk assessment is reviewed before the change goes ahead — that ordering is a statutory requirement, not a preference.

To be confirmed — name the person responsible and the date this starts.

2.2 Reviewing and updating policies in response to a risk assessment review and other triggers

Why this is required. When the risk assessment changes, the policies built on it have to be revisited. Policies that no longer match the assessment are the commonest form of drift.

Not currently in place. You told us: nothing recorded.

Policy to be implemented. Any review of the ML/TF risk assessment is followed immediately by a review of these policies against it, carried out by Priya Raghavan. Policies are also reviewed at least every three years and after adverse independent evaluation findings. Every update is documented within 14 days, and material changes go to the senior manager for written approval.

To be confirmed — name the person responsible and the date this starts.

2.3 Conducting customer due diligence, and identifying triggers for source of funds and source of wealth checks

Why this is required. Initial CDD (s28), ongoing CDD (s30), and the triggers that require you to ask where the money or the wealth came from.

What happens now, in your words: Identity documents are collected from vendors before listing — driver licence or passport, scanned to the property file. Nothing extra is done for company or trustee vendors beyond taking a director's ID.

Policy. The above is adopted as policy. The compliance officer confirms it is complete, that it is followed in practice and not only on paper, and that there is a record capable of demonstrating both. Under s26N a control that is not documented is not a policy.

2.4 Ensuring compliance with targeted financial sanctions obligations

Why this is required. Sanctions obligations are absolute and sit outside the risk-based approach: there is no risk rating at which it becomes acceptable to deal with a sanctioned person.

Not currently in place. You told us: Not done.

Policy to be implemented. Every customer, and every beneficial owner identified, is screened against Australian sanctions lists before the designated service is provided, and re-screened when the lists change. A possible match stops the matter and goes to Priya Raghavan immediately. Sanctions obligations are absolute: there is no risk rating at which proceeding becomes acceptable, and no commercial deadline that overrides them.

To be confirmed — name the person responsible and the date this starts.

2.5 Informing or obtaining approval before providing a designated service to certain customer types

Why this is required. Some customers should not be onboarded on the judgement of whoever happens to answer the phone. This policy names which, and whose approval is needed.

Not currently in place. You told us: Salespeople onboard their own vendors. Nothing is escalated as a matter of course.

Policy to be implemented. Priya Raghavan must approve, before the business acts, any matter involving a politically exposed person, a customer connected to a high-risk jurisdiction, a complex or opaque ownership structure, or any customer where staff cannot satisfy themselves who ultimately benefits. The approval and its reasons are recorded on the file.

To be confirmed — name the person responsible and the date this starts.

2.6 Monitoring transfers of value under the travel rule

Why this is required. Where transfers of value pass through your business, the travel rule obligations attach to the information that must travel with them.

Not currently in place. You told us: Not applicable as far as we know — no transfers of value pass through the agency.

Policy to be implemented. Where the business is involved in a transfer of value to which the travel rule applies, the required information travels with the transfer and is recorded. Where incoming information is missing or incomplete, Priya Raghavan decides whether to proceed and records the decision.

To be confirmed — name the person responsible and the date this starts.

2.7 Verifying KYC information provided by another person you rely on for CDD in a real estate transaction

Why this is required. This is an express AUSTRAC requirement for real estate, not a general good practice. If you rely on a conveyancer, a solicitor or an agent for customer information, you must verify it.

Not currently in place. You told us: We assume the purchaser's solicitor has done their own checks. We have never asked to see them.

Policy to be implemented. Where the business relies on another person for customer information in a real estate transaction, Priya Raghavan verifies that information rather than accepting it. There is a written agreement with each party relied on setting out what they must collect, what they must provide, and that the business may audit it — and that agreement is assessed regularly, as s37B requires. Reliance moves the work; it never moves the obligation.

To be confirmed — name the person responsible and the date this starts.

AUSTRAC's warning, and it is worth taking literally: the requirements above are not likely to be sufficient on their own. Further policies must be adopted as necessary for your business. Where your risk assessment rates something Medium-High or High, expect to need more than the minimum against it.

3.43. Customer due diligence

This is the longest section in the program because it is where most of the obligation actually sits. It covers when customer due diligence falls due, what has to be established, the minimum information to collect, when you may start before finishing, when simplified or enhanced measures apply, what to do when you cannot complete it, relying on someone else, and what continues for the life of the relationship.

3.1 When it falls due

The single question that decides whether you are compliant on any given matter is when the designated service starts, because that is when the obligation attaches. It is earlier than most people assume, and it differs by role.

Who your customer is for RE1. Both the seller or transferor AND the buyer or transferee. Obligations run to both parties of the same transaction, which is the single most commonly missed feature of item 1.

Auctions. The hammer-to-contract gap is the classic timing problem, and the answer is more precise than it is usually described. Delayed CDD under s29 is only available in circumstances specified in the AML/CTF Rules, and there is no auction-specific circumstance. What actually covers the auction case is Rules s6-32: where you have already commenced providing the item 1 service to the seller and the successful bidder becomes your customer, you may commence before completing CDD on them — and the period to finish ends at the earlier of 28 days after the exchange of contracts, or 3 days before the initially agreed settlement day. On a short settlement the second limb bites first. So this is a timing allowance with a hard, derivable deadline attached to the transaction, not a general allowance for auctions, and it does not permit money to move: it is initial CDD that is deferred, not the obligation.

3.2 What has to be established, before you commence

Section 28(1) is a prohibition, not a task: you must not commence to provide a designated service unless you have established each of the following on reasonable grounds. Each service to each customer is a separate contravention if you get it wrong (s28(9)), and where the service is provided through an overseas permanent establishment it is a separate contravention on each day (s28(10)).

And s28(3) sets out what you must actually do to establish them:

• (a) If the customer is an individual — take reasonable steps to establish that they are who they claim to be.
• (b) Identify the ML/TF risk of the customer, based on KYC information reasonably available to you before you commence.
• (c) Collect KYC information about the customer appropriate to that risk.
• (d) Verify, using reliable and independent data, such of that information as is appropriate to that risk.

Note the shape of (c) and (d): you collect what is appropriate to the risk, and you verify such of what you collected as is appropriate to the risk. Those are two different tests, and the second is narrower than the first. Your policies have to say which information you collect and which you also verify, in which circumstances — including for source of wealth and source of funds (Rules s5-2). Writing that down is the requirement; leaving it to the person on the file is not.

When you identify the customer's risk at step (b), s28(4) requires you to take these into account:

• Your own ML/TF risk assessment
• The kind of customer
• The kinds of designated services provided or proposed
• The delivery channels used
• The countries you deal with in providing the service to that customer
• Anything else specified in the AML/CTF Rules

The first of those is why this document and your risk assessment are one program rather than two files: every customer risk rating is required to be made against the risk assessment, so a risk assessment nobody opens cannot be complied with.

3.3 The minimum information to collect, by customer type

The AML/CTF Rules set a floor for each customer type — the words are "must collect at least". Anything further that is appropriate to the customer's risk is required on top of it by s28(3)(c), so this is where you start, not where you stop.

Individual sole trader — Rules s6-1

• Full name
• Any business name used for the business
• Any other names they are commonly known by
• A unique identifier for the business, or for the customer if the business has none
• The address of the principal place of business

Plus KYC information about the nature of the business for the nature-and-purpose limb.

Company, partnership or unincorporated association — Rules s6-2

• Full name
• Any business names
• Any other names it is commonly known by
• A unique identifier (if one has been given)
• The address of the principal place of business or operations
• The address of any registered office
• Evidence of the customer's existence
• Information about the powers that bind and govern it
• The full name — and where applicable the director identification number — of each individual with primary responsibility for its governance and executive decisions

Plus KYC information about the ownership and control structure for the beneficial owner limb, and about the nature of the business or operations for the nature-and-purpose limb.

Trust, or a foreign equivalent such as a fiducie, waqf, treuhand or fideicomiso — Rules s6-3

• Full name
• The kind of trust — discretionary, bare, unit and so on
• Any business names, and any other names it is commonly known by
• A unique identifier (if one has been given)
• The address of the principal place of business or operations
• Evidence of its existence, and information about the powers that bind and govern it
• The full name of each individual with primary responsibility for its governance and executive decisions

Plus: the identity of each beneficiary — or, where the nature of the trust makes that impossible, a description of each class of beneficiary; the identity of the trustees; and for the beneficial owner limb, the control structure and the identity of any settlor, appointor, guardian or protector.

Government body — Rules s6-4

• Full name, and any other names it is commonly known by
• The country or part of a country under which it is established
• A unique identifier (if one has been given)
• The address of the principal place of business or operations
• Evidence of its existence
• The full name of each individual with primary responsibility for its governance and executive decisions

Plus KYC information about the nature of its business or operations.

Where a person on whose behalf the customer acts, or a person acting on the customer's behalf, is not an individual, you collect the same identity information for them as you would if they were the customer (Rules s6-5).

3.4 Starting before you have finished — the delayed CDD route

Section 29 permits commencing before s28(1) is satisfied, but only where all of these hold: the circumstances are ones specified in the Rules; you determine on reasonable grounds that starting early is essential to avoid interrupting the ordinary course of business; you have policies to finish CDD as soon as reasonably practicable and within the specified period; you determine on reasonable grounds that the additional risk is low; and you implement policies to manage it.

For real estate this has its own rule, and it is not the general one. Rules s6-32 specifies the circumstance for brokering (Table 5 item 1) and for assisting with a real estate transaction (Table 6 item 1): it is the case where you have already commenced providing the service to one side of the transaction and the other side becomes your customer. In that circumstance the period to complete CDD ends at the earlier of:

• 28 days after the exchange of contracts; and
• 3 days before the initially agreed settlement day.

Those are hard dates derived from the transaction, not from when you got round to it, and the second one will usually bite first on a short settlement. Rules s6-12 (the general 20-business-day route below) expressly does not apply where s6-32 does.

Rules s6-33 adds two routes that matter in practice. First, you may rely on an arrangement with another reporting entity in the chain — typically the conveyancer or solicitor — to collect and verify, provided the arrangement lets you obtain the information no later than 28 days after exchange and the verification data at least 3 days before settlement, and documents each participant's responsibilities including recordkeeping. If you are in such an arrangement, Rules s5-20 requires your policies to deal with how you will verify the information yourself if you do not get it — the fallback is the part people leave out.

Second, and this is the provision worth knowing: where a brokering customer will not cooperate, you are taken to have established the s28(2) matters if you have taken all reasonable steps, recorded the steps taken and the difficulties encountered, and made a record of your consideration of whether a suspicious matter report is required. The two records are the condition, not the courtesy. And the customer's failure to cooperate must itself be taken into account in deciding whether an SMR obligation arises (Rules s9-4A).

The general route (Rules s6-12) applies to a designated service provided through an Australian permanent establishment. Its specified period is 20 business days after commencing. Before you may use it you must already have: taken reasonable steps to establish an individual customer is who they claim to be; identified their ML/TF risk; collected the KYC information for all the s28(2) matters appropriate to that risk; and established the identity of the customer (s28(2)(a)) and of anyone acting on their behalf (s28(2)(c)). Those two are not deferrable.

There is also a hard prohibition attached to it: until CDD is complete you must not transfer, or allow or facilitate the transfer of, money, property or virtual assets for the customer, or otherwise make them available to the customer. In other words the delay lets you start the work; it does not let you move the money.

3.5 Simplified and enhanced due diligence — triggers, not discretions

Simplified (s31) is available only where the customer's ML/TF risk is low, s32 does not apply, and your policies deal with how simplified measures are applied (Rules s6-16). It is a permission, and it has to be earned by a risk rating you can show.

Enhanced (s32) is mandatory where any of these apply — there is no discretion and no commercial override:

• The customer's ML/TF risk is high
• A suspicious matter reporting obligation has arisen and you propose to keep acting for them
• The customer, a beneficial owner, a person on whose behalf they act, or a person acting for them is a foreign politically exposed person
• Any of those people is physically present in — or is an entity formed in — a high-risk jurisdiction for which the FATF has called for enhanced due diligence
• The service is part of a nested services relationship
• The customer is of a kind specified in the Rules — which includes anyone requesting services with no apparent economic or legal purpose, or involving unusually complex or large transactions, or an unusual pattern of transactions (Rules s6-20)

Where enhanced due diligence is triggered by high risk, an SMR, or a FATF high-risk jurisdiction, you must establish the customer's source of wealth and source of funds where relevant to the nature of the risk (Rules s6-21) — and keep that information current through ongoing CDD.

Politically exposed persons are not all treated alike, and this is worth getting right because the common assumption is wrong. Under Rules s6-23 you must establish the source of wealth and source of funds of:

• a foreign PEP — always, whatever the risk rating; and
• a domestic PEP or an international organisation PEP — only where the customer's ML/TF risk is high.

So identifying someone as a domestic PEP does not by itself trigger the source-of-wealth work, and identifying someone as a foreign PEP always does — and also triggers mandatory enhanced due diligence under s32(c). The same split applies on an ongoing basis when someone becomes a PEP during the relationship (Rules s6-24).

3.6 When you cannot complete it

The Rules provide for the cases that actually happen, and each is conditional on a record. None of them is a shrug.

• You cannot identify the beneficial owners of a company, partnership or unincorporated association (Rules s6-8(1)). You are taken to have established them if you took all reasonable steps, recorded the steps and the difficulties, collected the identity of the chief executive officer or equivalent, and verified such of that as is appropriate to the risk.
• You establish there are no beneficial owners at all (Rules s6-8(2)-(3)). The CEO's identity then becomes a specified matter in its own right.
• An individual genuinely cannot provide evidence of identity (Rules s6-10) — because they cannot obtain it, or cannot access it for reasons beyond their control. You must still take reasonable steps to establish they are who they claim to be, identify and collect to the risk, take reasonable steps to verify using data reasonably available, and have policies to manage the additional risk that the missing evidence creates.

What none of these permits is proceeding quietly. Every one of them converts an unfinished check into a compliant position only if the reasoning is written down at the time.

3.7 Relying on someone else

You rely on Purchasers' conveyancers and solicitors for anything to do with the buyer side. Written agreement in place: Yes.

Sections 37, 37A, 37B and 38 govern this. Reliance moves the work but never the obligation: if the other party's checks were inadequate, the failure is yours. The Rules set out what the agreement has to do (s6-29):

• The other party must be a reporting entity, or a person regulated by a foreign country's laws giving effect to the FATF Recommendations — and must have measures in place to comply with Part 2 (customer due diligence) and Part 10 (recordkeeping) of the Act, or the foreign equivalent
• It must be appropriate to the risks you face, taking into account the nature, size and complexity of the other party's business, its products, channels and customer types, and the ML/TF risk of the countries it operates in or is resident in
• It must let you obtain all the KYC information they collected, before you commence — or within the s29 period where delayed CDD applies
• It must let you obtain copies of the verification data immediately or as soon as practicable on request
• It must document the responsibilities of each party, including for recordkeeping

And it has to be reassessed at intervals of not more than two years (Rules s6-30(2)(b)), more often if the risk warrants, and again whenever there is a significant change of circumstances that might affect whether it still meets those requirements. An agreement signed once and filed does not satisfy s37B.

Where you rely without an agreement — on another person's procedure under s38 — the equivalent conditions apply (Rules s6-31), and you must document your reasons for concluding they are met.

3.8 Ongoing customer due diligence (s30)

Initial CDD is a gate; ongoing CDD is the rest of the relationship. Section 30 requires you to monitor customers to identify, assess, manage and mitigate ML/TF risk, and specifically to:

• monitor for unusual transactions and behaviours that may give rise to a suspicious matter reporting obligation
• review and update the customer's risk rating where there is a significant change to any of the s28(4) matters, or where unusual transactions or behaviours arise
• review, update and reverify KYC information at a frequency appropriate to the customer's risk, and whenever you have doubts about its adequacy or veracity

Rules s6-35 sets out what monitoring has to cover to be taken as compliant, and it is broader than money laundering: the predicate offences named include sanctions breaches, organised crime, human trafficking and people smuggling, sexual exploitation including of children, drug and arms trafficking, trafficking in stolen goods, corruption and bribery, fraud and identity theft, tax crimes, cybercrime, environmental crime, extortion, forgery, insider trading and market manipulation — plus any other kind of offence you have identified in your own program as presenting a high money laundering risk. That last limb means this list is partly yours to write.

3.54. Reporting

4.1 Suspicious matter reports (s41)

Anyone in the business who forms a suspicion escalates it to the compliance officer, who decides and reports. Policies must ensure reports are complete, accurate, free from unauthorised change, and not unduly delayed. Tipping off is prohibited: the customer must not be told, and neither must anyone with no need to know.

4.2 Threshold transaction reports (s43)

Physical currency of A$10,000 or more in a single transaction is reportable.

You told us you do not accept physical cash. The obligation still has to be in the program, because the risk is that cash is offered and accepted by someone who did not know the rule — which is a training point as much as a policy one.

4.3 The annual compliance report (s47)

Reporting runs on financial years, not on your enrolment anniversary. You submit between 1 July and 30 September each year, covering the previous 1 July to 30 June.

Your next report covers 1 July 2026 to 30 June 2027 and is submitted between 1 July 2027 and 30 September 2027 — currently not yet open.

It is an online form in AUSTRAC Online only: Business → Compliance Reports → Open Compliance Report. The person submitting must be listed as an administrator on the account, so check that before the window opens rather than during it. Non-lodgement can attract a remedial direction or an infringement notice.

3.65. Records, training and people

5.1 Record keeping

Property files and identity documents are held in the agency's practice management system and retained indefinitely. Trust account records are held separately and reconciled monthly by the administrator.

Records must evidence every obligation in section 6 below, and must be producible if AUSTRAC requests documentation under s26Q. The compliance officer's own records must additionally show who was appointed, when they acted, how they meet the eligibility requirements, and what was considered in reaching that view.

5.2 Training

To be confirmed — no training programme recorded. Everyone whose work touches customers, transactions or records needs training on what the risks look like in your business, how to escalate, and the prohibition on tipping off. Attendance is recorded, because an untrained team is the commonest reason a well-written program fails in practice.

5.3 Due diligence on your people

To be confirmed — checks on people going into roles that touch AML/CTF work, recorded at the time. This applies to the compliance officer and to staff in relevant roles, and it is the counterpart to the fit-and-proper requirement in section 1.3.

3.76. How these policies cover every obligation

s26F requires the policies to set out how you comply with each obligation you have — not only the ones you find interesting.

3.87. Review, update and independent evaluation

7.1 Review

These policies are reviewed at least once every three years, after any review of the ML/TF risk assessment, and after adverse findings from an independent evaluation. Updates must be documented within 14 days, and material changes to how the policies achieve their outcomes need senior manager approval.

7.2 Independent evaluation

An independent evaluation must evaluate how the risk assessment was undertaken or reviewed, evaluate the design of these policies, and test whether the business actually identified, assessed, mitigated and managed its risks and complied with its own policies. It is in addition to your own reviews, and it produces a written report that goes to both the governing body and the senior manager who approved the program, as soon as reasonably practicable.

Frequency is set by these policies, appropriate to the nature, size and complexity of the business, and at minimum once every three years. The rationale for the frequency chosen must be documented.

Your first independent evaluation is due by 31 December 2030, because your AUSTRAC Account Number ends 67 — second-last digit even, last digit odd — and the transitional rules stagger first evaluations on that basis. AUSTRAC suggests going earlier than the deadline: issues are cheaper to fix when found early, and skilled evaluators will be easier to find before the deadline crowd arrives.

Who can do it. There are no mandatory qualifications. The evaluator may be internal or external, but must be genuinely independent: free from bias and conflicts, empowered to conduct the evaluation as they see fit, not responsible for implementing or maintaining the program, not involved in developing it or assessing the risks, and not the compliance officer or a member of the compliance team.

Which is why it cannot be us. Having prepared your risk assessment and these policies, Deplexify is excluded by that list. We will refer you to an independent evaluator rather than take the work.

Responding to findings. These policies require the business to review and, where needed, update the risk assessment after adverse findings about it, and to review these policies after adverse findings about them. You are not required to agree with every finding — but you must keep records of how each was addressed, including the reasons for not acting on any of them.

3.9Approval of this AML/CTF program

Section 26P requires the AML/CTF program to be approved by a senior manager in writing before designated services are provided, and s26N requires the approval to be documented. AUSTRAC expects the approval to record the approver's name, role and date. This block is that record — it is not a formality and the document is not in force until it is completed.

The ML/TF risk assessment must also be provided to the governing body (Board of three directors, meeting monthly), and any later update relating to new or significantly changed risks must go to them in writing as soon as practicable. Updates to this document must be documented within 14 days.

3.10Version control

Keep this table. s26N requires program updates to be documented within 14 days, and this is where an evaluator will look first for evidence that the program is maintained rather than written once.

Sources

Prepared from the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (in-force compilation C62, register ID C2026C00274, in force 1 July 2026) and from guidance published by AUSTRAC. AUSTRAC-produced material is © AUSTRAC for the Commonwealth of Australia and is reused under Creative Commons; Commonwealth legislation is reproduced from the Federal Register of Legislation. Deplexify is not affiliated with, endorsed by, or acting on behalf of AUSTRAC.

• AUSTRAC — real estate designated services
• AUSTRAC — real estate program starter kit
• AML/CTF Act 2006, in-force compilation
• AUSTRAC — your AML/CTF program

4AML/CTF Compliance Calendar

Sunline Realty Pty Ltd

Your dates, derived from your answers — not a generic list

DRAFT FOR REVIEW — not yet in force.

Prepared by Deplexify for Sunline Realty Pty Ltd from the answers given in the engagement questionnaire. This is a draft. Priya Raghavan should read it in full and test it against how the business actually operates, and Grant Alderton must approve it in writing under s26P before it takes effect. We prepare the documents; the reporting entity adopts them as its own.

This is not legal advice. We are not your AML/CTF compliance officer — AUSTRAC permits that person to be external to the business, but it is a standing appointment carrying personal statutory duties and it is not a role we take on. Having prepared these documents we are also disqualified from performing the independent evaluation of them, so that is always a referral.

Anywhere you see Not yet verified, we have deliberately not stated something we could not confirm from a primary source, and it is checked and completed before the pack is finalised — never guessed.

4.1Your dates

Every date below is derived from something you told us, and the derivation is shown. Where we could not derive one, it says so rather than showing a plausible date.

4.2Standing obligations — no fixed date, but a clock once triggered

4.3Watch list

• AUSTRAC risk communications. Under s26C you must take account of risk information AUSTRAC communicates about your designated services, and under s26D receiving it triggers a review. Keep the compliance officer's email current in AUSTRAC Online, and record each communication and what was done about it.
• Fit-and-proper guidance. AUSTRAC has said it is working with industry bodies on recognising existing fit-and-proper checks, with guidance expected late 2026. Not yet verified — check whether it has landed before your next compliance officer reassessment; it may reduce the work.
• Your own growth. The most common way a compliant business becomes non-compliant is by quietly starting to do something new. New service, new country, new onboarding tool, first PEP — each is a review trigger, and the review is supposed to come first.

4.4What is not on this calendar

• Enrolment. The transitional window closed 29 July 2026; if you are not enrolled, that is a today problem, not a calendar item. Enrol in AUSTRAC Online.
• Filing your annual compliance report. We do not file it for you under this engagement. The first Tranche 2 reports are not due until the window opening 1 July 2027, and support for that is a separate engagement.
• Your independent evaluation. Referral only — we are disqualified from evaluating documents we wrote.

Sources

Prepared from the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (in-force compilation C62, register ID C2026C00274, in force 1 July 2026) and from guidance published by AUSTRAC. AUSTRAC-produced material is © AUSTRAC for the Commonwealth of Australia and is reused under Creative Commons; Commonwealth legislation is reproduced from the Federal Register of Legislation. Deplexify is not affiliated with, endorsed by, or acting on behalf of AUSTRAC.

• AUSTRAC — real estate designated services
• AUSTRAC — real estate program starter kit
• AML/CTF Act 2006, in-force compilation
• AUSTRAC — your AML/CTF program

5Annual Compliance Report Readiness

Sunline Realty Pty Ltd

What the report will ask, what you have to be recording all year so the answers exist, and when to do it

DRAFT FOR REVIEW — not yet in force.

Prepared by Deplexify for Sunline Realty Pty Ltd from the answers given in the engagement questionnaire. This is a draft. Priya Raghavan should read it in full and test it against how the business actually operates, and Grant Alderton must approve it in writing under s26P before it takes effect. We prepare the documents; the reporting entity adopts them as its own.

This is not legal advice. We are not your AML/CTF compliance officer — AUSTRAC permits that person to be external to the business, but it is a standing appointment carrying personal statutory duties and it is not a role we take on. Having prepared these documents we are also disqualified from performing the independent evaluation of them, so that is always a referral.

Anywhere you see Not yet verified, we have deliberately not stated something we could not confirm from a primary source, and it is checked and completed before the pack is finalised — never guessed.

5.1Why this document exists

AUSTRAC describes the annual compliance report in one sentence: "The compliance report is a report you submit to us each year that includes questions about how you have met your anti-money laundering and counter-terrorism financing (AML/CTF) obligations." Every one of those questions is about a whole year, and most of them ask for a number, a date, a list or a reason.

That is the entire difficulty. A business with no registers answers the report from memory in the submission window, and the answers are either wrong or defended by someone reopening files for a fortnight. A business with registers answers it by reading them. This document sets out what will be asked, the registers that make the answers accumulate on their own, and when to touch them.

Your first reportable period is 1 July 2026 to 30 June 2027, and the window opens in 329 days (1 July 2027). The registers below need to be running from the start of that period, not from the day someone remembers the report is due. Anything not recorded between now and 30 June 2027 is reconstructed later or answered as unknown.

5.21. What is settled about your report

Each row below is AUSTRAC's own published position on the annual compliance report, from its Annual compliance reports guidance (last updated 1 April 2026), which cites Act ss47(2) and 47(3) and Rules s9-9.

The exemptions do not apply to you. AUSTRAC's exemption list covers small gaming venues licensed for no more than 15 electronic gaming machines, entities solely registered as an affiliate of a remittance network provider, AFSL holders whose only designated service is making arrangements for customers to receive a designated service, and anyone granted a specific exemption. None of the first three describes real estate agency work. If you believe you hold a specific exemption, check it in AUSTRAC Online before relying on it.

5.32. What the report asks

Not yet verified — the question list below is AUSTRAC's 2025 compliance report, not yours.

AUSTRAC publishes a Preview questions in the AUSTRAC [year] compliance report page ahead of each reporting period. No preview has been published for 1 July 2026 – 30 June 2027 that we have been able to read, and we do not write a question set we have not seen. What follows is the most recent question set AUSTRAC has published — AUSTRAC, Preview questions in the AUSTRAC 2025 compliance report, page last updated 8 December 2025 — quoted verbatim.

Read it as the shape of the form, not as your questions. The 2025 report covers a calendar year and was written for the pre-reform obligations. It asks, for example, whether "Part A of your AML/CTF program" has been independently reviewed — and Part A no longer exists: a program is now the ML/TF risk assessment (s26C) plus the AML/CTF policies (s26F), and independent evaluations cover the entire program. Some questions will change wording, some will be replaced, and reform-specific ones are likely to be added. Confirm the published preview for your period before you answer anything from this list.

The headings below are not AUSTRAC's. They are the obligation inventory your AML/CTF policies already have to cover — which is the same inventory the report tests, because the report is questions about how you met your obligations.

2.0 The gate question — did you provide designated services at all

Whether the rest of the form opens. Answering it wrongly is the one mistake that cannot be fixed by good records, and the reduced-filing route below is answered here.

AUSTRAC's 2025 questions in this area:

• Did you provide designated services during all or part of the reporting period (1 January 2025 00:00 to 31 December 2025 23:59)? (Yes or No)
• Do you believe you have a legal exemption from submitting a compliance report? (Yes or No)
• Why did your business not offer designated services during all or part of the reporting period? (Maximum 500 characters)

Registers that produce these answers: Transaction register.

2.1 Enrolment, your details, and how you delivered the services

The obligation. Enrolling on the Reporting Entities Roll (Part 3A), keeping enrolment details current within 14 days of any change (s51F), and requesting removal if you cease providing designated services (s51G).

AUSTRAC's 2025 questions in this area:

• Has there been a change in key personnel or contact details for your business? (Yes or No)
• Have you notified AUSTRAC of these changes? (Yes or No)
• Did you acquire or merge with another entity in 2025? (Yes or No)
• How did you provide designated services in 2025? (Select all that apply) — the list includes Email, Face to face, Mobile application, Telephone, Website, Video conferencing, Broker, Mail and Additional method(s), alongside options for other industries
• Were any of the above delivery methods introduced in 2025?

Registers that produce these answers: Transaction register, Delivery channel and technology log, Enrolment detail change log.

2.2 The AML/CTF program itself

The obligation. Maintaining the ML/TF risk assessment (s26C) and these policies (s26F), documenting them (s26N), having them approved (s26P), and complying with them (s26G).

AUSTRAC's 2025 questions in this area:

• Do you have an AML/CTF program? (Yes or No)
• Is your AML/CTF program approved by its governing board and/or senior management? (Yes or No)
• When was your AML/CTF program last approved? — Within the past 12 months / Within the previous 2 years / Within the previous 3 years / More than 3 years ago / Program has not been approved
• Did you make any changes to your AML/CTF program in 2025? (Yes or No)
• What prompted these changes? (Select all that apply) — AUSTRAC compliance assessment; AUSTRAC enforcement action; AUSTRAC engagement, feedback or guidance; Change of AML/CTF compliance officer; Changes to your ML/TF risk assessment; Newly identified risks; New designated service; New technology or delivery method; Regular scheduled review; Internal review of systems or procedures; Advice from industry body; Advice from external consultant or service provider; Media reports; Independent review; Changes to legislation; Changes to designated business group; Changes to management or ownership; Additional reason(s)
• Did you conduct an ML/TF risk assessment of your business in 2025? (Yes or No)
• Was this risk assessment documented? (Yes or No)
• Do you have a documented process for conducting a risk assessment? (Yes or No)
• Did your business conduct an ML/TF risk assessment on the new delivery methods introduced in 2025? (Yes or No)
• Has Part A of your AML/CTF program been independently reviewed? (Yes or No)
• How was the independent review conducted? — Internally / Externally / Combination; Service provider type; Service provider name
• Did your business outsource any of the following AML/CTF functions in 2025? (Select all that apply) — Customer identification; AML/CTF program development; Transaction monitoring; Transaction reporting; Enhanced customer due diligence; AML/CTF training; None
• What is the legal business name of the provider for your AML/CTF program development? (Maximum 200 characters)
• Have you confirmed that your outsourced program is tailored to your business and its ML/TF risks? (Yes or No)

Registers that produce these answers: Program and risk assessment change log, Governing body and senior management reporting log, AUSTRAC communications log, Delivery channel and technology log, Outsourcing register.

2.3 Governance, training and personnel due diligence

The obligation. The governing body's responsibilities (s26H), the compliance officer's appointment and functions (ss26J–26M), training staff, and checking the people you put into roles that touch this.

AUSTRAC's 2025 questions in this area:

• Approximately how many full time equivalent employees does your business have?
• Please specify number of full time equivalent employees with a primary role in AML/CTF compliance
• Did you report internally to the Board or Senior Management on any of the following matters in 2025? (Select all that apply) — AML/CTF risk awareness training statistics; AUSTRAC engagement, feedback, or guidance; Changes to ML/TF risk assessment; Independent review or remediation; Newly identified risks; Performance of outsourced functions; Staff compliance or non-compliance with AML/CTF program or policies; Transaction monitoring information; Internal AML/CTF statistics; AML/CTF uplift activities; Other matter(s)
• What employee checks do you conduct? (Select all that apply) — Check licensing; Open source searches; Police checks; Other qualification checks; Reference checks; Sanction and PEP checks; Social media review; News and media; Bankruptcy checks; Credit checks; ASIC banned and disqualified person checks; Identification checks; Additional check(s)
• Did you provide AML/CTF training in 2025? (Yes or No)
• What AML/CTF training did you provide? (Select all that apply) — Training for new employees; Regularly scheduled refresher training; Training on request; ACAMS; Role specific training; Additional training
• Did you update your AML/CTF training program in 2025? (Yes or No)

Registers that produce these answers: Training register, Personnel due diligence register, Governing body and senior management reporting log.

2.4 Initial and ongoing customer due diligence

The obligation. ss28–32, including simplified CDD (s31), enhanced CDD (s32), PEP detection and sanctions screening, plus reliance arrangements (ss37, 37A, 37B, 38).

AUSTRAC's 2025 questions in this area:

• Approximately how many customers/members do you have? — 1-100 / 101-1,000 / 1,001-10,000 / 10,001-100,000 / 100,001-1 million / More than 1 million
• What are your customer types? (Select all that apply) — Individual; Company; Trustee; Partnership; Association; Registered co-operative; Government body
• Do you have procedures to assist customers who cannot meet your standard customer identification requirements as they do not have standard forms of identification? (Yes or No)
• Did your business have a documented customer risk assessment methodology in 2025? (Yes or No)
• How many of your customers are high risk or above?
• Did you perform Politically Exposed Persons (PEPs) checks in 2025? (Yes or No)
• How did you identify PEPs? (Select all that apply) — Media review; Open source searches; Commercial or external database; Sanctions list; Self-certification or declaration by customer; Additional identification method(s)
• How many of your customers did you identify as PEPs?
• Does your business obtain applicable customer identification information provided by brokers? (Yes or No)
• Does your business verify the applicable customer identification information provided by brokers? (Yes or No)
• Do you have a documented enhanced customer due diligence (ECDD) program? (Yes or No)
• Did you conduct ECDD in 2025? (Yes or No)
• Which ECDD measures did you undertake in 2025? (Select all that apply) — Extra information gathered; Verify or re-verify KYC information; Verify or re-verify beneficial owner information; More detailed analysis of transaction monitoring; Sought senior management approval for continuing a business relationship with a customer; Sought senior management approval for whether a designated service should be provided; More analysis of KYC information; Collected Source of Funds; Collected Source of Wealth; Additional method(s)

Registers that produce these answers: Transaction register, Customer register, Customer due diligence evidence index, Sanctions and PEP screening log, Enhanced customer due diligence log, Ongoing monitoring and review log, Client money register, Third-party reliance register, Auction CDD timing log, Overseas connection register.

2.5 Reporting

The obligation. Suspicious matter reports (s41) and not tipping off; threshold transaction reports for physical currency of A$10,000 or more (s43); the annual compliance report (s47); and cross-border movement reports where they apply.

AUSTRAC's 2025 questions in this area:

• How did your staff report unusual or potentially suspicious activity in 2025? (Select all that apply) — Email (internal); Online form (internal); Paper form (internal); Verbal conversation (internal); Submit SMR to AUSTRAC (external); Additional reporting methods (internal); Additional reporting methods (external); Staff did not identify and report any unusual or potentially suspicious activity in 2025
• Why did staff not identify and report any unusual or potentially suspicious activity? (Maximum 500 characters)
• Do you have a transaction monitoring program (TMP) in place? (Yes or No)
• Is your TMP manual, automated or both?
• Did you review TMP rules in 2025? (Yes or No)
• Did your TMP identify any potentially suspicious customer transactions that required further review in 2025? (Yes or No)

Registers that produce these answers: Escalation and suspicious matter log, Physical currency and threshold transaction register, Client money register.

2.6 Record keeping, and what you did with AUSTRAC's feedback

The obligation. Keeping the records that evidence all of the above, and being able to produce them if AUSTRAC requests documentation under s26Q.

AUSTRAC's 2025 questions in this area:

• Do you have a documented procedure in place to record and consider AUSTRAC feedback and guidance? (Yes or No)
• What feedback, guidance or engagement did you receive? (Select all that apply)
• What did you do in response to this? (Select all that apply) — Communicated or escalated feedback internally; Conducted training; Increased AML/CTF resourcing; Reviewed or changed AML/CTF program; Reviewed or changed ML/TF risk assessment; Reviewed or changed transaction monitoring rules; Back-captured transaction reports; No action required; Independent review; Additional action(s)

Registers that produce these answers: Customer due diligence evidence index, AUSTRAC communications log.

5.43. The registers that make the answers accumulate

20 registers, selected for real estate agency work and for the answers you gave us — not a generic list. Each one below says what it is, what a row looks like, which part of the report it feeds and when to write in it.

Format does not matter: a spreadsheet is fine, and a spreadsheet that is actually kept beats a system that is not. What matters is that a row is written at the time, because a register reconstructed at year end is not evidence of a control operating. The example rows are illustrative — they are not your data and no date in them is a date of yours.

R1. Transaction register

One row per customer per transaction. Under Table 5 item 1 the customer is both the seller or transferor and the buyer or transferee, so one brokered sale normally produces two rows with two different service-start dates.

• Feeds: §2.0 the gate question, §2.1 enrolment and delivery, §2.4 customer due diligence.
• Write in it: A row on the day the designated service starts — not on settlement or completion.

R2. Customer register

One row per customer, typed the way AUSTRAC types them. This is the register that answers the customer-count and customer-type questions without anyone having to count files in September, and it is where the high-risk and PEP totals come from.

• Feeds: §2.4 customer due diligence.
• Write in it: A row at onboarding; the risk rating and review date updated whenever either changes.

R3. Customer due diligence evidence index

What was collected, what was verified, by whom, when, and where the evidence now lives. The register is the index; the documents themselves stay in your normal filing. Without the index, evidencing CDD means opening files one at a time.

• Feeds: §2.4 customer due diligence, §2.6 record keeping.
• Write in it: At initial CDD, and again whenever anything is re-verified.
• You already do this: Identity documents are collected from vendors before listing — driver licence or passport, scanned to the property file. Nothing extra is done for company or trustee vendors beyond taking a director's ID. The register is the record of it, which is the part the report asks for.

R4. Sanctions and PEP screening log

Every screening event, including the ones that returned nothing. A screening that found nothing is the evidence that screening happens — if only hits are recorded, the register proves the opposite of what it needs to.

• Feeds: §2.4 customer due diligence.
• Write in it: Before the designated service starts, and on re-screening.
• Not in place today — you told us so: Not done. The register stays empty until the underlying process exists, and an empty register is an honest answer to the report but a poor one to be giving. 02_AMLCTF_Program sets out the process.

R5. Enhanced customer due diligence log

Which customers went to ECDD, what triggered it, which measures were actually applied, and who approved continuing. AUSTRAC asks which measures you used from a fixed list, so record the measure, not just the fact of a review.

• Feeds: §2.4 customer due diligence.
• Write in it: Whenever ECDD is triggered.

R6. Ongoing monitoring and review log

Customers and matters looked at again after onboarding, and what came of it. This is the register that distinguishes a business doing ongoing CDD (s30) from one doing initial CDD and calling it ongoing.

• Feeds: §2.4 customer due diligence.
• Write in it: On the schedule your policies set, and on any trigger.
• Not in place today — you told us so. The register stays empty until the underlying process exists, and an empty register is an honest answer to the report but a poor one to be giving. 02_AMLCTF_Program sets out the process.

R7. Escalation and suspicious matter log

Every internal escalation, whether or not it became a suspicious matter report. AUSTRAC's form has an explicit option for staff having reported nothing at all, followed by a free-text box asking why — a nil year is answerable, but only if the escalation route was real and can be described.

• Feeds: §2.5 reporting.
• Write in it: Same day the concern is raised. Do not tip off the customer at any point.
• Not in place today — you told us so: Nobody has ever made a suspicious matter report. Staff would raise something with the Licensee in Charge but there is no form, no record, and no guidance on tipping off. The register stays empty until the underlying process exists, and an empty register is an honest answer to the report but a poor one to be giving. 02_AMLCTF_Program sets out the process.

R8. Physical currency and threshold transaction register

You told us you do not accept physical cash, so keep this as a nil register with the policy stated at the top. It costs nothing to maintain, it evidences the control rather than the intention, and the risk it covers is cash being accepted once by someone who did not know the rule.

• Feeds: §2.5 reporting.
• Write in it: At the point cash is received — not at month end.
• You already do this: We do not accept cash at all, and the trust account only receives funds by transfer. The register is the record of it, which is the part the report asks for.

R9. Training register

Who was trained, on what, when, and how you know they attended. AUSTRAC asks for the type of training from a fixed list — new starters, scheduled refresher, on request, role specific — so record the type as well as the date.

• Feeds: §2.3 governance and training.
• Write in it: At induction, on the refresher cycle, and after any material change to the program.
• Not in place today — you told us so: The Licensee in Charge talked the team through the reforms at a sales meeting in June 2026. No materials, no attendance record. The register stays empty until the underlying process exists, and an empty register is an honest answer to the report but a poor one to be giving. 02_AMLCTF_Program sets out the process.

R10. Personnel due diligence register

The checks done on people going into roles that touch customers, transactions or records — and on the compliance officer's own eligibility. AUSTRAC's list of check types is specific (licensing, open source, police, qualifications, references, sanctions and PEP, social media, news and media, bankruptcy, credit, ASIC banned and disqualified, identity), so record which were done rather than 'checks completed'.

• Feeds: §2.3 governance and training.
• Write in it: Before the person starts in the role, and on your re-check cycle.
• Not in place today — you told us so: New salespeople are checked for a current licence and a reference is taken from their previous agency. Nothing is written down, and administrators are not checked at all. The register stays empty until the underlying process exists, and an empty register is an honest answer to the report but a poor one to be giving. 02_AMLCTF_Program sets out the process.

R11. Program and risk assessment change log

Every change to the risk assessment or the policies, with the trigger recorded. AUSTRAC does not simply ask whether you changed the program — it asks what prompted the change, from a fixed list of triggers. A change log without a trigger column cannot answer that question. s26N also requires updates to be documented within 14 days.

• Feeds: §2.2 the program.
• Write in it: Within 14 days of the change (s26N).

R12. Governing body and senior management reporting log

What was reported upwards, when, and in what form. The compliance officer must report to the governing body at least once every 12 months (s26L, s116), and AUSTRAC separately asks which matters were reported internally during the period, from a fixed list. AUSTRAC treats reporting internally as a recorded notification — an email, a written brief, or attendance at a minuted meeting.

• Feeds: §2.2 the program, §2.3 governance and training.
• Write in it: At least every 12 months, plus every interim escalation.

R13. AUSTRAC communications log

Everything received from AUSTRAC — entity-specific correspondence, industry correspondence and published guidance — and what you did about it. This register does double duty: AUSTRAC asks whether you have a documented procedure for recording and considering its feedback, and under s26C you must take account of risk information AUSTRAC communicates about your designated services, with s26D making receipt a review trigger.

• Feeds: §2.2 the program, §2.6 record keeping.
• Write in it: On receipt, with the action closed out and dated.

R14. Delivery channel and technology log

How designated services were actually delivered during the year, and anything new that was introduced. AUSTRAC asks how you delivered services, whether any method was introduced during the period, and whether you risk-assessed the new one — three questions that a business only answers accurately if it noticed the change at the time.

• Feeds: §2.1 enrolment and delivery, §2.2 the program.
• Write in it: Before a new channel or tool goes live — the assessment is supposed to come first.
• Not in place today — you told us so: Nothing formal. New services get discussed at the monthly directors' meeting but there is no link to a risk assessment because there isn't one. The register stays empty until the underlying process exists, and an empty register is an honest answer to the report but a poor one to be giving. 02_AMLCTF_Program sets out the process.

R15. Outsourcing register

Any AML/CTF function performed for you by someone else, with the provider's legal business name. AUSTRAC's list is specific: customer identification, program development, transaction monitoring, transaction reporting, enhanced customer due diligence and training. It then asks for the provider's legal name and, for outsourced program development, whether you have confirmed the program is tailored to your business and its ML/TF risks.

• Feeds: §2.2 the program.
• Write in it: On engaging a provider, and reviewed at least annually.

R16. Enrolment detail change log

Every change to the details AUSTRAC holds — address, services, compliance officer, primary contact — with the date you updated AUSTRAC Online. s51F gives you 14 days from the change occurring, and AUSTRAC's form asks both whether details changed and whether you notified it.

• Feeds: §2.1 enrolment and delivery.
• Write in it: Within 14 days of the change occurring.

R17. Client money register

Money you receive, hold or control for a customer, and what it was for. You told us you handle client money: Agency trust account — sale deposits only, held to settlement. Where money is held for anything beyond the transaction itself, that is the point AUSTRAC's own starter-kit eligibility line is drawn at, and each such instance belongs on this register with the reason.

• Feeds: §2.4 customer due diligence, §2.5 reporting.
• Write in it: On receipt and on release.

R18. Third-party reliance register

Every customer whose identification you took from someone else rather than doing yourself, and what you did to verify it. You told us you rely on: Purchasers' conveyancers and solicitors for anything to do with the buyer side. AUSTRAC's form asks separately whether you obtain customer identification information from brokers and whether you verify it — two questions with two different answers.

• Feeds: §2.4 customer due diligence.
• Write in it: At the point you accept someone else's customer information.
• Not in place today — you told us so: We assume the purchaser's solicitor has done their own checks. We have never asked to see them. The register stays empty until the underlying process exists, and an empty register is an honest answer to the report but a poor one to be giving. 02_AMLCTF_Program sets out the process.

R19. Auction CDD timing log

Auction sales, with the time between the fall of the hammer and CDD being completed. AUSTRAC contemplates initial CDD being delayed where completing it would disrupt the ordinary course of business, and names the hammer-to-contract gap as the example. A delay you can point to a policy and a closing date for is a control; the same delay with no record is a gap.

• Feeds: §2.4 customer due diligence.
• Write in it: On the day of the auction, closed out when CDD completes.

R20. Overseas connection register

Customers, funds, structures or property with a connection outside Australia, and which country. You told us: Two Singapore-based buyer's agents introduce purchasers to the commercial team; a small number of vendors are expatriate Australians resident overseas. The country factor is one of the four mandatory s26C risk factors, and it is the one most often answered from impression rather than from a count.

• Feeds: §2.4 customer due diligence.
• Write in it: Whenever an overseas connection is identified.

5.54. What you would be answering today

Computed from your questionnaire answers, as a starting position rather than a result. Everything here moves during the year, which is the point of the registers.

4.1 Your designated service register does not start empty

You told us about 4 live matters. Every one of them is already a row: the designated service has started, so the customer, the start date and the CDD position all belong on the register now rather than from the next matter onwards.

• 2 rows would go on with customer due diligence not confirmed complete. Those are also the priority actions in 00_Gap_Analysis.
• 1 row cannot be dated, because we do not know your role and therefore when the designated service started.
• 1 row with CDD confirmed complete and recorded.

4.2 Your customer numbers, in AUSTRAC's categories

Your section D answers already map onto AUSTRAC's own customer-type list, so this question is answerable from the customer register the moment it exists.

• Total customers taken on: 147 — AUSTRAC's 2025 band for that is 101-1,000. Not yet verified — the band set for your period; these are the 2025 form's bands.
• The report asks for customers rated high risk or above and the number identified as PEPs. Neither is derivable from what we hold: they come from the customer register's own risk rating and PEP columns, which is why those columns are in R2.

4.3 Which of these registers have a real process behind them today

From your section E answers. A register with no process behind it will stay empty, and an empty register in September is the same problem as no register at all — it just looks better.

7 processes named above are not in place today. Each is a question on the report with an answer you would not want to give, and each is addressed in 02_AMLCTF_Program. Standing the register up is the smaller half of the job; the process it records is the larger half.

4.4 Outsourcing — this pack is an answer to one of the questions

AUSTRAC's 2025 form asks which AML/CTF functions were outsourced, and names AML/CTF program development as one of them. It then asks for the provider's legal business name and whether you have confirmed the program is tailored to your business and its ML/TF risks.

We prepared these documents, so if that question survives into your report the honest answer names us — and the tailoring confirmation is yours to make, not ours to assert. That is what the review and the s26P approval are for: read the risk assessment, test it against how the business actually runs, amend what does not fit, then approve it. Record the answer in the outsourcing register when you do. Not yet verified — whether the reformed report keeps this question.

Your reliance on someone else for customer identification is a separate matter from outsourcing and is asked about separately (the broker questions in 2.4). Keep them apart in your own records too — reliance arrangements sit under ss37–38, and outsourcing does not make the obligation someone else's either way.

5.65. The reminder schedule

Put these in whatever calendar the business actually uses. The point of the cadence is that nothing has to be reconstructed in the submission window.

Do not wait for the reminder email. AUSTRAC sends them, but the obligation is yours whether or not one arrives, and reminders go to the addresses AUSTRAC holds — which is a good reason to check those addresses this quarter rather than next August.

5.76. What this document is not

• Not the report, and not a completed draft of it. The question set for your period is not published in a form we have read, and we do not write question sets we have not seen.
• Not us filing for you. We do not lodge your compliance report under this engagement. The first Tranche 2 reports fall due in the window opening 1 July 2027 and support for that is a separate engagement.
• Not an audit and not an independent evaluation. Having prepared your program we are disqualified from evaluating it. Referral only.
• Not legal advice. Document preparation, led by a Chartered Accountant.

Sources

Prepared from the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (in-force compilation C62, register ID C2026C00274, in force 1 July 2026) and from guidance published by AUSTRAC. AUSTRAC-produced material is © AUSTRAC for the Commonwealth of Australia and is reused under Creative Commons; Commonwealth legislation is reproduced from the Federal Register of Legislation. Deplexify is not affiliated with, endorsed by, or acting on behalf of AUSTRAC.

• AUSTRAC — annual compliance reports
• AUSTRAC — preview questions in the AUSTRAC 2025 compliance report (pre-reform, quoted here for the shape of the form only)
• AUSTRAC — AUSTRAC compliance reports
• AUSTRAC — real estate designated services
• AUSTRAC — real estate program starter kit
• AML/CTF Act 2006, in-force compilation
• AUSTRAC — your AML/CTF program