The Privacy Act change that came with AUSTRAC enrolment

Australian real estate professionals became AUSTRAC reporting entities on 1 July 2026. The sector prepared hard for the obligations it was told about: enrolment, an AML/CTF program, a compliance officer, customer due diligence, suspicious matter reporting, seven year record keeping and staff training.

A second change arrived on the same day and was covered far less. Becoming a reporting entity removes the small business exemption from the Privacy Act for the personal information an agency handles for AML/CTF purposes, regardless of turnover. That's the change this article lays out: what commenced, exactly how far the privacy change goes, where identity documents actually end up in an agency, and the two dates that belong in the diary. It's general information for agents, not legal advice.

What commenced on 1 July 2026

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 extended Australia's AML/CTF regime to a second tranche of businesses from 1 July 2026. Real estate professionals are in it, alongside lawyers, conveyancers and accountants. Trust and company service providers are in too, as are dealers in precious metals and stones. For an agency the designated service is brokering the sale, purchase or transfer of real estate on behalf of a vendor or a purchaser. Leasing and property management aren't designated services, which matters later.

Enrolment with AUSTRAC opened on 31 March 2026. A business has 28 days from the day it first provides a designated service to enrol, so for an agency trading on 1 July the window closed on 29 July 2026. The reporting entity is the business providing the service, usually the agency, and the obligations sit with it.

The obligation everyone prepared for

Most agencies spent the first half of 2026 on the list AUSTRAC published. Enrol. Assess the money laundering and terrorism financing risk of the business. Write an AML/CTF program and appoint a compliance officer. Train staff. Carry out customer due diligence on the parties to a transaction. Report suspicious matters. Keep records for seven years.

Customer due diligence is the part a salesperson touches every week. Acting for a vendor, the agency has to complete initial due diligence, which in practice means verifying who the vendor is, before it starts providing the service. AUSTRAC treats the service as starting when the agreement to broker the sale is signed. That's why the identity check now comes before the signature, not after it. When the agency acts for the vendor, AUSTRAC lets the purchaser check wait where that's essential and the risk is low, but it must be done within 28 days after exchange or at least three days before the initially agreed settlement day, whichever comes first.

Verifying identity means reliable and independent documents or data: a driver's licence or passport, or other government documents backed by something like a utility bill. The agency records what it checked, such as the document type, number and result, and keeps that record for seven years after the relationship or transaction ends. AUSTRAC doesn't require a copy of the document. The OAIC's updated guidance goes further: from 1 July 2026, newly regulated businesses shouldn't keep copies of full ID documents for AML/CTF record keeping. The five year figure that turns up in search results is the United Kingdom's and doesn't apply here.

The exemption that went with it, and exactly how far it goes

Here is the second change. The Privacy Act 1988 generally doesn't apply to a small business, which for most agencies has meant never having to think about the Australian Privacy Principles. But the Act has long carried a specific provision for AML/CTF reporting entities, section 6E(1A): a small business that's a reporting entity is treated as an organisation under the Act in relation to the activities it carries out for AML/CTF purposes.

On 1 July 2026 every real estate agency providing designated services became a reporting entity. So on the same day, regardless of turnover, the Privacy Act started to apply to the personal information those agencies collect, use, hold and disclose to meet their AML/CTF obligations. The Office of the Australian Information Commissioner published guidance for reporting entities on 27 February 2026 and updated it on 28 August 2026. It says plainly that the Act applies to those activities whether or not the entity would otherwise fall inside the small business exemption.

Two things follow. The identity documents you're now required to collect are regulated personal information from the moment they land. And the agency is accountable for them under the Australian Privacy Principles: collect only what's needed, tell people what it's collected for, keep it secure, give access on request, and destroy or de-identify it once it's no longer needed for any purpose the agency is permitted to hold it for. The seven year AML/CTF rule covers the record of the check, not a copy of the document.

What "scoped to AML/CTF purposes" excludes

The change is scoped, and precision matters here, because the overclaim is the easy mistake.

The small business exemption hasn't been removed generally. Removing it for every small business hasn't been legislated, and it isn't in the draft privacy bill released for consultation on 31 August 2026. What changed on 1 July is narrower: the Privacy Act applies to a small business reporting entity's AML/CTF activities and the personal information handled for them.

So, for an agency that was a small business on 30 June:

• The identity documents and due diligence records collected for AML/CTF purposes are covered.
• Suspicious matter reports and the information gathered to make them are covered.
• The CRM notes, the appraisal history, the vendor database, the buyer enquiry list and the tenancy applications aren't covered on this basis. They sit where they always sat.

Two cautions. An agency that was already above the small business turnover threshold, or was otherwise an APP entity, has been under the Privacy Act for everything all along; nothing narrowed for it. And the line between AML/CTF information and everything else is only clean if the information is kept clean. A licence photo pasted into a CRM contact card is still AML/CTF information; it has just been copied into a system built for something else.

Leasing and property management sit outside the AML/CTF regime, so a tenancy applicant's identity documents aren't caught by this particular change. That's not the same as saying they need no care.

Where identity documents actually end up in an agency

Walk one licence photo through an ordinary week. The vendor texts it across at the kitchen table. It lands in the camera roll, which syncs to the tablet at home. It sits in the text thread. It's forwarded by email to admin. It's attached to the contact card in the CRM, which every user in the office can open. In some offices it's dropped on the shared drive as well. Five copies, one obligation, and the only one anybody remembers is the CRM.

Then the ordinary turnover of an office. The admin leaves for the agency two suburbs over and hands the laptop back. Nobody asks about the phone. Ask the licensee "which of the five was it in?" and the honest answer is "I don't know", and that's the whole problem.

The OAIC guidance suggests keeping an inventory of the personal information handled for AML/CTF purposes: why it was collected, where it's stored, who can access it and when it's destroyed. For an agency that map is mostly a list of places, and the first honest draft is longer than anyone expects.

The practical standard is one place with named access, and one habit. The details of the check go into the system the AML/CTF program names and nowhere else. Then the photo, the text and the email are deleted. The CRM holds a note that verification was done and where the record lives, not the document itself.

The Notifiable Data Breaches scheme, in one paragraph

Because the Privacy Act now applies to this information, so does the Notifiable Data Breaches scheme. If personal information you hold is lost, or accessed or disclosed without authorisation, and a reasonable person would conclude that's likely to result in serious harm to the individual, and you can't head off that harm with remedial action, you've got an eligible data breach. You must notify the affected individuals and the OAIC. If you only suspect a breach, you must assess it, and the Act gives you up to 30 days for that assessment. The OAIC guidance recommends a data breach response plan. For an agency that's a page that says who gets called, what gets checked and who tells the client. A vendor's licence sitting in a former employee's phone is the scenario to plan for.

Three questions to take to your licensee

The agency's compliance officer, the licensee and, where it matters, a lawyer own the answers. A salesperson's job is to ask the questions well.

1. Where does it actually live? Not where it's meant to live. Where every copy is right now, including the sent items.
2. Who can open it? Every person who can, not every person who needs to.
3. What happens to any copy we still hold, and who decides? The record of the check is kept seven years. The OAIC says a copy of the full document shouldn't be kept for AML/CTF record keeping. Somebody has to own that.

Before the conversation, one request to the office manager: "Every place a client's ID has landed since July. List them for me. Include your sent items." One place with named access is a good answer to walk in with. Four places is this quarter's job.

The dates: 1 July 2027, and the staggered independent evaluation

Two dates belong in the diary now.

The first annual compliance report. For businesses regulated from 1 July 2026, the first reporting period runs from 1 July 2026 to 30 June 2027, and the report is lodged with AUSTRAC between 1 July and 30 September 2027. Write 1 July 2027 down as the day the window opens.

The first independent evaluation. Under the AML/CTF Act an AML/CTF program has to be independently evaluated at least once every three years. To spread the load, the AML/CTF Transitional Rules 2026 stagger the first deadline for newly regulated businesses by the last two digits of the AUSTRAC account number. Both digits odd: 30 June 2029. Odd then even: 31 December 2029. Both even: 30 June 2030. Even then odd: 31 December 2030. The account number was issued at enrolment and sits with whoever enrolled the agency. Ask them to read out the date, then put it in your own diary as well as theirs.

AUSTRAC has said it doesn't expect newly regulated businesses to be perfect from day one, but it does expect honest efforts. That doesn't make any of the above optional. It describes how the regulator intends to respond to businesses making a genuine effort, and a genuine effort is visible in the records.

Who to ask, and what isn't your job to solve

None of this has to be solved from an article. The AML/CTF program belongs to the licensee and the compliance officer. The access settings on the CRM belong to the office manager and the software vendor. The legal questions belong to a lawyer. What a salesperson controls is the moment the photo arrives: where it goes, where it doesn't, and the sentence said out loud before the next one lands. It's not a form. It's her identity.

The quiet cost is the one nobody budgets for. The weeks an office spends on enrolment, training and folder audits are weeks in which nobody in the database hears from anyone, and the appraisals that went quiet stay quiet. If the compliance year has swallowed the prospecting hour, the next listing is already in your database waiting for the call. And if you're still catching up on the obligations themselves, Tranche 2 and what it asks of agents is the companion piece to this one.

Sources

• Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth), commenced 1 July 2026
• AUSTRAC, New reporting regime now in force: https://www.austrac.gov.au/new-reporting-regime-now-force
• AUSTRAC, Real estate designated services and customer due diligence timing: https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities/real-estate-designated-services
• AUSTRAC, Delayed initial customer due diligence: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/customer-due-diligence/initial-customer-due-diligence/delayed-initial-customer-due-diligence
• AUSTRAC, Step 5: Conduct an independent evaluation: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/step-5-conduct-independent-evaluation
• AUSTRAC, AML/CTF transitional rules 2026: https://www.austrac.gov.au/about-us/legislation/updates-legislation/amlctf-transitional-rules-2026
• Office of the Australian Information Commissioner, Privacy guidance for reporting entities under the AML/CTF Act, published 27 February 2026, updated 28 August 2026: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/privacy-guidance-for-reporting-entities-under-the-anti-money-laundering-and-counter-terrorism-financing-act
• AUSTRAC, Record keeping overview: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/record-keeping/record-keeping-overview
• Office of the Australian Information Commissioner, updated AML/CTF privacy guidance on copies of ID documents: https://www.oaic.gov.au/news/media-centre/know-your-privacy-obligations-under-the-anti-money-laundering-counter-terrorism-financing-amlctf-act-updated-oaic-guidance
• Attorney-General's Department, privacy reform consultation, draft bill released 31 August 2026: https://consultations.ag.gov.au/rights-and-protections/privacy-reform
• Privacy Act 1988 (Cth), section 6E: https://classic.austlii.edu.au/au/legis/cth/consol_act/pa1988108/s6e.html
• REIQ, Fact sheet: AUSTRAC enrolment for real estate agencies: https://www.reiq.com/articles/property-sales/fact-sheet-austrac-enrolment-for-real-estate-agencies

General information for real estate professionals. Not legal advice. Speak to your licensee or your lawyer about your own obligations.