Two weeks into Tranche 2, the mistakes agencies are actually making

Obligations commenced 1 July 2026. Two weeks in, some patterns are showing up.

Not fraud. Not deliberate corner-cutting. Small process gaps that feel harmless in week one and turn into a real problem by month three.

The fastest way to check where your agency stands is the AUSTRAC Readiness Check inside AML Simple. It takes around 5 minutes and flags exactly which of these gaps apply to you. Below is what it's built to catch, and what agencies handling it well are doing instead.

1. Treating CDD as a one-off tick-box

The pattern: verify the buyer once, file the ID copy, move on. Never look at it again until the file's audited.

CDD isn't a stamp you apply and forget. Reporting entities are required to keep customer due diligence current and to reassess it when circumstances change, not just complete it once at the start.

Agencies that are handling this well tend to treat verification as the start of a file, not the end of one. A common fix is a simple flag on the client record that prompts a re-check if something changes, a new entity structure, a new authorised signatory, a change in the transaction itself.

2. Verifying identity after settlement, not before the designated service

The pattern: get the paperwork moving, chase the ID documents whenever there's a spare hour, sometimes after the contract is signed.

Under the Act, CDD is generally required before providing the designated service, not after. Doing it retrospectively defeats the purpose and leaves a gap in the record for exactly the period it's meant to cover.

A common fix agencies are landing on is building the ID check into the intake step itself, before an offer is drafted, not somewhere in the settlement admin pile.

3. Records that exist but can't actually be found

The pattern: the ID documents are somewhere. In an inbox. On a shared drive. In someone's downloads folder. Technically retained, practically unsearchable.

Records must be kept, and "kept" implies retrievable. An AUSTRAC request or an internal review that takes three days of digging through old emails to answer isn't a record-keeping system, it's a filing accident.

Agencies handling this well tend to centralise the record at the point of verification, so there's one place to look, not five.

4. Collecting the ID document without verifying it

The pattern: the client emails a photo of their licence, it gets attached to the file, and that's treated as done.

Having a copy of an ID document is not the same as verifying it. Verification means checking the document is genuine and that it matches the person in front of you, not just holding a scan on file.

A common fix is running the document through an actual verification step, rather than eyeballing it and moving on. AML Simple's client verification workflow does this as part of sending the ID check link.

5. No ongoing awareness once the transaction is underway

The pattern: CDD's done at the start, then nobody's watching for anything unusual as the deal progresses.

Reporting entities are required to monitor transactions for the duration of the designated service, not just clear the client at intake and stop paying attention. A cash top-up mid-transaction, a last-minute change of purchaser, an unusual payment source, these are the kinds of things ongoing awareness is meant to catch.

Agencies that are on top of this tend to build a simple habit of re-checking anything that changes about the deal, not just the person.

6. Assuming the CRM already covers it

The pattern: "we've got a CRM, surely it handles this."

Most real estate CRMs were built for listings and pipeline management, not AML/CTF obligations. They weren't designed to enforce CDD timing, keep a defensible audit trail, or flag ongoing monitoring gaps. Some newer AML tools are built as CRM add-ons and inherit the same blind spot from the other direction, tied to a single CRM instead of standing alone.

A common fix is running a purpose-built compliance workflow alongside the CRM rather than assuming general-purpose software covers a specific obligation it was never designed for.

7. Treating "we enrolled" as "we're done"

The pattern: enrolment with AUSTRAC felt like the big milestone, so once it was submitted, attention moved elsewhere.

Enrolment and the compliance officer notification are steps, not the finish line. The compliance officer must be notified to AUSTRAC by 29 July 2026, and enrolment completed by the same date, but a written AML/CTF program, CDD processes, and ongoing record-keeping are separate obligations that continue well past that date.

Agencies handling this well are treating enrolment as one item on a longer list, not the list itself.

Where a tool helps

None of these mistakes come from agencies not caring. They come from AML/CTF sitting on top of a busy sales calendar with no dedicated system underneath it.

One option is AML Simple. The AUSTRAC Readiness Check flags which of these seven gaps apply to your agency in around 5 minutes, and the record-keeping, verification, and monitoring workflows are built to close them without needing a compliance background to operate. It's a tool for running the workflow, not a substitute for your own judgement on individual client decisions.

If you'd rather work through it manually, the checklist above is a reasonable starting point, and our guide on what a completed AML/CTF program looks like covers the documentation side in more detail. For the record-keeping obligation specifically, see AML record-keeping requirements for real estate.

Maximum civil penalties run up to A$36.4 million per contravention for a body corporate, or A$7.28 million per contravention for an individual (based on the A$364 penalty unit from 1 July 2026). The point isn't the fine. It's that the gaps above are the ones that show up in your own records first, which is exactly where a review or audit looks.