Customer due diligence for real estate agencies: a complete guide
A plain-English guide to customer due diligence (CDD) obligations for Australian real estate agencies under AUSTRAC Tranche 2. Covers what to collect, when to verify, enhanced CDD triggers, beneficial ownership, and how to build CDD into your workflow.
Quick answer
Customer due diligence (CDD) requires every Australian real estate agency that buys or sells property on behalf of clients to verify each client's identity before acting on their behalf — from 1 July 2026. That means collecting name, date of birth, and address, verified against a government-issued photo ID or electronic verification service. Companies and trusts require additional beneficial ownership checks. Records must be kept for 7 years.
Key facts
- CDD applies from 1 July 2026 to real estate agencies that buy or sell real property on behalf of a customer as a designated service under the AML/CTF Act 2006.
- CDD must happen before the service commences — before the agency acts on a client's behalf, not at settlement or contract exchange.
- Both buyers and sellers must be verified — not just buyers.
- Three verification methods are acceptable: in-person document inspection, electronic verification, or video-call verification.
- Beneficial owners of companies and trusts must be identified and verified — not just the entity name.
- Enhanced CDD is required when a customer is a Politically Exposed Person, the source of funds is unclear, or the transaction structure is unusual.
- CDD records must be retained for 7 years and must be retrievable if AUSTRAC requests them.
- Pure property management (leasing, tenancy) is not a designated service — CDD applies to sales transactions only.
Source: AML/CTF Act 2006, ss 6, 34B, 36; AUSTRAC Tranche 2 summary
Customer due diligence is one of the most operationally intensive parts of AML compliance for real estate agencies — and the part most likely to directly change how your staff interact with clients every day.
From 1 July 2026, every real estate agency that brokers property sales must verify the identity of buyers and sellers before providing a designated service. That means no more "we'll sort the paperwork later." CDD must happen before the agency acts on a client's behalf.
This guide covers everything your agency needs to understand about CDD: what it means, when it applies, what you must collect and verify, and how to build the workflow into your day-to-day operations without slowing down your settlements.
Start your CDD process in under 5 minutes
The fastest way to understand where your agency stands on CDD is the AML Simple compliance check. Answer 8 questions about your current setup and you'll get a personalised report showing exactly which parts of your CDD process are in place and which need attention.
From there, AML Simple's CDD workflow lets you send a verification link to clients from your phone. They complete identity verification in their own time — uploading documents, confirming details — and the result is recorded automatically against their file.
No paper forms. No chasing documents at settlement. No manual data entry. Every verification is stored for the required 7 years.
See AML Simple features for the full list of what's included, or go straight to pricing to see plans from A$79/month.
For a walk-through of the verification process from a client's perspective, read How to run your first client screening.
What is customer due diligence?
Customer due diligence is the process of identifying your clients and verifying that they are who they say they are — and, where a client is a company or trust, identifying and verifying the real people behind the entity.
The purpose is straightforward: money laundering in real estate depends on using property transactions to move and conceal criminal proceeds. The first line of defence is knowing who your clients are and ensuring the identities they present are genuine.
CDD in AML/CTF law is not the same as the identity checks your agency may already do for tenancy applications or purchaser deposit paperwork. The AML requirements are more specific about what you must collect, how you verify it, and what happens when something doesn't match.
The obligation comes from Part 2 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, which defines the CDD process real estate agencies must follow for each designated service. AUSTRAC has issued supplementary guidance on how the CDD rules apply specifically to the real estate sector.
When does CDD apply?
Under the 2026 reforms, CDD obligations for real estate agencies apply to designated services — specifically, the service of buying or selling real property on behalf of a customer as part of a real estate business.
CDD must be completed before you provide the designated service. In practice, this means before the agency begins to act on behalf of a buyer or seller — not at settlement, not at contract exchange, but before the agency takes any substantive step in the transaction on the client's behalf.
Key timing rules:
- New clients: Full CDD before the designated service commences
- Existing clients: CDD must be refreshed when the risk profile changes materially, when you have doubts about the accuracy of previously collected information, or when AUSTRAC guidance requires it
- Unusual circumstances: If a situation arises mid-transaction that raises new concerns about identity or source of funds, your program must address how to handle it
For a detailed breakdown of the timing rules — including the CDD transition period and what it does and does not cover for real estate — read When does CDD apply in real estate transactions?
Does CDD apply to property managers?
Pure property management — leasing properties, managing ongoing tenancies, collecting rent — is not a designated service under the 2026 Tranche 2 reforms. CDD obligations do not apply to those activities.
The designated service is specifically the buying or selling of real property on behalf of a customer. If your agency conducts both sales and property management, CDD applies to the sales transactions only.
This is a common source of confusion for agencies that run combined sales and property management businesses. Your AML/CTF program should be clear about which parts of your business are in scope.
For a more detailed analysis, read Do property managers need AML compliance in Australia?
The three levels of CDD
Standard CDD
Standard CDD applies to the majority of your clients — individual buyers and sellers with a low to medium risk profile.
For individual customers, standard CDD means collecting and verifying:
| Required information | How to verify |
|---|---|
| Full legal name | Government-issued photo ID (driver licence, passport) |
| Date of birth | Government-issued photo ID |
| Residential address | ID or secondary document (utility bill, bank statement less than 3 months old) |
Verification means checking that the identity document is genuine (not expired, not obviously forged) and that the person presenting the document matches the image on it. For remote transactions — increasingly common in real estate — electronic verification or video-call verification is an acceptable alternative.
AML Simple's digital verification flow handles this automatically. Your client receives a link, uploads their documents, and the system cross-checks the information and records the outcome.
Enhanced CDD
Enhanced CDD (ECDD) applies when a customer's risk profile indicates higher than usual risk. Your program must define the triggers — the conditions that escalate a client from standard to enhanced CDD — and what enhanced CDD requires in practice.
Common ECDD triggers for real estate agencies:
- The customer is a Politically Exposed Person (PEP) or a close associate of one
- The source of funds for the purchase is unclear or inconsistent with the client's stated profile
- The transaction structure is unusual (multiple purchasers, complex trust arrangements, offshore entities)
- The customer is reluctant to provide CDD information or provides documents that don't match
- The transaction involves a jurisdiction on AUSTRAC's higher-risk list
What enhanced CDD looks like in practice:
- More information about the source of funds (bank statements, evidence of asset sale, business income documentation)
- Senior management sign-off before the agency proceeds
- Closer ongoing monitoring of the transaction
- Potentially, a Suspicious Matter Report if the concerns cannot be resolved
Enhanced CDD does not automatically mean refusing the transaction. It means taking additional steps to satisfy yourself that the transaction is legitimate before proceeding.
Simplified CDD
Simplified CDD applies in limited circumstances where the risk is demonstrably low — typically when the customer is another regulated entity (a bank, a listed company, a government body) where the AML obligations are equivalent to your own.
For most real estate agencies, simplified CDD applies rarely. Do not assume that a client "looks low risk" qualifies for simplified CDD — your program must specify the precise conditions under which it applies.
Beneficial ownership: going behind the entity
One of the most significant CDD obligations for real estate agencies is the requirement to identify beneficial owners — the real individuals who ultimately own or control a client that is not a natural person.
When your buyer is a company, a family trust, or an SMSF, you cannot simply verify the details of the company name. You must identify the individuals who own or control the entity and verify their identities.
For companies:
- Identify individuals who own (directly or indirectly) more than 25% of the company's shares or voting rights
- If no individual meets the 25% threshold, identify the senior management official who controls the company (the "beneficial owner by control" pathway)
For trusts:
- Identify the trustee (if corporate, apply the company rules above)
- Identify all beneficiaries who are named or determinable
- Identify the settlor of the trust
- Identify any person who controls the trust — including the power to vary, terminate, or appoint trustees
For SMSFs:
- Identify all trustees (if individual trustees, apply standard CDD)
- For corporate trustees, apply the company beneficial ownership rules
Beneficial ownership verification is one of the harder parts of real estate CDD because the information is not always readily available and clients do not always understand why you need it. Your program must describe how you request this information, what documents you accept as evidence, and what you do when a client cannot or will not provide it.
For a detailed guide, read Beneficial ownership in real estate AML: what agencies must know.
Source: AML/CTF Act 2006, s 34B; AUSTRAC beneficial ownership guidance
Identity verification methods
The 2026 reforms give agencies flexibility in how they verify identity. The methods your program must cover:
In-person document inspection
The traditional method: the client presents original identity documents in person, the agent inspects them, and records the details. For face-to-face transactions this is still a reliable option, but it creates manual record-keeping obligations.
Electronic verification
Electronic verification services cross-reference the client's details (name, date of birth, document number) against government and commercial databases. When the check passes, it produces a verification record that is stored automatically.
AML Simple's built-in electronic verification covers Australian driver licences and passports. It satisfies the verification standard for standard CDD on individual clients.
Video call verification
Where in-person inspection is not practical and electronic verification cannot be completed (for example, for a foreign national without Australian documents), a live video call where the client holds up their documents is an acceptable alternative. Your program must document the specific standards that apply (what documents, how the call is recorded, how the result is documented).
Buyers vs sellers: is the obligation the same?
Under the 2026 reforms, real estate agencies must conduct CDD on both the buyer and the seller in a property transaction.
This surprises many agencies whose prior identity practices focused on buyers (for deposit purposes) but not sellers (who are presumably the ones being paid). The AML logic is that real estate is used for laundering on both the buy and sell side — a criminal can purchase property to park funds and then sell it to repatriate cleaned proceeds.
Key differences in the buyer and seller CDD process:
- Buyers must be verified before the agency begins to act on their behalf — before showing properties or making offers
- Sellers must be verified before the agency accepts the listing and begins acting on their behalf — before the property goes to market
- For sellers, beneficial ownership verification is equally important — especially for properties held in company or trust structures
For a detailed comparison of CDD obligations between transaction types, read AML compliance for buyers' agents vs sales agents: what's different?
Identity documents, privacy, and data retention
Collecting and storing identity documents creates obligations under both the AML/CTF Act and the Privacy Act 1988.
AML/CTF requirements:
- CDD records must be retained for 7 years from the date the verification was conducted
- Records must be accurate and retrievable — you must be able to produce them if AUSTRAC requests them
- Records of ongoing CDD (re-verification events, screening checks) must also be retained
Privacy Act requirements:
- You must only collect information that is necessary for the purpose (CDD)
- You must store it securely and protect it against unauthorised access
- Clients have rights to access and correct their information
- Your privacy policy must reflect that you collect identity information for AML/CTF compliance
AML Simple stores all CDD records in Australia (Sydney data centre) and meets both the AML/CTF retention requirement and Australian Privacy Principle 11 (security of personal information).
For a detailed guide to the privacy and data implications, read Identity documents, privacy, and AML compliance in real estate.
What happens when CDD cannot be completed?
There will be situations where a client cannot or will not complete CDD. Your program must tell your staff what to do.
Your obligations when CDD cannot be completed:
- You must not commence or continue the designated service (you cannot take on the listing or act for the buyer)
- If the failure to complete CDD raises concerns about why the client is unwilling, you may need to consider whether to lodge a Suspicious Matter Report
- You must document the decision not to proceed and the reason
This is one of the harder conversations in real estate: telling a prospective client that you cannot act for them without completing their identity verification. Your program should include a script or guidance for how to have that conversation in a way that is clear, professional, and does not trigger the tipping-off prohibition (you cannot tell a client that you are considering lodging an SMR).
Ongoing CDD: it doesn't end at onboarding
CDD is not a one-time event at the start of a client relationship. The Act requires ongoing CDD — monitoring your client relationships over time and updating records when circumstances change.
For most real estate transactions, the "ongoing" obligation is limited because the relationship is transactional: one property, one transaction, one engagement. But if your agency works with repeat clients — investors who buy and sell regularly, developers, or estate clients with multiple properties — you must maintain current CDD records for each engagement.
Triggers for re-verification:
- A material change in the client's circumstances (change of name, change of beneficial owners for a company)
- Doubts about the accuracy of previously collected information
- A change in the client's risk profile that would trigger enhanced CDD
- A new transaction that is materially different from prior ones (different scale, different source of funds, different counterparties)
For the full record-keeping framework, read AML record-keeping requirements for real estate agencies.
Building CDD into your agency workflow
The most common operational complaint about AML compliance from agency principals is the friction it adds to client onboarding. The good news is that with the right workflow, CDD can be a near-invisible step in your existing process.
Recommended workflow with AML Simple:
- At listing presentation (for sellers) or first buyer consultation: explain that your agency uses a digital identity verification system and that verification is required before you can act
- Send the verification link from the AML Simple app — the client receives a link, completes verification on their phone in 2–3 minutes
- The verification result is recorded automatically — no manual data entry, no document scanning, no paper filing
- If Enhanced CDD is required, the app flags this and guides you through the additional steps
- At each subsequent engagement, AML Simple reminds you if re-verification is due
The goal is to make CDD feel like part of your professional onboarding process — not a compliance burden that happens in parallel to your actual work.
Not sure where your agency is right now? Run the /check compliance quiz — it takes 3 minutes and gives you a personalised gap analysis across all your CDD obligations.
CDD and the transition period
The 2026 reforms included a CDD transition period for existing clients. This period does not apply to real estate agencies in the same way it applies to other reporting entities. Real estate agencies are required to conduct CDD on all clients for each designated service — the transition period does not reduce this obligation.
For a clear explanation of what the transition period covers and what it does not cover for agencies, read Why the CDD transition period does not apply to real estate agents the way you might expect.
FAQ
What is customer due diligence for real estate agents in Australia?
Customer due diligence (CDD) is the process of identifying your clients and verifying their identity before you act on their behalf in a property transaction. From 1 July 2026, Australian real estate agencies that buy or sell property on behalf of customers must collect and verify each client's full name, date of birth, and residential address using a government-issued photo ID or an approved electronic verification service. For companies and trusts, you must also identify and verify the beneficial owners — the real individuals who control the entity.
Source: AML/CTF Act 2006, Part 2; AUSTRAC CDD guidance for Tranche 2 entities.
When do I need to do CDD in a property transaction?
CDD must be completed before the agency begins to act on a client's behalf. For sellers, that means before accepting the listing. For buyers, it means before showing properties or making offers. It cannot be deferred to contract exchange or settlement. If you have an existing client and their circumstances change materially — new beneficial owners, a change in risk profile, or doubts about the accuracy of your records — you must re-verify before the next designated service. There is no "we've dealt with them before" exemption.
How do I verify a client's identity for AML compliance?
Three methods are acceptable under the 2026 reforms: (1) In-person inspection — the client presents original government-issued photo ID, you inspect it and record the details; (2) Electronic verification — a digital service cross-checks name, date of birth, and document number against government databases, producing an automatic verification record; (3) Video-call verification — the client holds up their documents on a live call, suitable for clients without Australian documents. AML Simple's built-in electronic verification covers Australian driver licences and passports and satisfies the standard CDD requirement for individual clients.
What documents do I need for customer due diligence?
For an individual client, you need: a government-issued photo ID (Australian driver licence or passport) to verify name and date of birth, plus proof of residential address (the photo ID itself, or a secondary document — utility bill or bank statement less than three months old). For a company client, you need the company's ACN, ASIC registration documents, and identity verification for each beneficial owner. For a trust, you need the trust deed, trustee identity documents, and identification of all beneficiaries and controllers.
Does CDD apply to property managers?
No — the Tranche 2 reforms apply specifically to agencies that buy or sell real property on behalf of a customer. Pure property management activities (leasing, tenancy management, rent collection) are not designated services and do not trigger CDD obligations. However, if your agency runs combined sales and property management operations, CDD applies to every sales transaction. Your AML/CTF program should clearly delineate which parts of your business are in scope. See Do property managers need AML compliance in Australia? for the full analysis.
What is enhanced CDD and when does it apply?
Enhanced CDD (ECDD) applies when a client's risk profile is elevated beyond the standard level. Your AML/CTF program must define the specific triggers. Common triggers include: the customer is a Politically Exposed Person (PEP) or a close associate; the source of funds for the purchase is unexplained or inconsistent with the client's profile; the transaction involves multiple purchasers, offshore entities, or complex trust structures; or the client is reluctant to provide standard CDD documents. Enhanced CDD typically requires source-of-funds documentation, senior management approval, and more intensive ongoing monitoring.
What is beneficial ownership and why does it matter for real estate?
Beneficial ownership means identifying the real people who ultimately own or control an entity — a company, trust, or SMSF — rather than just recording the entity name. Real estate is a well-documented vehicle for money laundering through corporate and trust structures because the real owner can be hidden behind multiple layers of entities. The AML/CTF Act requires you to identify individuals who own more than 25% of a company or who exercise control over a trust, and to verify those individuals' identities. You cannot complete CDD on a company client without going through this process.
What happens if a client refuses to complete CDD?
You must not commence or continue the designated service. This means not accepting the listing and not acting as the buyer's agent. If the refusal raises concerns — for example, the client becomes hostile or offers implausible reasons — you may need to consider whether to lodge a Suspicious Matter Report (SMR) with AUSTRAC. You must document the decision not to proceed. You cannot tell the client you are considering an SMR — this is the tipping-off prohibition under the Act, which carries its own penalties.
How long must CDD records be kept?
CDD records — including the original verification documents, the outcome of the verification, and the date it was conducted — must be retained for 7 years from the date of the verification. This is set by the AML/CTF Act 2006. The records must be accurate, accessible, and capable of being provided to AUSTRAC on request. This applies to re-verification records and any ongoing CDD checks as well as the initial onboarding verification.
Do I need CDD for both buyers and sellers?
Yes. Many agencies assume CDD only applies to buyers (because buyers are the ones bringing money into the transaction). But real estate laundering operates on both sides: property can be purchased to place criminal funds and sold to repatriate them. From 1 July 2026, your agency must verify the identity of every buyer and every seller before providing the designated service. This includes verifying the beneficial owners of any company or trust that appears on either side of a transaction.
What is the fastest way to build a CDD process for my agency?
Start with the AML Simple /check quiz. It takes 3 minutes and assesses your current setup against all CDD requirements, giving you a personalised gap report. From there, the AML Simple app gives you a CDD workflow that handles client verification links, document collection, electronic verification, and 7-year record storage — without manual data entry. For a full walkthrough, see AML Simple features or start directly at app.amlsimple.com.
Summary: the CDD checklist for your agency
Before 1 July 2026, your agency should be able to confirm:
- Your AML/CTF program includes documented CDD procedures for individual buyers, individual sellers, companies, and trusts
- Your staff know when to collect CDD, what to collect, and how to verify it
- Your agency has a method for electronic or in-person identity verification
- You have a documented process for beneficial ownership identification
- You have a documented process for when CDD cannot be completed
- Your CDD records are stored securely and retained for 7 years
- Your staff know the triggers for Enhanced CDD and what it involves
- You have a process for ongoing CDD and re-verification when circumstances change
Related reading
- Customer due diligence for real estate: a plain-English guide — the original CDD overview
- When does CDD apply in real estate transactions? — timing rules in detail
- Beneficial ownership in real estate AML — company and trust verification
- AML compliance for buyers' agents vs sales agents — how CDD differs by transaction role
- Identity documents, privacy, and AML compliance — Privacy Act obligations alongside AML
- Do property managers need AML compliance in Australia? — scope clarification for mixed agencies
- AML record-keeping requirements for real estate agencies — 7-year retention in practice
- Your AML/CTF program: a complete guide — the full compliance framework including CDD procedures
This content is general information only and does not constitute legal or AML/CTF advice. For tailored advice, consult a licensed AML/CTF advisor. AML Simple is a compliance tool, not a law firm.
Ready to build CDD into your agency workflow? Start your compliance check at /check — free, 3 minutes, personalised results.