The AML/CTF independent review for real estate agencies: who can do it, what it covers and when yours is due

Why the review exists

Your own reviews of the program check that it is up to date. The independent evaluation checks that it works: does it contain what the Act and the Rules require, does the risk assessment describe this agency honestly, do the policies answer those risks, and do the sales team and the trust accountant actually do what the document says? The findings go to the principal or the directors and feed the next version of the program.

Not the trust account audit

State licensing law requires an annual audit of the trust account by an auditor. The AML/CTF independent evaluation is a different obligation under Commonwealth law, on different records: the program, the vendor and buyer files, the reports and the training log. Your trust account auditor may be able to do both if they have AML/CTF knowledge, but one does not satisfy the other.

Who counts as independent

Someone with the skills to assess an AML/CTF program who was not involved in designing or operating it. The Rules do not require an external person; a director with no compliance role could do it in a larger group. In an office of one to ten people the options are a compliance consultant, an accountant or lawyer with AML/CTF experience, or a reciprocal arrangement with a peer agency. The compliance officer cannot review their own program.

What the reviewer looks at

• The program and its version history: enrolment, risk assessment, due diligence for both parties, monitoring, reporting, records, training, governance; each version approved by a senior manager.
• The risk assessment against reality: price points, off-the-plan and development sales, overseas and remote buyers, cash policy.
• Vendor and buyer files, sampled across campaigns: identification, verification within the delayed window, beneficial owners, risk rating, reviews.
• Reports: SMRs and TTRs lodged within the deadlines with the reasoning on file; the annual compliance report lodged.
• Training and screening records for the sales team.
• Findings table and recommendations, with management's response.

When it is due

At least once every three years. The Transitional Rules 2026 stagger the first evaluation for entities that became reporting entities with the reforms, by the last two digits of the AUSTRAC account number: odd then odd, 30 June 2029; odd then even, 31 December 2029; even then even, 30 June 2030; even then odd, 31 December 2030. After the first one, the three-year clock runs from each evaluation. A material change to the program is a reason to bring the next one forward.

Scoping it for a small agency

Agree the scope in writing: the program, a sample of vendor and buyer files (say ten, across risk ratings and including one auction), all reports in the period, the training log, the compliance officer's notes. Half a day is realistic: an hour on the program and its history, an hour sampling files against the due diligence policy, an hour of interviews with the compliance officer and one or two salespeople, and the write-up. Ask for a short report with a findings table: requirement, what was found, rating, recommendation. File it with the program; the annual compliance report asks whether an evaluation was done.

What reviewers find most often in agencies

Each of these is a record-keeping habit. An agency that keeps vendor and buyer files, reviews and training in one place walks into the review with the evidence already assembled, which is what RealtyAML's audit trail and exports are for.

• Buyers verified after the delayed-verification deadline, or not at all when the sale settled quickly.
• Beneficial owners not documented for buying companies and trusts.
• Risk assessments that never mention overseas buyers although the agency sells to them.
• Training recorded once, at commencement, and never again as salespeople joined.
• Program updates without a recorded approval.