AML/CTF CDD Requirements for Real Estate — Who Do You Need to Identify?

What is CDD?

Customer due diligence (CDD) means identifying your clients and verifying that they are who they say they are. Under Tranche 2, real estate agents must conduct CDD on both sellers and buyers — but the timing and rules are different for each.

CDD is not just a box-ticking exercise. The point is to understand who you're doing business with so you can identify suspicious patterns — like a buyer using funds from an unknown source, or a seller who doesn't match their claimed identity.

Sellers: CDD at listing

You must conduct CDD on the seller before or at the time of listing the property. This is a hard rule — there is no flexibility on timing for seller CDD.

What you need to collect from sellers

• Full legal name
• Date of birth
• Residential address
• Government-issued photo ID — driver's licence or passport
• If a company: company name, ACN, registered address, and the identity of any beneficial owners controlling more than 25%
• If a trust: trustee identity plus trust deed details

Buyers: CDD before exchange

For buyers, the timing depends on whether the sale is private or by auction.

What you need to collect from buyers

• Full legal name
• Date of birth
• Residential address
• Government-issued photo ID
• If purchasing through a company or trust: same requirements as seller entity verification above
• Source of funds — for higher-risk transactions

Legal reliance for buyer CDD

For buyer CDD only, you can rely on verification already conducted by another AUSTRAC-regulated entity — for example, if a buyer's solicitor (once lawyers are in scope) or a financial institution has already verified the buyer's identity.

This is called "legal reliance." To use it, you must have a written agreement in place with the other entity, and you must be satisfied that their verification procedures meet the required standard. Legal reliance is not available for seller CDD.

High-risk clients: Enhanced CDD

For clients assessed as higher risk — for example, politically exposed persons (PEPs), clients from high-risk jurisdictions, or transactions with unusual features — you must conduct enhanced CDD. This means:

• Obtaining more detailed information about the source of funds
• Seeking senior management approval before proceeding
• Applying enhanced ongoing monitoring
• Potentially declining the transaction if the risk cannot be adequately managed

Ongoing monitoring

CDD is not a one-off task. You must monitor your ongoing transactions for unusual patterns. This doesn't mean running checks every day — it means being alert to red flags like a client changing their payment method, a rapid resale after settlement, or instructions to pay proceeds to a third party.

Record-keeping: 7 years

All CDD records — identity documents, verification records, and transaction records — must be retained for 7 years from the date the transaction or business relationship ends. This is a legislative requirement under s.107 of the AML/CTF Act.

Use the SimpleAML app to log and store your CDD records digitally, and export them regularly as a backup.

What about existing clients?

You are not required to retrospectively verify clients you dealt with before 1 July 2026. However, if you re-engage with an existing client after 1 July 2026 on a new transaction, you must conduct CDD at that point.