You've got a vendor ready to sign and a buyer about to exchange. Who do you need to check, by when, and what does a proper check actually involve?
This is the short version. No legal jargon, just what your agency needs to do on every deal.
What KYC actually means for your agency
Since 1 July 2026, every agency that brokers property sales is a reporting entity under AUSTRAC's AML/CTF rules. KYC (Know Your Customer) is how you confirm who you're dealing with before you act for them. It's part of customer due diligence, or CDD.
For every customer, you need to establish four things:
- Who they are, verified from reliable, independent documents like a driver licence or passport.
- Who's acting for them, and their authority to do it.
- Their PEP and sanctions status: whether they're a politically exposed person (PEP) or on a sanctions list.
- Why they're dealing with you: what they're buying or selling, and how.
Then you rate their money laundering and terrorism financing risk. The higher the risk, the more you collect and verify.
The two dates that matter
When you broker a sale, the vendor and the buyer are both your customers, whichever side you act for. Each has their own deadline.
Vendor check
Buyer check
- Listing
- Agency agreement
- Exchange
- Settlement
The vendor
Before or at signing the agency agreement
No check, no agency agreement.
The buyer
Within 28 days of exchange, or three days before settlement
Whichever is earlier. Diarise it the day contracts exchange.
| Who | When the check has to be done |
|---|---|
| Vendor | Before or at signing the agency agreement |
| Buyer | Within 28 days of exchange, or three days before settlement, whichever is earlier |
The vendor is easy to remember: no check, no agency agreement. The buyer is where agencies slip. Diarise the check the day contracts exchange.
Got a trust or company on the title? That's KYB, not just KYC. You verify the entity, identify its beneficial owners (generally anyone with 25% or more, or who controls it), then run a KYC on each of them. Our KYB Guide for Real Estate walks through it step by step.One check, five parts
A proper KYC check has five parts. Your agent sends it, your client completes it, and the rest runs on its own.
You
4 details
Send the link
First name, last name, mobile and email. Hit send.
Your client, on their phone
About 2 minutes
- 01
Identity document
Driver licence or passport, scanned.
- 02
Biometrics
A face scan, matched to the ID.
- 03
Due diligence questions
Built into the flow, so you never have to ask.
Automatic
Results in seconds
- 04
Screening
PEPs, sanctions and adverse media.
- 05
Risk rating
Against your agency's own risk assessment.
Identity document. Your client gets a secure link by SMS or email and scans their driver licence or passport on their own phone. No app, no trip into the office. Foreign passports from supported countries work too. If a client can't provide standard ID, AUSTRAC allows other ways to verify them, and your compliance officer can step in.
Biometrics. A quick face scan confirms a live person is holding the phone, and that they match the photo on their ID.
Due diligence questions. Occupation, how they're dealing with you, country of residence, nationality and, for buyers, source of funds. They're asked in plain English inside the same flow, so your agent never has to ask them across the desk.
Screening. The moment your client submits, they're screened against PEP and sanctions lists, plus adverse media. You don't run anything.
Risk rating. Their ID, answers and screening results run through your agency's own risk assessment, and the rating lands on their record.
From the client's side, it takes about 2 minutes on their phone.
What each risk rating means
Every check ends with a rating, and each one tells your agency what to do next.
| Rating | What happens |
|---|---|
| Low | Standard due diligence. Get on with the deal. |
| Medium | Collect and verify more information, in line with the risk. |
| High | Enhanced due diligence (ECDD), handled by your compliance officer. |
The rating isn't there to slow every sale down. It makes sure the deals that need a closer look get one, and that your agency can show how it decided if AUSTRAC ever asks.
Where agencies get stuck
Most agencies don't get stuck on the rules. They get stuck on the day-to-day.
Chasing documents. Clients forget, photos come through blurry, and the listing waits.
The awkward questions. Nobody likes asking a buyer where their money is coming from.
A screening match. What happens next isn't obvious to an agent. The rule of thumb: foreign PEPs always go to ECDD (enhanced customer due diligence). Domestic PEPs follow your agency's risk appetite. A sanctions match can't go ahead.
Trusts and companies. Working out who in a trust actually needs a check.
Records. Every check, answer and result has to be kept for seven years, and scattered emails won't cut it.
If any of these sound familiar, run through The Real Estate AML Checklist to see where your agency stands.How AML Assured handles it
Your agent enters four details (first name, last name, mobile and email) and hits send. Your vendor verifies on their phone in about 2 minutes. Screening and the risk rating happen automatically, and every record is stored for seven years, encrypted and hosted in Australia.
Your risk assessment
| Identity | Verified |
|---|---|
| Customer type | Individual |
| Residence | Australia |
| Source of funds | Home loan |
| PEP and sanctions | No match |
| Adverse media | Clear |
Result
Low risk
Verified
Kept for 7 years
With Client-Pay switched on, your client pays for their own ID check, so it costs your agency $0. And if you get stuck, our median support response is under an hour, from a real person in Australia.
It's built only for real estate, and it's used by 2,000+ real estate professionals.
Get the full guide
Our free guide, KYC for real estate, simplified, covers each step on its own page, with what your client sees and why AUSTRAC expects it.