Enrolling with AUSTRAC feels like the finish line. You’ve submitted the Business Profile Form, you’ve got your AUSTRAC-issued number, your agency now appears on the Reporting Entities Roll. Job done.
It isn’t. Enrolment is AUSTRAC agreeing you exist as a reporting entity. It says nothing about whether you’re actually meeting your obligations — and if AUSTRAC ever asks to see your AML/CTF program, an enrolment confirmation email won’t be the document they’re looking for.
If you read our piece on the 29 July enrolment deadline, this is the part that comes next, and it’s the part most agencies underestimate.
What enrolment actually confirms
Enrolment is an administrative step. You tell AUSTRAC who you are, what designated services you provide, and who your AML/CTF Compliance Officer is. AUSTRAC records it. That’s the entire transaction.
Nowhere in that process does anyone check whether you’ve done a risk assessment, written a policy, verified a customer, or trained a single staff member. AUSTRAC doesn’t audit your program at the point of enrolment — it audits it later, when it chooses to, and by then the paperwork either exists or it doesn’t.
That gap — between “enrolled” and “compliant” — is where most of the real exposure sits for newly regulated agencies. It’s also, not coincidentally, where a lot of AML software marketing quietly stops being useful. A platform can help you enrol in twenty minutes. It cannot write your risk assessment for you, and it cannot make a document exist that nobody has actually produced.
What a real AML/CTF program has to contain
Strip away the acronyms and an AML/CTF program is asking your agency to be able to answer, with evidence, five questions:
- What are our money laundering and terrorism financing risks, specifically? Not a generic industry statement — your actual customer base, transaction types, and how your agency operates.
- What do we do to verify who we’re dealing with? Your customer due diligence procedure, including what triggers enhanced due diligence for higher-risk customers.
- How do we screen for problems before they become transactions? PEP checks, sanctions screening, and what happens when something flags.
- How do we make sure our people actually know this? Staff training that’s delivered, evidenced, and refreshed — not a slideshow someone watched once in 2026 and never again.
- Can someone independent confirm this is actually working? AUSTRAC’s rules require your program to be reviewed at intervals appropriate to your size and risk — not written once and left in a drawer.
Every one of those needs to exist as a document, dated, version-controlled, and able to be produced on request. That’s not bureaucratic box-ticking for its own sake — it’s exactly what an examiner is trained to ask for, and exactly what determines whether your agency is treated as a business making a genuine effort or one that enrolled and hoped nobody would check further.
Why this catches good agencies out
Most real estate principals aren’t being negligent. They’re busy, they’ve never held a regulatory obligation like this before, and “enrol with AUSTRAC” was the loudest, most trackable instruction in every article they read in the lead-up to 1 July. So they did that part well, and reasonably assumed the rest would follow.
It doesn’t follow automatically. A risk assessment doesn’t write itself once you’re enrolled. Staff don’t absorb training obligations by osmosis. And a policy document that exists on a laptop, was never circulated, and that no one on your team could describe if asked, is not meaningfully different from a policy that doesn’t exist — an examiner will treat it the same way.
This is the distinction we mean when we say an AML/CTF program is a management system, not a folder of documents. A management system is something your business actually runs on: staff know their part in it, evidence accumulates as a by-product of normal work, and it survives someone external asking hard questions about it. A folder of documents is something you produced once, under pressure, to get a form ticked.
What audit-ready actually looks like
If AUSTRAC contacted your agency tomorrow, here’s roughly what “audit-ready” means in practice:
- Your risk assessment is dated within the last 12 months and reflects your agency’s actual transaction mix, not a template’s.
- You can produce CDD records for a sample of recent transactions without hunting through emails to reconstruct what happened.
- Your staff training has attendance records or completion evidence attached to real names and real dates.
- Your compliance officer can explain, in plain language, why your program is structured the way it is.
- Nothing is missing “because we’ve been busy since July” — busy is not a defence AUSTRAC recognises.
None of this is exotic. It’s the same evidence-first discipline that underpins any functioning management system, in any regulated industry. It’s just new to real estate.
What to do if you’ve only enrolled so far
Don’t try to build the whole program in a weekend — that’s how agencies end up with a generic template that doesn’t reflect how they actually work, which creates its own problems at review time. Instead:
- Get an honest read on where you actually stand. A short, structured gap assessment against what AUSTRAC expects will tell you more in 30 minutes than another article will.
- Start your risk assessment, because every other document depends on it.
- Put staff training in motion now, even before every policy is finalised — training is one obligation you can start today without waiting on anything else.
Lead Comply runs a free 30-minute Compliance Gap Audit for Australian real estate agencies — no obligation, and you’ll walk away knowing exactly what’s built, what’s missing, and what to prioritise first.
