AML for Principals:Accountability, Risk & Readiness

Principal accountability and the legal stakes

Kylie: One of the biggest topics at the moment is AML Tranche 2 — it's introducing new compliance obligations for real estate from 1 July. What we're going to look at today is your obligations as a principal, because they are different to general agents. David, what's the fundamental shift in legal accountability for principals under this legislation?

David: For principals it's about setting up your business to be more structured around things like verification of identity — obligations that in the past would often have been shifted off to the conveyancing role. AUSTRAC thinks of real estate agents as partners in the process, not targets — it's about minimising the threat of money laundering and providing a strong evidence trail if something does happen.

Kylie: The buck does stop with you as a principal, though. There's no getting out of that.

David: It does. To get the big scary fines out of the way: a body corporate could face up to $30 million for choosing not to comply. Individuals, sole traders, and directors could be in the $6 million range. There are also criminal penalties — tipping off a client flagged for a suspicious matter report is up to two years imprisonment, though that's highly unlikely for the vast majority of agents.

The right mindset: The goal isn't to catch criminals — it's to make sure that if something unusual happens, you've done your due diligence and have the records to show it.

Operational readiness: what to do before 1 July

Kylie: Our deadline is July 1st. What do principals have to have done before then in order to be ready?

David: Number one priority: make sure you are enrolled with AUSTRAC. Your business must be enrolled before you can do anything else. After that, we're working off the easyAML operational readiness checklist — very practical, broken down into all the little things you need to do. The very first item is: appoint a compliance officer and define their authority. For most small agencies, that's going to be the principal.

Pre-July checklist summary: 1. Enrol with AUSTRAC (do this first). 2. Appoint a compliance officer and document their authority. 3. Set AML policies and procedures for your business. 4. Select and connect an AML provider. 5. Train relevant staff. 6. Update agency agreement admin fees to cover CDD costs.

Kylie: As a principal inside a real estate group, you've usually got scripts and dialogues for how you handle different scenarios. There's probably just a handful of new scripts you'll need — for explaining the verification process to vendors, for handling clients who push back, for the auction scenario.

Know your customer (KYC) and the CDD process

Kylie: A lot of this comes down to specific questions and compliance steps. In the past, the conveyancer sorted a lot of this out, so in many ways we're just bringing it earlier in the transaction.

David: Another way to think about CDD is that it's like a disclosure statement for the property — but for the person. The two main forms you'll use in Forms Live are the customer onboarding form and the initial risk assessment. In most cases the outcome is straightforward, but there are provisions for what to do if a client comes back elevated.

Kylie: For auctions, you only need to do the buyer check after the hammer comes down and you're dealing with one party. You don't have to run everyone in the room through the process.

David: That's right. AUSTRAC has also made concessions in the auction space — you can start the process in parallel after the auction has completed.

Choosing an AML provider: a framework for principals

Kylie: Principals already have what feels like hundreds of subscriptions coming off their credit card. How do you decide which AML provider to go with?

David: The first thing is security. Forms Live is ISO 27001 certified, and we require the same from anyone we work with. Data must be stored in Australia. After that, look at capabilities and technology, and make sure the APIs are clean. We've selected integrations that cover the full spectrum of agency size: APLYiD and AML Assured for smaller or ad hoc agencies (per-transaction model), and easyAML and AMLHUB for higher-volume operations (subscription-based).

Provider selection checklist: ISO 27001 or equivalent security certification, Australian data storage, clean API integration, pricing model that fits your transaction volume, and ideally an existing integration with Forms Live.

Manual forms vs. integrated providers

Kylie: What are some of the risks of trying to handle this with paper forms?

David: You might choose a mixture of both. For very low-risk onboarding, you could do it yourself using the Forms Live CDD forms. For anything medium or high risk, the integration is valuable because it guides you through the process step by step. Forms Live provides the forms for agencies that want to do it without a third-party subscription, but we do encourage using a provider for efficiency.

Kylie: One of the real risks of going manual is that you end up photocopying driver's licences and storing identity documents, and there's enormous pressure on agencies not to do that.

David: That's the frustrating tension here. AUSTRAC does require you to store this information, which is why it's so important that you're storing it securely and in Australia.

Connecting your AML provider to Forms Live

Kylie: If I've been diligent and signed up to an AML provider, and I'm also a Forms Live customer, how do I bring them together?

David: Very simply, through the Connections tab in Forms Live. Once connected, it becomes part of the workflow: you initiate the onboarding, risk assessment, and VOI all through Forms Live, with client details pre-populated from the form. From the forms list, you can see AML status indicators alongside your signing status, and you can start the AML process while a form is still in draft.

How it fits into the vendor sign-up process: Get the agency agreement signed first, explain the new legislation to the vendor, send them the onboarding form via Info Request, then initiate the risk assessment — all within Forms Live.

The Forms Live app and mobile AML tracking

David: The Forms Live app has just been released, managing the signing process on mobile — tracking who's signed, sending reminders, notifications. The extension of that will be AML status: an outstanding risk assessment in progress will be visible through your phone.

Kylie: Nobody wants 49 tabs open. The goal is to have it all running from one place as you go about your day.

Audit trails, data security, and non-tech clients

Kylie: As a principal, you need to be able to prove you've handled compliance if AUSTRAC ever asks. How is Forms Live making that audit trail easier?

David: Think of Forms Live as your audit trail by definition. All your onboarding forms and risk assessments sit inside Forms Live against the relevant property. Forms Live data is stored in Australia and doesn't leave, and we have ISO 27001 accreditation.

Kylie: What about clients who aren't comfortable with technology?

David: You can verify someone in person or with wet-ink forms if needed. If you're physically in the room with someone, your risk level is already lower because you can see and identify them directly. Digital VOI matters most for interstate buyers, overseas buyers, anyone you've never met in person.

Closing summary and next steps

Kylie: If you're a principal watching this and thinking you're not prepared — the first step is registering on the AUSTRAC website. The second is thinking about which AML provider you want to use, and checking which ones are integrated with Forms Live at formslive.com.au/aml. Download the operational readiness checklist, and try to keep things digital where you can.

David: It'll be a little interesting in those first few months, but once you get into a flow it'll become standard procedure. My focus is making sure you have the information you need so you can focus on what you do best — communicating with customers and selling property.

Kylie: Your job isn't to capture criminals. It's simply to take the steps so that if anything does happen, there's an evidence trail.

Big announcement: Forms Live is coming to Queensland — live by 30 June 2026.