Tranche 2 AML:Fast Track to AML Compliance

We've done a lot with APLYiD coming up to 1 July, trying to educate the market about what AML compliance means, from the early days through to pre-launch and now post-launch. It's past the 1st of July. Every agency is now looking at AML very seriously, and as they should. I'm proud of the integration we've built with Toby and Russell's team, and the feedback from our users has been really positive.

We're going to go through the obligations pretty quickly — not because they're not important, but because most agencies we're talking to now understand what they have to do. The question is how to do it. So we'll cover the four areas briefly, then get into the demos.

First: policy creation and AML training. These were required before 1 July by law. You need a set of policy documents that dictate how your agency will handle AML, and a training log proving which staff completed which training and when. That log needs to be submitted to AUSTRAC annually.

Second: customer due diligence. This is what most people think of when they hear AML, and verifying the identity of your vendors and buyers. For real estate in Australia, it's identity checks and risk assessments. You don't need to prove source of funds in most cases.

That's a significant win, for anyone who's not aware. Not having to deal with source of funds is a genuinely painful process in other jurisdictions.

Absolutely. Some countries require you to prove funds for every single client, and you can imagine how much fun that isn't. Real estate in Australia is in a comparatively good position.

Fourth: record keeping. A transaction might close in a couple of months, but you need to hold the records for seven years. You'll be audited every three years and required to submit an annual report to AUSTRAC covering what you've been doing — how many clients were high risk, what checks were run, and so on.

With AI making it easy to spin up new businesses, there are a lot of new AML providers in the market right now. That ambition is great to see. But businesses that have been doing this for years, through New Zealand's rollout in 2018, through the UK, genuinely understand the pain points you and your clients are going to face. That experience is built into how we design the workflows.

The second thing is ISO 27001 certification. This is the gold standard of data security, and we see it as a baseline requirement, not a nice-to-have. We're capturing your clients' passports, driver's licences, and biometric data. Whoever you work with should have this certification. If they don't, they don't have the right processes and policies in place for data security. Ask the question before you sign up.

Third: APLYiD is genuinely all-in-one. We create your AML policies, run your staff training with quizzes, certificates, and completion logs, handle all the identity checks and risk assessments, and store everything for your annual AUSTRAC reporting. You don't need a second vendor for anything.

And the pricing model — we charge one flat fee per listing, covering unlimited people on that transaction. Pass it on through your vendor paid advertising and the product effectively costs your agency nothing.

The Forms Live integration is designed to be as frictionless as possible. In most cases, you're pulling your vendor or buyer information from your CRM directly into the form. Once the form is populated, you'll see an APLYiD panel on the right-hand side, and you connect it once through Forms Live integrations, and it's there every time from that point forward.

When you're ready to run the check, the vendor's information from the form pre-populates the APLYiD panel automatically. You submit the request with one click. That's it. APLYiD returns a result, and if you need to go deeper into the APLYiD platform for any reason, there's a direct link. But the whole point is that you don't leave Forms Live for a standard check.

The flow is: CRM to Forms Live, Forms Live to APLYiD. Three steps, one click.

Agents do not want to do AML. Anything you can trigger from existing platforms is exactly why these partnerships matter. Not just for the efficiency, but for actually getting adoption in the first place. We see a major difference in compliance rates between integrated and non-integrated clients. The integration removes the friction that causes people to put it off.

Everything in APLYiD starts from the New Listing button. I'm creating this manually today to show you what the integration replaces, in practice, the listing details and vendor information come across automatically from Forms Live, so you'd arrive on the page after this one.

You record the property address, the transaction type, and the value, because AUSTRAC requires that context. For 64 Smith Street, residential owner-occupied, $750,000. Normally you wouldn't type any of this. The Forms Live integration sends it all over when you click the button in your form.

The really important thing about how the platform is designed: you don't need to think about what checks apply to different client types. Dealing with a trust? A joint entity? A company? You just fill in each page and the platform changes the checklist and guides you through the right steps. It's built for people who are completely new to AML.

The client receives a text message with two things on it: a link to complete the check, and a free phone number they can call if they need help. That phone number is unique to APLYiD, and if your clients are unsure what to do, they can call us directly and we'll walk them through it.

The only thing they type is their address. Everything else is automated. They present their ID, a driver's licence, passport, or other supported document, and the system reads it automatically. It doesn't need them to pick from a drop-down menu; it identifies the document type from what's in front of the camera. Data is pulled from the card and presented back to the client to sense-check. Accuracy is 99.9996%.

The client then completes a facial recognition and liveness check, then we confirm that their face matches the ID document and that they're physically present, not a photo or an AI-generated image. Start to finish: about one minute.

A common concern we hear is that clients are going to push back on this. Now that we're past 1 July and agencies have actually been running checks, the feedback is the opposite, and clients find it simple and quick. It's nothing like getting a bank account a decade ago. A text message, one minute, done. There's no 20-page form, no branch visit.

Worth noting: we license our ID verification technology to some other AML platforms too. So even if you've previously used a different provider, you may have already seen this experience. The core ID check is that solid.

After the client completes their check, I can see in the platform that there's something that needs review, and it's not letting me proceed. This is by design. If you're worried that junior agents will cut corners, this is the safeguard: the system blocks them until the review is done.

In this case, the PEP check has flagged a potential match. PEP stands for politically exposed person, and the platform also checks for sanctions and adverse media. A flag doesn't mean your client is on a watchlist; it means there's a similar name that needs to be investigated.

The platform deliberately searches for similar names, not exact matches. If there's an article about "Russ Smith" who's a money launderer, you'd want to know that even if your client is "Russell Smith." Broad matching is intentional, and it just means most flags aren't your client, and you're in here checking rather than assuming.

In this case: T. Taylor was in court in Exeter, UK, in 1997 for an insolvency matter. My ID shows I was born in 1997. Clearly, the person in that 1997 case isn't someone born in 1997. I leave a note documenting my reasoning, and overturn the flag to a pass. That note and the decision are permanently recorded — they can't be deleted. That's your audit trail.

For those of us on the call who are a little older, we all know how confronting it is that Toby was born in 1997.

The last step is the risk assessment. These questions come directly from AUSTRAC, and we've built them into the platform as a simple yes/no questionnaire with scores behind the scenes. You're not deciding the risk level; the platform calculates it based on your answers. That's intentional, as it removes subjectivity.

For this scenario: not anonymous, not overseas, not a PEP, met in person. Result: low risk. Done. That's the outcome for the vast majority of residential transactions.

I want to be direct about this: there's a lot of noise in the market about complex, high-risk edge cases. The reality is that those cases happen far more often in legal and accounting sectors than in residential real estate. If you focus your energy on making the standard low-risk workflow smooth — mum and dad selling their home — you'll be in good shape. The high-risk workflow exists and the platform handles it, but don't let the edge cases distort your expectation of what day-to-day AML looks like.

If a client does come back high risk, the platform requires enhanced due diligence — source of wealth and source of funds, and automatically assigns the case to your compliance officer. A junior agent can't approve it. That's built in.

Not having to request source of funds in most cases is genuinely significant. In other countries, that's a requirement for every single client, and as Toby said, it's not a fun process. Real estate in Australia is in a comparatively good position.

Exactly right. That was one of the design decisions we made early, to make sure the workflow reflects what Australian residential real estate actually looks like, not what a law firm in London needs. The low-risk path should feel like nothing. The occasional high-risk case should feel manageable. That's the bar we built to.

For your annual AUSTRAC report, there's a built-in reporting function. Set the date range, download everything you need. Full audit trails for every client you've onboarded — ID checks, risk assessments, a history of everything that was done, and by whom.

When you're audited, you give the auditor read-only access to the platform. They can see everything. Every decision is traced back to a specific user with a timestamp. You can't retrospectively change anything. That's what AUSTRAC wants to see, not just what was done, but who did it and when.

Records are stored for seven years, as required. You don't need a separate filing system.

Two options. Pay-as-you-go at $125 per listing, which covers the identity checks but not the policy builder, AML training, or enhanced support. If you're listing one property a month and you've already sorted your policy documents separately, this might suit you. Otherwise, the monthly plan is almost certainly better value.

The most popular plan is $250 per month for up to five listings, at $50 per listing. If you go over, additional listings are $50 each. This includes absolutely everything: policy builder, AML training platform with quizzes and certificates, enhanced support, full reporting. Once you're listing two properties a month, you're paying $250 anyway on pay-as-you-go, so the monthly plan with all inclusions is the obvious choice.

There are higher tiers beyond five listings, all on 30-day rolling terms. No lock-in. If your volume changes, you change your plan.

The pricing model is designed around passing the cost on. One flat fee per listing covers unlimited people, from vendor, buyer, to a complex trust with multiple beneficial owners. Add it to your VPA and the product costs your agency nothing.

There was a great question from an attendee who received a PEP or sanctions report back in Chinese and wasn't sure what to do. My answer: run it through an AI tool — Gemini, ChatGPT, any of them. Paste the text, ask for a translation, and do a loose check. If it's clearly not your client, note your reasoning and move on.

The broader point here is important: your job is not to be a secret agent. Your role isn't to stop a transaction, confront a client, or make a judgment call about whether someone is a criminal. Your job is to sell property. If something feels suspicious, you flag it through your AML platform and file a Suspicious Matter Report with AUSTRAC. It then becomes AUSTRAC's job to investigate. Never raise the issue with the client directly, and that's called tipping off and is illegal. Your job starts and ends with doing your due diligence and letting the system do the rest.

There was also a question about whether you need to verify a buyer if the contract went unconditional after 1 July but the property was listed before. Two parts to that. First, on the platform side: if you only need to verify one party, not both, there's a standard template in APLYiD for a single client. So you can run the buyer check without it being linked to a vendor check.

Second, on the obligation: if a vendor was listed before 1 July, you're likely not required to go back and verify them retrospectively. But my recommendation is to do it anyway, ideally while there's no pressure on the transaction. It gives your team a practice run when the stakes are low, and it means you have the vendor relationship already covered if anything comes up during settlement.

Good advice. The more reps your team gets before a critical moment, the better. The verification takes one minute, so there's really no downside to doing it proactively.