AML in ActionAPLYiD + Forms Live

Most people on this call already have some understanding of the AML obligations. We're going to cover the basics briefly, but this session is primarily focused on what operationalising this looks like day-to-day — with software, not slides.

There are four main buckets of obligation. First, AML policies — a process document, a business risk assessment, and a compliance program. This is largely a one-off before 1 July, with an annual review requirement.

Second, AML training. This is a mandatory requirement under the regulations — not just doing the training, but keeping a training log that proves to AUSTRAC which staff members completed which training and when. Different roles require different levels.

Third, customer due diligence. This is what most people think of when they hear AML — identity checks. But there's more to it than a standard ID check. It includes background checks, risk assessment, and ongoing monitoring.

And fourth, record keeping. All checks must be retained for seven years, and you're required to submit an annual compliance report to AUSTRAC. If any suspicious matter reports arise, those are filed as well.

A lot of agencies have had their inboxes flooded with AML vendors in the past year. It's worth understanding what's different.

APLYiD has been in the AML space since New Zealand's laws changed in 2018. We supported New Zealand real estate agencies through that transition and have thousands of customers across the globe. This isn't a startup that's jumped on a regulatory change — we've walked this road before.

Second, we're genuinely all-in-one. We're not just an identity check provider. APLYiD creates all your policy documentation, provides a full training platform with quizzes, certificates, and logs, runs the customer due diligence workflow, and handles your ongoing record keeping and reporting — all in one subscription.

On pricing: we're the only vendor that charges per listing rather than per check. Because you're verifying both vendors and buyers, and it's difficult to predict how many buyer checks you'll run on a given listing, a per-check model creates cost uncertainty. One flat fee per listing covers unlimited people for that transaction, which makes it straightforward to pass the cost on through your administration fees.

From Forms Live's side, the reason we invested in this integration is exactly what Toby said — we want to make sure the APIs we connect with are best in market, and that they make a real impact on efficiency for agents. The goal is that going through compliance doesn't feel like extra work on top of your day job. It should feel like part of the existing process.

A lot of the webinars we've run over the past month have been educational — helping agents understand what AML is and what they need to do. What we were hearing back was: that's great, but we want to see it in action. So that's what today is about.

The integration is built so that agents don't have to leave their existing workflow. You're in Forms Live filling out an agency agreement or a sales authority — the same form you'd be using on any normal day. When you're ready to initiate the AML process, you click a button. That's it. The vendor's details are passed through to APLYiD automatically, and the workflow begins from there.

The most important thing to understand about the integration is what it eliminates: re-keying. In Forms Live you've already captured the listing address, the transaction value, and the vendor's details. Clicking that button submits all of that through to APLYiD, so you arrive in our platform with everything pre-populated. Your first action is beginning the identity verification — not filling in forms you've already filled in.

For the purposes of this demo, we're going to focus on the most common scenario: a residential transaction, probably low risk, single individual selling a property. Everything is cloud-based — nothing to download, unlimited users on the account.

After clicking the button in Forms Live, you'd arrive in APLYiD with the listing already set up. For today I'm creating it manually. You record the property address, the reason for the transaction, and the transaction value — AUSTRAC requires that context. The platform then walks you through each step from there.

In the vendor section, you select the client type — in this case, an individual. The platform adapts the steps required based on what you tell it: client type, risk level, and other factors all change what you need to do. You're not working from a checklist you have to interpret; the system tells you what comes next.

Now we're at the identity verification step. There are a few options. The most common is a text message link — you send it to the vendor, they complete it on their own phone in their own time. There's also an in-person option, optimised for mobile, where the agent pulls it up on their phone in the lounge and the vendor completes it right there.

That video is 57 seconds. The client receives the link, confirms their address — which is verified automatically in the background, so they don't need to provide a utility bill — takes a photo of their physical ID, and does a live selfie. That's it. One ID is enough; no Medicare cards, no secondary documents. The system reads the ID automatically and fills in the details. The selfie proves the ID belongs to them.

If the client hasn't completed it after three days, the system sends them an automatic reminder. You'll receive an email notification as soon as it's done. You don't need to chase them.

Once the client completes their check, you'll be notified to review the results. If anything requires attention, the system won't let you proceed until it's resolved. In this case, there's a PEP — politically exposed person — flag.

The way PEP matching works is that the system searches for similar names, not exact matches. This is by design. If your client is Alex Johnson and there's an Alexander Johnston, you'd want to know about that. So the system flags potential matches and requires you to investigate.

In this demo account, the matching criteria are deliberately loose to illustrate the concept. In practice, this kind of flag occurs maybe one in a hundred checks. But it's important to understand how to handle it when it does come up.

In this case, there's a match for a T. Taylor who was involved in a bankruptcy case in the UK in 1997. I can cross-reference that against the ID — my date of birth is 1997, so clearly that person isn't me. I document my reasoning, note that the matched case predates my birth, and overturn the flag to a pass. The notes, the decision, and the user who made it are all permanently recorded for audit purposes. You can't go back and delete them.

After the identity checks are complete, the next step is the client risk assessment. AUSTRAC provides questionnaires that are built directly into the platform. You can customise the wording — some agencies change terminology like "PEP" to "politically exposed person," or adjust phrasing to be clearer for their team — but we recommend not changing the substance of the questions. If you're using the government's own template, it's very difficult to get it wrong.

Each question is answered yes or no by your team, and each carries a point value. The total score places the client into a risk tier — low, medium, or high. For this scenario: client is not anonymous, not overseas, not a PEP, and I've met them in person. Result: low risk. No additional steps required.

If the client comes back as high risk, the system requires enhanced due diligence — source of wealth and source of funds — and automatically assigns the case to a compliance officer. A junior agent cannot approve a high-risk case; it has to go up the chain. That's a safeguard built into the platform.

For most residential agencies, high-risk clients will be rare — perhaps one in a hundred. If you're selling high-value property in premium markets, you'll see more of them. Either way, the process is the same; the platform just tells you what additional steps are needed.

Once approved, vendor onboarding is complete. The listing is now ready to go to market. The buyer verification happens later — after an accepted offer — and follows the same workflow.

For joint clients — a couple selling together, for example — you select Joint/Multiple Individuals when setting up the client. With the Forms Live integration, both people's details carry across automatically. Without it, you'd enter them manually.

The platform creates a separate identity verification box for each person. You don't have to use the same method for both. If one person was in the office with you, you might use the in-person option on your phone. If the other is interstate, you send them a text link. Each method produces the same result — a completed, verified identity check stored against that transaction.

The Forms Live integration handles joint vendors the same way — if you have multiple vendors on a sales authority, clicking the button in Forms Live passes all of them through to APLYiD, so you're not creating records for each person individually.

All records are stored in APLYiD for seven years, as required. When you're audited, you give the auditor a read-only login to the platform. They can filter by risk level, view the full history of every client and listing, see which checks were done and when, and review any decisions made — including overturned flags and the reasoning behind them.

For the annual AUSTRAC compliance report, there's a built-in reporting feature. You set the date range for the 12-month period and extract everything you need in a format ready for submission. You don't need to compile records manually from different places.

One thing worth flagging on the audit experience: everything is traceable to a specific user. If a compliance officer overturns a PEP flag, their name, the timestamp, and their notes are all recorded. If a junior agent tries to approve a high-risk case, the system blocks them. These controls mean that when an auditor reviews your records, they can see not just what was done, but who did it and why — which is exactly what AUSTRAC wants to see.

Pricing is per listing — one flat fee that covers unlimited people per transaction, plus the policy builder, training platform, and all platform access.

Pay-as-you-go is $125 per listing — this covers the identity checks but not the policy builder or training platform. Monthly plans start at $250 per month for up to five listings, which works out to $50 per listing. Additional listings beyond your plan's allocation are $50 each. There are higher tiers at $45 per listing (10 per month) and $40 per listing (20 per month), with enterprise options beyond that.

All plans are on 30-day terms — no long-term lock-in.

When you sign up, we start with a setup session with your compliance officer or senior managers — covering the customisable elements, custom branding for the client-facing verification flow, and your preferred account structure for rolling it out across your team. From there, policies are created, team training is completed, and the Forms Live integration is activated.

Support is built into the platform — video walkthroughs, live chat, and a free phone line that clients can call if they need help completing their ID check. The intention is that your agents aren't the ones troubleshooting client questions about the verification process.