Activate Your Defenceswith VOI Superpowers.

Kylie: Hi everyone, it’s Kylie Davis from Proptech Guru, and the Proptech Association Australia. We're here to talk about VoI and the importance of it in residential real estate, and what we need to do to get ready for AML. I'm here with David Howell from Forms Live, and Ches Rafferty from SCANTEK and the very sensibly named Easy AML.

Ches: Correct, yes.

Kylie: I wanted to quickly do to kick us off is - there's a lot of acronyms going around, and I'm a little bit allergic to acronyms, but let's get an understanding of the size of the issue inside real estate, what's coming, and the landscape. So, how big and how real is the problem of scamming in Australia. Ches, do you want to take that?

Ches: Yeah, absolutely. So, in terms of identity verification, unfortunately no one's compiled all the data together, but it's very, very common because the value of property is so large. So, you'll certainly see scamming in the values of multiple hundreds of thousands to even, low millions to some of the ones that have come through in the last few years. The variety of scams that have been done - some of them are your email injections, where they spoof emails or spoof invoices, or banking details. And then other ones where they attempt to impersonate people, and that's around the actual property transfers themselves. So, there was one in WA, where it didn't get through as a scam, but quite recently, where it was an international owner, or appeared to be an international owner, and was trying to transfer a property - and got very, very close. They had gone through the real estate agent and the conveyancer, and it was just literally someone else at the conveyancing firm knew something was a bit unusual - started looking into it, and it was literally hours away from being transferred. So, yeah, it's quite a common process. In terms of the anti-money laundering changes, we'll talk a bit more about coming through next year. The federal police alone see $1.2 billion in property from money laundering over a five-year period between 2019 and 2024. So, we're talking about enormous amounts of money that are being sloshed through and stolen out of the property sector.

Kylie: Yeah, and look, as a sector we’re quite vulnerable to it, because of the size of the transactions that we're dealing with. I mean, even a rental deposit, or a deposit on it is a good chunk of change, right?

Ches: Absolutely.

Kylie: The size of the transactions that we're dealing with, and the fact that, as an industry, we transact a lot on email, and we also then advertise those emails extensively through all of our marketing activity, makes it really easy to find us.

Ches: Yeah, and then relationships are new as well, which I think is a big part of it. As opposed to a lot of transactions where you build up a relationship over a period of time - each one of these is, you know, not exactly a one-off, but it's an irregular relationship. You might only deal with a client every 2, 3, 4, 5 years, and vice versa. The client's only dealing with the real estate agents every, you know, 2, 3, 4, 5 years. So, it's not surprising if they get something and it's a change of details, that that would feel quite normal, and I think that's another big part of the risk as well.

Kylie: Yeah, I think that's a really great point. So, what is the real cost to a real estate business if there's a security breach? When you were giving that example before about the international (transaction), was that a vendor who was trying to sell, or was it someone pretending to be an international vendor and selling someone else's property?

Ches: So, it was an international owner of the property, and it was someone trying to impersonate that person selling that property. So again, it was quite well thought through, it was vacant land. So, no neighbors that saw a sign go up to sell it from the real estate agent put up. Didn't seem unusual, they never really had a relationship with the person. Clearly, there was quite a strong plan behind the scammers. It wasn't just a random attack. They were targeting properties that had no relationships with their neighbors - vacant Land obviously does that. And again, the vendors, the owners were international as well, so that was another bit where the real estate agent and the conveyancer were used to the relationship being dealt, as you said, over email and remotely, and a lot of really good excuses why I can't jump on and talk to you now because of time zones and things like that. So, it was very much a targeted attack. As I said, literally, it was a few hours away from settlement, and only just happened to go through multiple hands who sort of accepted it, and then just happened to trigger off something with a conveyancer to double-check one thing that then, caught on that thread. I guess, it started unraveling after that. But again, it's so easy, we're all busy in our lives, so, without the right pieces of technology, and they didn't do an identity verification check on that process. They just accepted photocopied documents provided by the Consulate in that country, which then turned out not to be real.

Kylie: So, in that case, if the conveyancer and, you know, big shout out to all the conveyancers out there for excellent observational detective work. But, if that had gone through, who would have won the hit? I guess, the owner of the property, because suddenly their property's been (targeted).

Ches: It would have gotten complicated very quick - under Torrens (Title), so whoever ends up with the title is the title holder. So, if that was your dream retirement piece of land that you were going to build your perfect dream home on, there goes that opportunity, because you don't own that. Presumably, the insurance companies would have got to town, and the lawyers would have got to town around trying to pass on who had ultimate liability for that. I think the bit we have to think about is what's the real cost to your business? It's the emotional stress, it's investigations by the Titles Officers or respective bodies in your industry, it's insurance people hassling you, it's lawyers, it's statements, it's obviously the credibility of your business as well, getting out, that you allow this to occur, you allowed a property to be ‘stolen’. I think that's the bit. It's very, very hard to actually put a price on, but it would be extraordinarily damaging. I know personally, the conveyancer that I spoke to, the amount of stress that she had to go through to, and she actually prevented it. So, she was so stressed and is still stressed about it a year later. You wonder, what would that have actually been like if it had gone through? You know, it's incredibly stressful.

Kylie: Yeah, that woman deserves a medal.

Ches: Yes

Kylie: So, David, what obligations do real estate principals have in this space?

David: Yeah, that's a good question. At the moment, there's a lot of optional things you should be doing, and it's probably why we're talking today, it's a good time to start your best practice. Because, next year, 1st of July, there will be a lot of mandatory requirements around the sales process and verifying identity and things like that. As March next year, you need to start enrolling, and then the 1st of July is the date where you must start doing these verification of identities. So, at the moment, it is optional, but it's highly encouraged.

Kylie: Is this all under the AML

David: and Tranche 2, yep.

Kylie: This anti-money laundering kind of regime change that's coming through to bring Australia into alignment with international guidelines by making it difficult to launder money.

David: Well, conveyances are used to a verification of identity on a property, but again, I know we'll be talking later about, the integration with Scantek, but we do make even conveyancing verification of identity - which is slightly different to what the agents need to do - make it easy through the integration.

Kylie: So, what is the difference between what an agent needs to do versus what a conveyancer would do?

David: It's all around the legal wording of ‘what is a reasonable attempt at identification’, and that's what it is at the moment. Obviously, I believe, Ches, that'll be tightening up over time. Whereas in ‘conveyancing world’, it is significant. The amount of identification you must provide, for a settlement to happen. So, it's like the first barrier of defense, getting through that first barrier of doing some sort of verification of identity to minimise that risk, from the agent's perspective. And going through that scenario we were talking earlier, like, if you've done best practice and minimized your risks, and then when it does come to that time, should something happen, you know you've done the very best you can, so a) you're going to limit any, any potential problems, and b) if there is a problem, you are then, you know, that helps you in that scenario as well, from that perspective.

Kylie: So, are the regulations covering this state or federal, or a joyous mix of both.

David: Ches, it’s federal, isn’t it?

Ches: Yeah, well, so this is, yeah, it's kind of both. So basically, there is an overarching body called ARNECC, that the states contribute to. This is, at least, the conveyancing side of it. Then they still implement it at a state level. For real estate agents that is purely state — each state has their own standard of verification. As David said, it's currently set relatively low at real estate agents compared to the requirements for conveyancing. And then, as we noted before, these new changes coming through are a federal requirement, these anti-money laundering changes, AML changes, They effectively are the same level of verification requirements, regardless of whether you're a real estate agent or a conveyancer, or, there's a few other sectors involved, lawyers and accountants as well. There's a set sort of federal standard that will have to be undertaken, and it is a very high bar compared to what, particularly real estate agents, lawyers, and accountants, have had to undertake previously. It's a seismic change for them.

Kylie: Right, so we're moving from a place where you've never really had to do anything as an agent to where you're going to have to do quite a lot of stuff, there's a big compliance obligation on us as a sector.

Ches: To be crystal clear, you are not able to settle the sale of a property until, you, as a real estate agent, have done it to this standard. So, it's very, very prescriptive from 1 July. This isn't something where, you know, a few people have sort of said, I don't think it affects me, I represent buyers, or we don't sell commercial property, or we don't sell high-value property, all these kinds of things. It's a very black and white thing. If you sell property, or assist in the sale of property, which I'm some real estate agents do, from 1 July, you will be required to verify your customers, both individuals and businesses and other entities — for example, self-managed super funds or trust funds, family trusts — to a certain standard, and if you have not completed that, then the property is not allowed to be sold. So, I mean, that's… a seismic change from right now. It's similar to what conveyances are doing, but even for conveyances, it's a higher bar than they currently have to undertake now.

Kylie: So, this is not like other technology areas where you can sort of go, I think we'll be right, I think we'll just risk it for a biscuit. There's none of that happening. There's, learn this stuff, or close the door, turn the light off.

Ches: Yeah, and AUSTRAC is very, very powerful organisation, and they're kind of quite unknown, really, I'd say, for the average Australian, we've all experienced their regulations — getting the signs at the airport, you can't leave with more than $10,000 cash, or even enter, that's AUSTRAC. When your bank or your online gaming service you use asks for all this identity verification, or your bank sends you out a message and says, if you don't go get your identity updated, we will not be allowed to have access to the bank account — those are all under AUSTRAC. So, we've all experienced it over the last 20 years. It's just moving into these new sectors, and there's yet quite a seismic shift. And look, New Zealand did it five, six years ago, the UK did it 8 years ago, so look, it is absolutely a compliance overhead that you haven't had to do, and to your point, Kylie, I think technology is the only sensible way you can actually resolve this. I also want to be clear that it’s 10 plus months away, plenty of time, you don't have to panic or rush into this. There’s plenty of time to find out what you need to do and the right partners. Obviously, this is why David and myself are putting this sort of event on, to let everyone know about what's coming, and the fact that we'll be making sure that no one will be left behind. And it will be easy to use Forms Live to complete these processes. Just creating that understanding and awareness that this isn't something you want to be thinking about in June next year. That would be very bad.

Kylie: No, because there'll be a rush then to get help, right? You don't want to be in that queue.

Kylie: At the moment, what we're talking about is verifying the identity of the seller to make sure that they have the right to sell the property. Is that correct? Are we looking at any point of verifying buyers, or is that not on the cards at the moment?

Ches: It's not on the cards for the moment, but it is required under the new AML/Tranche 2 changes. Really now, because the risk at the moment obviously sits with the person where the money is going to, so it really sits with the seller, of course, or a person potentially pretending to be a seller. It doesn't hurt to do verification on both sides of buyers and sellers. But again, it's really about starting to get these processes in, having the conversations with your clients, the marketing material, the team training to really start to educate your customers about why you're doing it, why it's a good idea. And then as that becomes a federal requirement, you've already sort of got yourself ahead of that curve.

Kylie: If we wanted to go down this path manually, this is kind of like the equivalent to photocopying someone's passport or their driver's license and being able to say, yeah, look, I checked. Is that right?

Ches: I guess that's one way of doing it, and certainly, as I said in the earlier example, that's exactly what occurred that allowed this sort of almost scam to occur — because it was just a photocopy. So, if you're using the right technology, we believe that it should be doing a lot more analysis than that, so it should be. For example; understanding where that person is located, is it unusual or suspicious? It should be making sure that the identity documents provided match back to government data sources to prove that they're real identity documents. It should be using facial biometrics to link the person providing those identity documents, and the person providing them, and the actual documents. And then, obviously, as I said, if you're going on to these other things, there's even further checks you need to do to make sure people aren't on government watch lists. So, it's very different.

David: It's very, very different, yeah. It's very different to getting a copy of ID and keeping it in for record keeping. It's very different to that.

Ches: Absolutely. And you've got audit requirements under these federal changes as well. So, if you're just photocopying and storing it, how can you do your order report at the end of the year to tell them how many documents you had, who you did, that sort of stuff. Look, I think the reality is best practice right now is doing digital identity verification, as opposed to manual collection. In the future, I cannot see a way that you can do it anymore like that. There is no way under the Tranche 2 changes that you can photocopy or do it anymore, because of your compliance requirements, but secondarily on top of that, how are you going to go check those identity documents on the government watch list, or what are known as sanctions list, basically people that are banned. So, how are you going to bring that all together? I really don't see it feasible to do without using some type of technology or some technology providers to assist you on that journey.

Kylie: Okay, so we seem to be at this sort of intersection of technology and compliance, and new legislation coming through, and extraordinary risk just out there generally. How hard or easy is it going to be to do? So, maybe this is where we bust out the demo, and at what point, how does this work? David, do you want to run us through that?

[SCANTEK x Forms Live demo]

David: I want to reiterate what Ches was saying earlier that there's a lot of fearmongering out there at the moment, and really the key thing here is not to worry, not to panic. We're creating the tools, and we're creating the way that you can do best practice. And we're making it as easy as possible for you at least to give it a try, without interfering with your transaction either.

David: So, the great thing we've got here with Scantek is the very first time you go to use ID verification, which will appear on any document or any agreement that requires it, or could require it, and optionally, so in our case, the agency agreements. There'll be an ID verification sidebar. The very first time you use it, it's going to ask you to create an account with Scantek. So, the great thing here is, thanks to Scantek, we can create an account, with a password, immediately, and they can start using it immediately, which is, you know, great. You can, within, you know, literally within seconds after creating this account, you can jump in and send off a request for verification of identity. I was just showing you here is what you see the very first time you use it (referring to the forms sidebar). The next time you jump in there, what you'll see is the start of a verification request. Now, the way to think about VoI is just like electronic signing — it pulls the information out of the form, the contact details of the vendors, and puts it in to send off a request. Once you've sent off a request, it's very similar to the electronic signing process- the vendor or the seller will get an SMS, and on their mobile phone, and they’ll have the ability to complete the verification requirements. Now, if I send this off now, what this will do is I'll get an SMS on my phone. You can see here (status in sidebar), it's in progress. And here we go. I also got an email. And it's got a hyperlink to jump into the Scantek system. And I won't run through the process, but I will show you how to jump in there and review it. But literally, it tells you to get started, and you'll use your mobile phone as the vendor.

The vendor will use their mobile phone to collect evidence to verify that identity. And I'll let Ches talk through exactly what that does, like, verification back to source, which is very, very important, and then the liveliness check, to confirm that you are a real person, that you're not putting photos up against the mobile device and things like that. It really is very simple for the vendor to complete. And at any time, you can edit and resend, you can void the request, just like electronic signing, or you can review it and see where they're at. So, at the moment, obviously, I've only just sent this off. But you can see here that, um, it's pending this verification details. Now, because this is our staging site, I haven't completed it, but the important thing to remember here is, once it's completed, what we get back is like, a certificate. It's a PDF which will explain that we have successfully or unsuccessfully verified the identity of the vendor. It'll explain what it did to, um, to verify the identity. But the key thing is, it will not contain any Personal Identifiable Information, so PII. Scantek redact that from the certificate, and we record that in Forms Live against the agreement. So, the great thing there is that you're not storing date of birth, you're not storing Driver's license details, all those types of things. You're storing the proof that you have verified the identity of this person and are successful.

Kylie: So, I said tokenisation in action?

David: It's the beginning of that, so, you know, when we talk about digital IDs, that's kind of where we're getting into that space. Slightly different, that's kind of goes on the trust factor. This is more about, if you were to create a digital ID, you would do this first. So, you've proven, back to the source, whether it's by passport, driver's license, Medicare card, those options, back to the source that you are, who you say you are. Again, with a liveliness check. And then, you pass all those tests, or a very high percentage, then you’re considered verified. It's as easy as that. Now, there are some other ways to do it, so like I said before, with electronic signing, it's the same thing as electronic signing, so what we can do is, before you send something off for electronic signing, you can tick a box and say, I want verification of identity prior. And run you through the process, so the vendor will verify their identity, then electronically sign the agreement. It's all very streamlined, it sits well within the workflow. There's no change to your process to get this done.

Kylie: So how much does it cost to do it? Like, how much extra cost is involved in getting a verification.

David: Ches, I'll let you explain.

Ches: It's a $10 charge for this. Obviously, there's some more checks and stuff that need to be done for AML, so the price will probably end up being more around the sort of $15 with some of the other things that we need to do going forward. But right now, it's $10 for these VoI checks, and then there'll be some, as I said, some additional sort of costs for the AML checks. And we're also providing, for people that want it as well, which I think will be popular, like a compliance product. For things like training your staff and things like that. So, there'll be some subscription costs around that element of it. For those people that want it, we can obviously talk about it in another meeting, but there's quite a lot of compliance requirements, um, out there. As I said before, having a platform that can help manage that, I think, will be a huge cost saving for a lot of businesses, because, again, we're all so busy trying to manage these things ourselves in spreadsheets and other documents, and Bringing outside providers to do training stuff is probably going to be cost prohibitive for most businesses, and finding the right partner. And again, you'll be able to access that sort of service as well. Yeah, it's a fair bit of change is coming, so kind of got, you know, what we've got today, and then what's going to be in the future. I am happy to talk in more detail about how they work in a different presentation.

Kylie: Sure. So, if I'm a vendor, what's the experience? And I ask this because, um. My son recently bought a unit, and I had to verify my identity, because we were guaranteeing his loan or something like that. And he came into my bedroom at, you know, 8 o'clock on a Saturday morning and said, hey mom, I just need you to do the verification of identity thing. And I'm not really awake and still in my jammies and all of that sort of stuff. And he was like, it won't take very long, it takes a few minutes… it didn't take a few minutes. Actually, it involved me getting out of bed and looking for the passport and doing. And then probably verified my identity.

Ches: Look, I can tell you one of the sad and disturbing things of our system, it is easy enough to do in bed. Fortunately, we only capture from the upper chest upwards, but certainly we've had some amusing images that have come through over time, that clearly people aren't wearing clothing on the upper half of their body, which was not how I would do a verification of identity.

Kylie: I had pjs on. I did think that when it was connecting to my passport photo, though, that was like, yeah, probably do look like I just got off a long-haul flight, so that's probably a good match right now.

Ches: Yeah, so look, and again, that's the advantage, and why I'm a big believer in technology. Because humans, we're quite surface level in terms of how we think about people, like dyeing your hair a different color from a human's perspective can be a very different looking person. For example, if you went, I don't know, blonde or completely, you know, black. Your human brain will say, oh my god, Kylie looks so different. I, you know, technology doesn't. It looks at data points, they don't change at all, and it doesn't look at hair color or anything like that, and that's why I think it's good, because it takes that subjectivity we have as humans. We gain weight, we lose weight, all those sorts of factors, the technology is fantastic about that that doesn't bother because of how it measures data points.

Kylie: T-line will be eternal.

Ches: Exactly, and our face doesn't change structure, our eyes don't get any wider or narrower over time, for example, or if we lose or gain weight. So, in terms of the time to do it, it does depend on if you're collecting one or multiple documents, and that's the options that are available. But, you know, normally, if you've got the documents in front of you, you can literally be done in less than 2 minutes. All we really do is we say, which of these documents do you have available? So, driver's license, passport, etc. You select that, where you've got some really smart technology to assist you in the data capture to assist the success of that. So, for example, if you're in very low lighting, or very bright lighting, so you're getting a lot of glares or it's too dark, well, our technology will go, look, we're not going to be able to capture a good photo.

Can you turn the lights on? Can you move from being under that down light? As soon as we get a good quality image, our technology automatically grabs that, so we don't even ask the user to tell us if it's a good photo, we just take a good photo. We tell the user where to place it, and then after that, as Dave said, we do some liveliness checks, which basically involve you to do a couple of head movements, turn left, smile, look right, and that means that you're live and present, and we're analysing the background and how that head moves around it, so we know people aren't putting photos in front of it. And that's it for the actual user. So, you know, even if you're collecting, or some processes, 3 or 4 documents, you've probably done in less than 5 minutes. And then, as I said, all that technology that I talked about before, the analysis of the biometrics of the face, the liveliness checks, the geolocation, where is that person actually located? All of that, the back-to-source government checks are all done. On our server side, and that is also extraordinarily quick. I think the average time from a user completing it to us being able to tell our business customers is 7 seconds. So, it's an incredibly quick process. It's basically for us, then the person could call you to say I've finished. You'd already have the results in the portal, and as Dave said, back into Forms Live, that report would be done, one or two seconds after that 7 seconds would be over across to Forms Live. Insanely fast. So, end-to-end, quite literally, we have people who've sent, you know, by the time I'm sending and they have a completed report back in 5 minutes, and half the time it's because they spent 2 minutes finding their passport or pulling their ID out of their wallet.

Kylie: I'm sure finding the passport takes a lot longer. Or the other thing was, um, I have a digital license, I didn't have a plastic one, and so that freaked the system out.

Ches: Yes, absolutely. We can connect to some digital licenses. Unfortunately, South Australia currently isn't one where the government has that open to corporate vendors, so we aren't able to, unfortunately, do back-to-source checks, but we can do it in other states, like New South Wales and Victoria, and shortly, Queensland as well, and hopefully South Australia will get. Or not just us, but technology business providers will be able to connect to that, hopefully, sometime in the near future.

Kylie: And so, Ches, are you hanging on to the photos? Are you storing that data that you're capturing? Is that your obligation?

Ches: Only depends on our client and their legal compliance requirements. For example, different states have different rules and regulations. These AML rules, depending on the type of verification level that needs to be done, they need to be held for different time periods. It's a fully configurable process. For verification of identity, as we mentioned for real estate agents, because there isn't a strict compliance timeframe, we tend to keep that quite short, the photos, and just keep the report. But obviously, as I said, with these AML changes, that will change again. In terms of the security, so we have ISO 27001 Information Security Management. We undertake regular, what's known as Penetration Test, which is effectively good hackers who attempt to break into our system. We've never had a successful breach. But what they are really good at penetration tests is always giving you industry best practice. So, look, we couldn't get in. Have we noted you hadn't done this level of security, and we're seeing best practice providers don't add this new level of security on. We'll then go through and update our system to make sure. And of course, the data's encrypted as well. Theoretically, not that we would ever want this or encourage it, theoretically, we should be able to give everyone all the images that we had, and it would be totally useless, because they'd be fully encrypted, and we'd quite literally take millions or billions of years of computing power to crack them open. Certainly, that’s something we don't, won't do, and we don't want people to ever get that, but, you know, that's why encryption is so important, and a lot of these unfortunate cases we've seen, like the Optus breaches and stuff like that, there was no encryption on those images. So, as soon as the hackers could get into the system, they had just the literal images, and they can take them out, which is, obviously, definitely, not best practice.

Kylie: Well, look, I'm mindful of the time. Let's wrap up, but what I'm hearing is that With AML legislation coming down the track, and an increase in crime and cyber scamming going on, with this increase in cyber fraud and stuff that's going on, it is absolutely essential for everyone in the real estate sector, or everyone in selling real estate, to start to get their brain around new practices that are about to become mandatory. So, we've got a period now where we can start to get used to what that looks like and start to build the capability in our business so that we're not going to basically, be going from a cold start in July next year. And, that the technology that is existing inside Forms Live and integrated with Scantek is making that a really seamless part of your workflow, and a small cost to start to introduce best practice to your business and reduce your risk. But most importantly, I guess, it really gives your clients peace of mind, and as a principal, give you peace of mind. Because, my god, I can't imagine, the blood leaving your face, what that would feel like if you found out that you just sold a property that didn't belong to the person that. That's stress we don't need.

Ches: Yeah, absolutely.

Kylie: Thank you so much. Any last tips on how to prevent scams, or things that you think Agents should be doing better or different?

David: From our point of view, from a Forms Live perspective, we will start communicating some tips and explain the process as we find out, as Scantek publishes as well, so that you're always in the know. Again, back to what Ches was saying earlier, not to worry, not to panic. Give this a go, and we'll keep you informed, because it's one of those things, you know, it'll be the end of year in no time, it'll be Christmas in no time.

Kylie: Time's going faster.

David: Yeah, keep an eye out on your mailbox as we start to send out this information.

Kylie: Fantastic. Well, Ches, David, thank you so much for your time. I think it's been a helpful webinar. I've seen and heard quite a lot of stuff, or increasingly hearing a lot of stuff. A lot of it is scare mongering, like, and a lot of it's very once-over lightly. So, I think this has been a really practical, insightful way on how straightforward it can be to start to be compliant in this space. Most importantly, it's not just about compliance, it's actually about giving yourself as a salesperson and as a business owner, and your clients, the security to know that, like, knowing that you're all functioning in a safe environment. So, um, so well done.

David: Thank you

Ches: Thanks, Kylie