What AUSTRAC's April audit order means for real estate agents — AML Simple

AUSTRAC directed a payment platform to appoint an external auditor in April 2026.

The company — MHITS Limited — was ordered to pay for the audit itself and provide the findings to AUSTRAC within a set timeframe. AUSTRAC found the platform lacked adequate transaction monitoring controls. The audit was compulsory, not voluntary.

This enforcement action targeted a payment services company, not a real estate agency. But it tells you something important about how AUSTRAC uses its powers — and those powers apply to your agency from 1 July 2026.

Source: AUSTRAC media release, 2 April 2026

The fastest way to be ready before July

If you have not started on AML compliance, three steps get the foundation in place:

Sign up to AML Simple — around 2 minutes. Enter your ABN and AML Simple pulls your registered business details automatically. Your organisation profile is pre-filled.
Use the AUSTRAC Enrolment Cheat Sheet — around 5 minutes. Open AUSTRAC Connect in one tab, open the Cheat Sheet in another. Every field AUSTRAC needs is pre-filled from your account.
Run the AML/CTF Program Generator — around 15 minutes. Answer questions about your agency and AML Simple generates your program document, consistent with AUSTRAC's Program Starter Kit structure.

Enrolled, program built, record keeping started. That is your compliance setup in place — ongoing CDD, client screening, and staff training start from 1 July 2026.

Prefer to understand what each step involves before you start? Read on.

AUSTRAC's enforcement toolkit

Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, AUSTRAC's enforcement toolkit includes:

Compliance assessments: requesting documentation and evidence of your AML/CTF program.

Directed audits: ordering you to appoint (and pay for) an external auditor — the tool used against MHITS in April.

Enforceable undertakings: binding agreements to fix compliance failures within set timeframes.

Civil penalties: up to $33 million per contravention for a body corporate, and up to $6.6 million per contravention for an individual.

Penalties are per contravention. A failure to enrol, a missing AML/CTF program, and absent CDD records are three separate potential contraventions — they can stack across multiple breaches.

What the MHITS audit reveals

The MHITS enforcement action shows AUSTRAC actively using directed audit powers months before Tranche 2 obligations begin.

Directed audits are not reserved for severe or long-running failures. AUSTRAC deploys them when monitoring controls do not hold up.

For a real estate agency, the equivalent risk looks like:

A program that says "we verify all clients" but no records showing it happened
CDD files that exist for some transactions but not others
A compliance officer named but not trained, and not notified to AUSTRAC

Audit findings from AUSTRAC typically examine whether your written program matches your operational records. Having a program document is step one. Running it as written, and keeping the records, is what makes it defensible.

Source: AUSTRAC guidance on compliance and enforcement — austrac.gov.au

What your agency needs in place by 1 July 2026

Enrolment. Enrolment with AUSTRAC is open now at austrac.gov.au. The deadline for newly regulated entities (including real estate agencies that broker property sales) is 29 July 2026. Completing it early gives you your AUSTRAC Account Number, which is needed for several subsequent steps.

Your AML/CTF program. Your program must document your ML/TF/PF risk assessment, CDD procedures, sanctions screening approach, and record-keeping policy. AUSTRAC publishes a free Program Starter Kit for real estate agencies. AML Simple generates a program consistent with that structure — in around 15 minutes, with your agency's details already filled in.

A named compliance officer. The compliance officer must be at senior management level. Newly regulated Tranche 2 entities must notify AUSTRAC of their compliance officer by 29 July 2026.

Staff training. All staff who perform AML-relevant duties must receive training before they perform those duties. Training records must be retained for 7 years.

CDD from day one. From 1 July 2026, customer due diligence is required on all customers before providing a designated service. Records must be kept for a minimum of 7 years.

Source: AML/CTF Act 2006, s 26F, s 34, s 107; AUSTRAC summary of obligations for new regulated entities

Why July 2026 is not a soft launch

AUSTRAC has confirmed the deadline will not be extended. The July 2026 FATF mutual evaluation of Australia creates additional incentive for AUSTRAC to demonstrate active enforcement rather than leniency.

The MHITS audit order — in April 2026, three months before Tranche 2 obligations commence — shows AUSTRAC is using its powers now, across sectors.

An agency that enrols, builds its program, and starts doing CDD from 1 July 2026 is in a very different position from one that waits to see what happens.

Start your AML program at AML Simple — the first three steps take under 25 minutes.

General information only, not legal or compliance advice. For guidance specific to your agency's circumstances, consult a qualified AML/CTF compliance professional.