What is customer due diligence (CDD) for real estate?

Customer due diligence (CDD) is the process of verifying who your clients are, understanding their ownership structure, and assessing whether the transaction carries unusual money laundering risk — before you provide your designated service.

From 1 July 2026, CDD is a legal requirement for Australian real estate agents who broker property sales. It's not optional, and it's not just collecting a copy of a driver's licence.

AML Simple's CDD workflow — available from amlsimple.com/get-started — walks you through every step: identity verification, beneficial ownership capture, sanctions screening, and risk assessment. You send a digital verification link to the client; they complete it on their phone. The record is stored automatically for the required seven years.

Here's what CDD actually requires.

Why CDD matters for real estate

Real estate transactions are high-value and historically attractive to money launderers. Property can be used to convert illicit cash into a legitimate asset — a process that's easier when the agent doesn't ask questions about the source of funds or the true identity of the buyer.

AUSTRAC's sector-specific guidance identifies real estate agents as being in a unique position to identify suspicious patterns. Unlike a bank, a real estate agent often has direct, personal contact with the buyer or vendor. That relationship is the best opportunity to identify when something doesn't add up.

CDD is the formal framework for that assessment.

When CDD is triggered

You must conduct CDD when you provide a designated service — for real estate agents, this means when you act on behalf of a client in buying or selling real property.

In practice, CDD is triggered:

When a new client engages you as their selling agent — before you list their property
When you act as a buyer's agent — before you begin searching for or negotiating on their behalf
When an existing client comes back for a new transaction — you generally cannot rely on old CDD records if circumstances have changed or the records are out of date

CDD applies to the client you are acting for — not to the other party in the transaction.

What CDD requires you to collect and verify

The new CDD framework under the reformed AML/CTF Act requires you to:

1. Collect identity information

For individuals:

Full name
Date of birth
Residential address

For companies:

Full legal name and ABN/ACN
Principal place of business
Names of directors
Beneficial owners (see below)

For trusts:

Full legal name of the trust
ABN (if applicable)
Name and details of the trustee
Details of the trust deed
Beneficiaries (or class of beneficiaries)

2. Verify that identity information

Collecting details is not enough — you must verify them against reliable, independent sources.

For individuals, this typically means verifying identity documents: an Australian driver's licence, Australian passport, or Medicare card combined with another document. AUSTRAC accepts electronic verification (via third-party services) as well as physical document checks.

For companies and trusts, verification typically involves checking ABR, ASIC, and/or the trust deed.

3. Identify and verify beneficial owners

A beneficial owner is the natural person who ultimately owns or controls the client — directly or through a chain of ownership.

For a sole trader or individual buyer, this is straightforward. For a company or trust, you need to look through the entity to find the individual(s) who ultimately control it.

AUSTRAC requires you to identify and verify beneficial owners where they hold more than 25% ownership or control of the entity. Where no natural person meets that threshold, you identify the most senior person in control (usually a director or trustee).

4. Understand the purpose and nature of the transaction

You're also required to understand the purpose of the transaction and — in higher-risk cases — the source of funds. For a straightforward residential sale or purchase, this will often be evident from context. For large commercial transactions, purchases by non-resident buyers, or complex ownership structures, AUSTRAC expects you to ask and document the answers.

Simplified and enhanced CDD

Not every client requires the same level of scrutiny.

Simplified CDD may apply to lower-risk customers — for example, an Australian-resident individual with a simple purchase where the source of funds is clearly documented (e.g., from a bank mortgage). Your AML/CTF program should define when simplified CDD applies and document the rationale.

Enhanced CDD is required in higher-risk scenarios. AUSTRAC identifies the following as triggers for enhanced CDD in real estate:

The client is a politically exposed person (PEP) — a current or former senior government official, their family members, or close associates
The client is based in or connected with a high-risk jurisdiction — countries identified by FATF as having strategic AML/CTF deficiencies
The transaction involves unusual payment structures — large cash components, third-party payments, or multiple currency sources
The client's beneficial ownership structure is complex or opaque
The client is reluctant to provide required information

In enhanced CDD situations, you're expected to ask more questions, apply greater scrutiny to the answers, and document your assessment.

Ongoing CDD — it doesn't stop at onboarding

CDD is ongoing, not a one-time check. You must monitor your client relationships and update CDD records when:

A client's circumstances change materially
You become aware of new information that affects your risk assessment
AUSTRAC guidance or sanctions lists change in a way relevant to a client

For returning clients, this means you can't simply rely on CDD records from a previous transaction without checking whether they're still current and accurate.

How CDD connects to your AML/CTF program

CDD doesn't operate in isolation. Your AML/CTF program sets out the policies and procedures that govern how you conduct CDD — who is responsible, what you collect, how you verify, what thresholds trigger enhanced CDD, and how records are kept.

For a full breakdown of how the 7 obligations fit together (including CDD, sanctions screening, and suspicious matter reporting), read: Your AML/CTF Program: A Complete Guide

Practical notes for small agencies

You don't need enterprise software. CDD verification for a small residential sales agency is not as complex as it is for a bank. For most individual clients, verifying an Australian driver's licence or passport — using a compliant electronic verification service — is sufficient.

AML Simple's digital verification link lets you send CDD to a client before you leave the agent's office. They complete it on their phone while you're still at the property. Records are stored automatically for seven years with no manual filing.

You cannot refuse CDD and still act for the client. If a client refuses to provide required identity information, you cannot provide your designated service. Your AML/CTF program should include a documented procedure for this situation.

This post is general information about customer due diligence requirements under Australia's AML/CTF framework and does not constitute legal advice. Sources: Anti-Money Laundering and Counter-Terrorism Financing Act 2006, Part 2; AUSTRAC Customer Due Diligence guidance; AUSTRAC Real Estate Sector Guidance.

What Is Customer Due Diligence (CDD) for Real Estate?