Cyber Security for Real Estate Agents: AML/CTF Obligations and the BEC Risk in Property Transactions

Property transactions involve some of the largest single transfers of money that most Australians ever make. For a real estate agent sitting in the middle of those transactions — holding client identity documents, communicating with buyers, sellers, conveyancers, and lenders, and coordinating the chain of events that leads to settlement — that creates a very specific and well-understood cyber risk profile.

Business email compromise (BEC) in property transactions is not a theoretical threat. It is the most financially destructive form of cybercrime affecting the Australian real estate sector, and the mechanics are simple: an attacker compromises or spoofs an email account involved in the transaction, monitors the correspondence, and at the critical moment inserts fraudulent payment instructions that redirect funds to an account they control. By the time the substitution is discovered, the funds have moved on — often offshore. Recovery rates are low.

The same BEC pattern targets mortgage brokers and conveyancers across every property transaction — the attack works wherever large funds move between parties coordinating by email.

Now, layered on top of that existing threat, comes a significant regulatory shift. The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 brings real estate agents into AUSTRAC's regulatory framework for the first time, with full compliance required from 1 July 2026. Understanding both dimensions — the immediate fraud risk and the incoming compliance obligations — is essential for any agency operating in today's environment.

What the AML/CTF Reforms Actually Mean for Agents

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 passed Parliament on 29 November 2024 and received Royal Assent on 10 December 2024. It brings lawyers, accountants, real estate agents, and dealers in precious metals into Australia's AML/CTF framework — making Australia one of the last FATF member countries to regulate these sectors.

For real estate agents, the designated services that trigger obligations include brokering the sale, purchase, or transfer of residential, commercial, industrial, and rural property on behalf of buyers or sellers. From 31 March 2026, enrolment with AUSTRAC opens. From 1 July 2026, compliance is mandatory.

The core obligations for newly regulated agencies are:

• Enrol with AUSTRAC — from 31 March 2026; failure to enrol before providing designated services is a breach
• Develop and maintain an AML/CTF program — a written, risk-based program covering your agency's ML/TF risk assessment, policies, procedures, and controls; must be approved by a senior manager and independently reviewed every three years
• Conduct customer due diligence (CDD) — verify the identity of clients at the outset of a transaction; this means collecting and verifying identity documents, understanding the nature of the transaction, and assessing the source of funds where risk warrants it
• Report suspicious matters — file a Suspicious Matter Report (SMR) with AUSTRAC when you have reasonable grounds to suspect a transaction may involve money laundering or other criminal proceeds
• Keep records — retain identity verification records, transaction records, and due diligence documentation for a minimum of seven years
• Train your staff — all staff involved in designated services must understand the agency's AML/CTF obligations and their role in meeting them

Critically, the AML/CTF obligations create a data security imperative that goes beyond the compliance checklist itself. To meet your CDD and record-keeping requirements, you will be collecting and retaining copies of passport pages, driver's licences, proof of address, and potentially beneficial ownership documentation for buyers and sellers. That data must be stored securely for seven years — and it is exactly the kind of data that attackers target.

Why Real Estate Is a Primary BEC Target

Business email compromise in real estate has a specific anatomy that sets it apart from generic phishing. The attacker does not need to rush — they can patiently monitor email threads for weeks, building a detailed understanding of the transaction, the parties involved, the expected settlement date, and the amounts at stake. When the moment is right, a single fraudulent email is enough.

The scenario most commonly seen in Australian property transactions is straightforward: the attacker compromises the email account of one party — the agent, the conveyancer, the buyer, or the seller — and uses access to monitor the transaction. As settlement approaches, they send an email appearing to come from a legitimate party (the agent, the solicitor, or the bank), advising that banking details have changed and requesting that funds be directed to a new account. The new account is controlled by the attacker.

What makes this particularly dangerous in real estate is the size of the amounts and the irreversibility of the transfers. A successful BEC attack on a single residential property transaction can divert hundreds of thousands of dollars. And unlike credit card fraud, where card networks have chargeback mechanisms, bank-to-bank transfers are extremely difficult to reverse once cleared — especially when the recipient account moves funds onward quickly.

Your Regulatory Obligations

The Data Profile: What Your Agency Actually Holds

Before considering controls, it is worth mapping the data your agency collects and retains across a typical transaction lifecycle. Most agencies accumulate more sensitive data than they realise:

Data Type	Why Held	Sensitivity
Identity documents (passport, driver's licence)	AML/CTF CDD, vendor/buyer verification	Very High — enables identity fraud
Bank account details	Deposit processing, settlement funds	Very High — BEC fraud risk
Financial information (proof of funds, loan approvals)	Pre-qualification, offer processing	High — financial profile data
Rental application data (income, employment, references)	Tenant screening	High — credit and employment data
Property access codes and key information	Inspection management	Medium — physical security risk
Beneficial ownership documentation	AML/CTF enhanced CDD	High — corporate structure data

The AML/CTF reforms do not create this data problem — they make it larger. Agencies that already held identity documents for KYC-adjacent purposes will now be holding them under a formal seven-year retention obligation, with explicit regulatory consequences for inadequate security.

Baseline Controls for Real Estate Agencies

For most small-to-medium real estate agencies, the security baseline that addresses the combined risk profile — BEC fraud, data breach, and AML/CTF compliance — centres on a manageable set of practical controls:

• MFA on all email accounts — the single most important control for BEC prevention; an attacker who cannot access your email cannot monitor your transaction communications
• MFA on your property management software and CRM — these systems hold the bulk of client identity and transaction data; they must be protected with strong authentication
• Out-of-band verification procedure for payment instructions — a documented, mandatory policy requiring phone verification of any banking detail change before acting on it; this must apply to staff across the agency, not just principals
• Secure document collection portal — collecting identity documents and financial information through an encrypted portal rather than via email attachments; email is not an appropriate channel for AML CDD documents
• Encrypted storage for identity documents — the AML/CTF records you retain for seven years must be stored in encrypted form, whether in cloud storage or on local drives
• Documented data retention and deletion schedule — what you keep, how long you keep it, and when and how it is securely destroyed when no longer required
• Incident response plan — a documented process for responding to a suspected breach or BEC incident, including who to contact (AUSTRAC for suspicious matters, OAIC for notifiable data breaches, cyber insurer, police)
• Annual cyber security training for all staff — particularly for property managers and support staff who handle identity documents and communicate payment information with clients

Preparing for 1 July 2026

The timeline for real estate agents is now quite short. AUSTRAC's enrolment portal opens on 31 March 2026, and mandatory compliance commences on 1 July 2026. Agencies that have not yet begun preparing are already behind.

The practical preparation steps most agencies need to work through are:

1. Confirm whether your services are designated services — buyer's agents, seller's agents, and property developers who sell directly are captured; property management services involving only tenancy management are not currently designated services under the Act
2. Conduct your ML/TF risk assessment — AUSTRAC has published guidance and a starter kit; the risk assessment must consider your client base, transaction types, geographic exposure, and delivery channels
3. Draft your AML/CTF policies and CDD procedures — documented processes for identity verification at the start of a client relationship, ongoing monitoring, and suspicious matter reporting
4. Appoint an AML/CTF compliance officer — a named senior manager responsible for your program
5. Audit your data security controls against your new record-keeping obligations — seven-year retention of identity documents requires secure, accessible, and auditable storage
6. Enrol with AUSTRAC by 31 March 2026

The cyber security assessment component — step five above — is where many agencies will find the most work to do. The gap between "we scan documents and save them to a shared drive" and "we retain identity verification records in encrypted, access-controlled storage with a documented destruction schedule" is significant, but it is bridgeable with the right tools and processes.