Since 1 July 2026, real estate agencies have been required to collect and retain customer identity documents under AML/CTF Tranche 2 — for seven years. Most agencies have never had to secure data like this before. This is where a breach, or an AUSTRAC review, finds the gap.
The two-minute check gives you an instant read. If you want the full picture, our fixed-price Data Security Review looks at each of these in your business and hands you a prioritised plan.
Where ID documents live
Are licences and passports sitting in individual staff inboxes, or somewhere actually secured?
Who can reach them
Does access match the role — and does it end the day a staff member leaves?
Retention & disposal
Can every document genuinely be deleted at the seven-year mark, with a record of who accessed it?
Authentication
Is multi-factor authentication on for every account that can reach client data?
If the worst happens
Is there a written plan for the first hour after a breach — including your notification obligations?
Provable compliance
If AUSTRAC asked how you secure retained records, could you show them a document?
The review is an assessment and a roadmap, done with your cooperation — not a penetration test, not a compliance certification, and not legal advice. We tell you where your gaps are and what to fix first, in plain English. If you'd rather your existing IT provider close them, the report is written so they can. Regulatory references are general information; confirm your specific obligations with your own adviser.
Your review is handled by a senior specialist — not a call centre, not a hand-off. Email us and we'll set up a 15-minute call.
hello@circuitrisen.com