Three months into Tranche 2, many agencies are running AML in-house. John Nguyen explains where the hidden time and risk sit, and the controls DIY programs need.
Three months into Tranche 2, a pattern has emerged across real estate. Many agencies have chosen to run AML compliance themselves. They bought a verification tool, adapted a program template, named someone as the AML/CTF compliance officer and got back to selling.
That can work. DIY is a legitimate choice, and for some agencies it is the right one. But principals are finding the real cost of doing it themselves is not where they expected it to be.
The time goes into the hard files
A straightforward check is quick. An individual vendor with an Australian driver’s licence and no screening matches can be verified and risk rated in minutes. Most software handles that well.
The time goes into the files that aren’t straightforward. A vendor selling through a family trust. A buyer purchasing through a company with layered ownership. An overseas purchaser. A possible match on a politically exposed persons list.
On these files you need to understand who actually owns or controls the customer, decide whether enhanced due diligence applies, and record why. That takes hours, not minutes. It usually lands on someone who already has a full-time job.
The bigger risk is the check that looks complete
The ID was verified. There’s a timestamp and a green tick. But the beneficial owners behind the trust were never identified. The screening match was dismissed without a documented reason. The risk rating stayed at the default because no one questioned it.
Software records what was done. It rarely tells you what was missed. Without a control to catch those gaps, an agency can process dozens of incomplete checks and not know until someone looks closely. That someone may be an independent reviewer, or AUSTRAC.
What banking taught me about exceptions
I spent more than a decade in AML compliance inside Australia’s major banks. The routine volume was never where the risk sat. The risk sat in the exceptions.
That’s why mature AML environments don’t rely on individual diligence alone. They build control frameworks around the work: clear escalation rules, a second set of eyes on higher-risk decisions, regular quality checks and reporting that shows management where things are stuck. Good people under time pressure miss things. The system has to catch what they miss.
What a DIY program needs to hold up
If you run AML in-house, these are the controls I’d expect to see:
-
Ownership with authority. Your compliance officer needs the time, seniority and access to stop a file when required.
-
Defined escalation triggers. Staff should know which customer types, structures and screening results go up the line, and who decides.
-
A second review on complex files. Trusts, companies, overseas parties and screening matches shouldn’t be signed off by one person.
-
Monthly quality sampling. Check a sample of completed files against your own program. You’ll find gaps. The point is to find them first.
-
Exception tracking. Keep a live view of open checks, unresolved matches and any transaction that progressed before due diligence was finished.
-
Records that show judgement. Explain why a decision was made, not only that a document was collected.
-
Reporting to the principal. The people accountable for the program should regularly see where it is working and where it isn’t.
Choosing the model that fits
Some agencies have the volume, people and discipline to run this framework well. Others find that the hidden time cost and the risk of incomplete checks make outsourcing the more practical option. At AML Partners, many of the agencies we now work with started on their own and found the complex files took more time than they could spare.
Neither model suits everyone. What matters is that the controls exist, whoever runs them.
So here’s a test. Pull your three most complex files from the last quarter. Can you show the decisions behind them, or just the documents?