An AML Program for a Four-Person Agency: Smaller Than You Fear

Does a four-person agency really need a full AML program?

You need a real program — risk assessment, written procedures, a compliance officer, CDD, screening, reporting and records — but "full" does not mean "long". Risk-based means proportionate: a small agency with a simple sales profile can meet every obligation with a program that fits in a short document your whole team has actually read.

And only the sales side triggers it. Brokering the sale, purchase or transfer of real property is the designated service; property management alone is not. If two of your four people are pure PM, your AML surface is smaller than your headcount.

The whole program, sized honestly

Seven pieces. Enrol with AUSTRAC within 28 days of first providing the designated service. Write a risk assessment of your actual business. Write procedures matching it. Appoint a compliance officer. Run CDD on each sale. Know your two reporting duties — suspicious matters within 3 business days of suspicion, and threshold transaction reports for physical currency of A$10,000 or more. Keep everything for seven years.

Read that list again as a four-person agency doing, say, thirty sales a year. It is one setup project and then a per-sale routine. That is the entire mountain.

The risk assessment: an honest afternoon, not a consultancy engagement

Your risk assessment answers plain questions about your own book. Who are your typical vendors and buyers? What share are companies, trusts or SMSFs? Any overseas-based customers? What price bracket, which suburbs, how do deposits arrive? Where the answers are "local individuals, financed purchases, we know half of them by name", your risk is low and your program can say so.

The one mistake to avoid is borrowing someone else's assessment. Its whole legal value is that it describes your business. A template can prompt the questions; only you can supply the answers.

One compliance officer, three hats, clear seams

In a four-person shop the compliance officer is also a selling principal or senior agent, and that is workable if the seams are explicit. Agents run standard CDD as part of listing and sale paperwork. The compliance officer handles the exceptions: entity structures, screening hits, enhanced due diligence, and any reporting decision.

Write the escalation triggers down in one list — trust or company customer, screening match, odd funding story, cash offer — so nobody has to judge in the moment what goes up the chain. In a small team, clarity substitutes for headcount.

The per-sale routine that carries the whole program

Day to day, compliance is a five-step rhythm per transaction: verify the vendor at the agency agreement; verify the purchaser before the deal proceeds; screen the parties; escalate anything on the trigger list; file the lot in the transaction record. On a straightforward sale with individual parties, that is minutes of actual work.

This is where small agencies hold an advantage the big ones would pay for: you see every deal personally. The pattern-spotting that banks attempt with software and committees, you do by knowing your market and noticing when a story does not fit it.

What to buy, and what not to

Do not buy an enterprise compliance platform with modules you will never open — most AML tooling is bank software wearing a real-estate costume, priced for departments, not desks. Do buy the things that genuinely do not scale down by hand: identity verification, PEP and sanctions screening, and a record trail that assembles itself. Indium prices CDD checks at $69 including GST inside the sales workflow, which is the right shape for an agency your size: pay per transaction, own nothing extra.

Then spend what you saved on the one asset that matters most in a small team — an hour of training so all four of you can run the routine without you in the room.

A note on nerve: the size of the penalty regime is designed for institutions, and reading about it can make a small principal freeze. The regulator's real expectation of a four-person agency is not perfection — it is a genuine risk assessment, a program you actually follow, and honest reporting when something looks wrong. An agency that does those things and documents them has done the job.

So set a date this month. One afternoon for the risk assessment, one for the procedures, one hour to train the team, and the routine goes live on your next listing. The agencies still describing Tranche 2 as huge next June will be the ones that spent the year dreading it instead of spending three afternoons doing it.