Property
Bold Property Group
Off-market deal sourcing and the AML/CTF program run from one staff app.
Screening runs against 11,414 DFAT Consolidated List rows every day.
Compliance readiness
An AML/CTF program for firms regulated under tranche 2.
For law, accounting and real estate firms regulated since 1 July 2026: the program written, then run inside the systems your staff use.
At a glance
- 1 July 2026Tranche 2 firms became reporting entities
- 7 yearsRecord retention built into the program
- SMB1001:2026 Gold, opens in a new tabCyberCert public registry
Overview
Since 1 July 2026, a law, accounting or real estate firm that provides a designated service is a reporting entity under the AML/CTF Act. It needs a program written for its own risks, and the records that show it running.
How the program runs
We write the program with the firm and build it into the systems the firm already works in. The checks, approvals and records sit beside the client file, the matter or the deal, so the evidence exists on the day AUSTRAC or an evaluator asks for it.
Who tranche 2 brings in
The reforms to the AML/CTF Act extend the regime to the professions that handle the money and the structures behind a transaction. A firm becomes a reporting entity when it provides a designated service, so the first job is to establish which of its services are designated.
- Legal practitioners who act in property transactions, hold or manage client money, or set up companies and trusts
- Accountants who provide the same kinds of services, including forming and administering companies and trusts
- Real estate agents and buyer's agents who broker the sale, purchase or transfer of property
Which services count
Whether a particular service is designated is a legal question, and the firm's legal adviser decides it. The program is then built around the services that are.
What an AML/CTF program contains
The program is the firm's ML/TF risk assessment and the policies that manage those risks, approved by a senior manager and overseen by the governing body. Under the reformed Act and the AML/CTF Rules 2025 it deals with each of these.
- An ML/TF risk assessment of the firm's customers, services, delivery channels and jurisdictions
- An AML/CTF compliance officer, with the role's fit and proper assessment recorded
- Customer due diligence: identity verified, beneficial owners established and the customer risk rated
- Targeted financial sanctions: customers screened against the DFAT Consolidated List
- Politically exposed persons identified, with a recorded approval before the work continues
- Ongoing due diligence, with suspicious matters assessed and reported to AUSTRAC
Staff, records and evaluation
- Due diligence and training for the staff who deliver designated services
- Records kept for seven years, and an independent evaluation at least once every three years
How we build the program
The risk assessment comes first, written from how the firm takes on clients and moves their money, and the policies follow from it. Each policy is then built into the system the staff already work in, so each check runs at the step where the work happens: intake, a new matter or deal, and before money moves.
- Designated services mapped, and the risk assessment written from the firm's own clients and channels
- Policies drafted for each obligation and approved by a senior manager
- Checks built into intake, the client record and the matter or deal, with each approval recorded
- Screening scheduled against the DFAT Consolidated List, with matches routed to the compliance officer
- Staff trained on the program as it runs in their own system
- Records retained for seven years, with the evidence an evaluator reads kept in one place
Run in software, beside the work
Bold Property Group runs its AML/CTF program inside the staff app we built, beside the deal pipeline. Each client record is screened every day against the DFAT Consolidated List, with the FATF high-risk and monitored lists in the same run, and a politically exposed person needs a recorded approval before work continues.
GRM LAW carries its AML/CTF program in the operations and compliance portal we built and run, connected to Smokeball, where intake, conflicts and the matter register already live and every change is recorded with who made it.
Approvals, records and the compliance officer
In the Bold program every uploaded document is scanned for malware on arrival, records are kept for seven years, and the compliance officer role, its fit and proper assessment, due diligence and training are recorded in the app beside the checks they oversee.
They are among the regulated firms whose systems we build, host and secure.
What AUSTRAC expects to see
A reporting entity enrols with AUSTRAC, reports suspicious matters and threshold cash transactions, and keeps the records that show its program operating. Those records are what an AUSTRAC review or an independent evaluation reads: who was checked, what was found, who approved what, and when.
Independent evaluation
The program's policies set how often it is independently evaluated, at least once every three years, by an evaluator with no part in building or running it. AML/CTF independent evaluation tests the risk assessment, the policies and compliance on sampled records.
Protecting what the program collects
A program gathers identity documents, ownership records and suspicious matter files, which makes the system holding them worth attacking. The tipping-off offence also means a suspicious matter file is seen only by the people who need it.
We build access by role, an audit trail of every change and who made it, and retention for the seven years the Act requires.
Our own certificate
Black Shard holds SMB1001:2026 Gold, verifiable on the CyberCert public registry.
Scope and how it is quoted
A program build is scoped and priced before the work starts, in writing. Five things drive the scope.
- The designated services the firm provides, and how many business lines deliver them
- The number of clients, and how many are companies, trusts or overseas
- The systems the checks run in: a practice system, a CRM, or a portal we build
- Whether a risk assessment or policies already exist to work from
- Whether we run the screening and the records after go-live
How to start
Send a brief to info@blackshard.com.au with the firm's sector, the services it provides and the systems it runs on. The designated services are mapped first, and the scope and the timetable follow.
Financial services
Stone Leaf Capital
Staff, investors and the board work from one portal inside the licence perimeter.
Every investor is identity-checked through InfoTrack before they can proceed.
Legal
GRM LAW
The firm runs intake, conflicts, trust oversight and AML/CTF from one portal.
A new release of the portal ships every week.
From the newsroom
Fraud, in the newsroom.
Questions, answered.
Is this legal advice?
No. We write and build the program with the firm and run it in software. Questions of legal interpretation, such as whether a particular service is designated, are decided by the firm's legal adviser from the record we provide.
Can the program run inside our practice management system?
Where the system has an API, the checks and records connect to it, as the GRM LAW portal does with Smokeball. Where it does not, the program runs in a portal or app we build, with the client and matter details carried across.
Who is the AML/CTF compliance officer?
A person at management level in the firm, appointed by the firm. We record the appointment, the fit and proper assessment, due diligence and training in the program, and route screening matches and approvals to that person.
Can you also run the independent evaluation?
Not on a program we built. AUSTRAC expects the evaluator to have had no part in developing the program, so a firm we built for engages a separate evaluator. We evaluate programs built by others.
