Purpose: review the 1 July 2026 InvestorKit AML/CTF Program against the current AUSTRAC guidance, Rules, the AUSTRAC Request to verify information form and the 9 Sandon Place scenario.

Status: operational and legal review draft. The governing body, senior manager and AML/CTF Compliance Officer should approve material amendments before implementation. External AML/legal review is appropriate because the Program is a controlled document.

Executive finding

The Program has a useful base. It correctly recognises that both the Buyer and Seller are customers, uses AML Partners as an outsourced operational provider, and keeps the final compliance decision and legal accountability with InvestorKit.

It is not yet detailed enough for the Seller routes now required in practice. It needs explicit controls for:

• third-party VOI or identity evidence;
• case-by-case reliance;
• ongoing written CDD arrangements;
• the special Rule 6-33 same-transaction arrangement;
• the AUSTRAC Request to verify information form;
• fallback verification if information does not arrive;
• intermediary refusal versus actual Seller non-cooperation;
• privacy-preserving contact routes; and
• testing and governance of these arrangements.

Priority 1 — correct Buyer CDD timing

The Program currently says direct-customer CDD is completed immediately after the agency agreement is signed and before properties are introduced.

AUSTRAC says a buyer’s agent starts providing the designated service to the Buyer when the agreement to find or identify property is signed. The safer Program wording is therefore:

InvestorKit completes initial CDD on the Buyer before the buyer’s-agency agreement takes effect or before InvestorKit begins providing the designated brokering service. Where a lawful delayed-CDD provision is proposed, the Compliance Officer must document the legal basis, conditions, risk controls and deadline before services commence.

A system trigger that starts identity collection only after signature does not itself change the legal timing.