Program review and corrective actions: Open the detailed review of InvestorKit’s AML/CTF Program, reliance controls and the 9 Sandon file
Do not call every third-party identity report “reliance”. First decide whether it is only supporting evidence, formal reliance, a same-transaction Rule 6-33 arrangement, or genuine Seller non-cooperation.
Use this when every individual Seller agrees to complete InvestorKit’s secure AML Partners process.
Staff must confirm every legal Seller and capacity, obtain or arrange a verified contact route, send the secure request through Engage, make sure each Seller is covered, link the result to the contract and property, complete representative/entity checks where relevant, and wait for InvestorKit Compliance to accept the identity, screening and risk outcome.
Use this for a selling-agency identity report, Securexchange report, PEXA or conveyancing VOI, company extract, trust document or another useful record that does not satisfy a formal reliance mechanism by itself.
Staff must confirm exactly who and what the report covers, match it to every legal Seller and capacity, record the issuer and method, upload it securely, list every missing CDD item, and have AML Partners or Compliance complete the missing identity fields, PEP, sanctions, adverse media, representatives, beneficial ownership, nature and purpose and InvestorKit risk assessment.
Use this only after Compliance documents that the other business is an eligible Australian reporting entity or regulated foreign equivalent, reliance is appropriate to InvestorKit’s risk, all KYC can be obtained by the deadline, and copies of the reliable and independent verification data can be obtained immediately or as soon as practicable after request.
A licence, professional reputation, “KYC passed” statement or matching name is not enough by itself.
Use this only where InvestorKit has a written, senior-manager-approved arrangement with an eligible third party. It must allocate responsibilities including recordkeeping, provide access to all KYC and verification data, and be assessed at least every two years and after a significant change.
Use this where another participating reporting entity in the same property transaction agrees to collect or verify specified Seller information and provide the KYC and verification data under the real-estate Rules.
The AUSTRAC starter-kit Request to verify information form can document this route. The form identifies a first entity and second entity, records the customer, risk and transaction, allocates collection and verification work, requires information and verification data to be returned, and requires both entities to keep the arrangement and relevant records for seven years.
The form does not create an arrangement merely because it is sent. The relevant parts and responsibilities must be completed and signed, and InvestorKit must still complete its own identity, nature-and-purpose, risk and any remaining CDD work.
<aside> ⚠️
Important form inconsistency
The current starter-kit form labelled version 1.1 still says 15 days after contract exchange in one field in Part 2, while Part 4 uses 28 days after exchange and provision at least 3 days before the initially agreed settlement date. AUSTRAC’s June 2026 update and the current Rules confirm the 28-day/3-day framework. Do not use the 15-day sentence as the legal deadline. InvestorKit should use a Compliance-approved corrected copy or annotate the form before operational use.
</aside>