Up to 100,000 Australian firms became reporting entities on 1 July 2026 - AUSTRAC's own estimate. For many, the identity and ownership evidence the reforms now require you to collect fell inside the Privacy Act for the first time. You're holding more sensitive client data than ever, with a legal duty to protect it, and no fixed checklist of what protecting it means.
AUSTRAC regulates designated services, not industries. The sector labels you'll hear in the press are far broader than the work that actually brings a firm inside the Act. Screen your own client list against what's below - if you provide any of these services, even occasionally, you're a reporting entity, APP 11 applies to that work, and SMB1001 is the way to show you've taken it seriously.
Only firms providing designated services became reporting entities. The sector label is much broader than the services, and most of the commentary has this wrong.
| Captured | Not captured | |
|---|---|---|
| Sales | Buyer's and seller's agents brokering a sale, purchase or transfer. Both the buyer and the seller are your customer on the same transaction. | |
| Developers | Selling house and land, off the plan, or blocks in a new subdivision using your own sales or marketing staff rather than an external agency. | Sales brokered for you by an independent agency. |
| Property management | Managing rental income and expenses through your trust account is expressly excluded by the AML/CTF Rules. Leases of 30 years or less aren't real estate under the Act. |
If you run sales, you're collecting identity documents on both sides of every transaction and holding them for years. Those documents are now personal information the Privacy Act reaches, whatever your turnover. The question isn't whether your AML program is done - it's whether anybody has looked at where the scanned licences actually end up. In most agencies they're in a shared inbox, on the server, and in a backup nobody has tested.
Only firms providing designated services became reporting entities. Which part of your practice is in scope depends on the work, not the shingle.
| Captured | Not captured | |
|---|---|---|
| Property | Conveyancing, and assisting in the planning or execution of a transaction to sell, buy or transfer real estate. | Transfers made under a court or tribunal order, including family law consent orders and deceased estates after probate. |
| Corporate | Creating or restructuring companies and express trusts. Selling or transferring a company. Shelf companies. Nominee directors and shareholders. Registered office services. | Drafting a will, and the testamentary trust that follows from it. |
| Client funds | Receiving, holding and controlling client money to advance a transaction. | Holding settlement funds only to support litigation, where the practice provides no other designated service. |
| Advice | Advice comprehensive enough that the client could act on it without further help. | Litigation. General advice that influences a decision without directly advancing a transaction. |
The Queensland Law Society already supports SMB1001 as an achievable way to show reasonable steps, and recommends practices work toward Gold. Law Society WA holds it itself. The exposure is specific: identity evidence has to be kept for seven years under the Participation Rules, and it ends up in the practice management system, in email, on the scanner and in backups at the same time. Worth knowing the Act doesn't require you to keep scans of identity documents at all - most practices keep them anyway.
Only firms providing designated services became reporting entities. For most practices it's a slice of the work, not all of it.
| Captured | Not captured | |
|---|---|---|
| Structures | Creating or restructuring companies, trusts and partnerships. Selling or transferring a controlling interest in a business. | Advising on whether a structure was lawfully created, after the fact. |
| Transactions | Representing a client in a business sale, preparing or reviewing contracts, due diligence and valuation in anticipation of a sale, preparing for settlement. | Tax advice on the implications of a sale, where no transaction exists yet. |
| Client funds | Receiving and holding client money and controlling where it goes, where that advances a transaction. | Routine bookkeeping that implements fixed instructions with no discretion to redirect funds, where the practice does nothing else captured. |
| Services | Providing a registered office or principal place of business address. |
The trigger is a transaction existing, not a conversation happening. Advice that only influences a client's decision is outside it; acting on instructions that move a transaction forward is inside it. Once you're inside, you're collecting beneficial ownership detail and source-of-funds evidence - exactly the material that makes a practice worth attacking. Practices with a trust account and a structures practice should assume they're captured and scope from there.
Whether you became a reporting entity on 1 July depends on how your customers pay you, not on what you sell.
| Captured | Not captured | |
|---|---|---|
| Payment | Cash or virtual assets totalling $10,000 or more, in a single transaction or in transactions that are linked or appear linked. | Payment only by card or bank transfer, at any value. |
| Goods | Precious metals, gem-quality stones, jewellery, watches, items of personal adornment, goldsmith and silversmith wares. | Items with no precious metal or stone content. In a mixed basket, only the regulated items count toward the threshold. |
| Instalments | Lay-by and staged payments that add up past $10,000 are linked transactions and count. |
If you take cash at that level you need a way to spot linked payments, because structuring under the threshold is the pattern AUSTRAC is looking for, and you have to report a suspicion even if you decline the sale. That means transaction records, customer records and identity evidence sitting in your systems. If you don't take cash over $10,000, you're not a reporting entity on this hook - and we'll tell you that on the call rather than sell you something.
Becoming a reporting entity doesn't just add a report to file. It strips the $3 million small business exemption under the Privacy Act for the personal information you handle in that work, and it requires you to collect exactly what an attacker wants, at the same time.
Take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. The Act doesn't define what those steps are, and "reasonable" gets judged after a breach, not before one.
Identity documents, beneficial ownership detail and source-of-funds evidence. The reforms that make you collect it don't tell you how long to keep it or how to secure it. From 31 March 2026 the Act doesn't actually require you to keep scanned copies of identity documents for record-keeping - many practices keep them anyway.
If that evidence is exposed, you're inside the OAIC's Notifiable Data Breaches scheme for the first time too. "What would you show the OAIC and your insurer?" is worth being able to answer before you're asked it.
"We take security seriously" is a claim. Each step below is something you can actually hand over when a regulator, an insurer or a client asks.
"We take security seriously." A statement, not proof.
MFA, backups, patching, access rules - the actions behind the statement.
Written policies, records, review dates - the proof the actions happened.
Independent assessment and certification - what makes the proof credible to someone else.
Certification is not privacy compliance and it is not an AML/CTF programme. We say so plainly when asked. It's independent evidence that reasonable steps have been taken, and it only holds if the controls stay on afterwards.
Dynamic Standards International writes SMB1001 and CyberCert certifies against it. Five domains apply at every tier - the control count is what moves. Every tier is signed off by a company director, so the person a regulator would look to is the person attesting, not a technical function three steps removed.
| Tier | Controls | How it's verified |
|---|---|---|
| Bronze | 7 | Director self-attestation |
| Silver | 17 | Director self-attestation - the sensible first rung |
| Gold | 28 | Director self-attestation - where most professional firms should land |
| Platinum | 37 | Independent external audit |
| Diamond | 44 | Independent external audit |
Start at Silver, work toward Gold. Silver is seventeen controls and covers most of what a cyber insurer asks at renewal. Gold is eleven more, and it's where the policies, the incident response plan and the asset register come in. Starting at Silver gets you a defensible position in weeks rather than a programme that finishes next year, and the evidence carries forward when you step up.
This is what separates the AML/CTF response from ordinary cyber advice - the demand is being created by the sectors' own peak bodies and regulators.
Already running CyberCert cohorts, with over 150 members registered for its first session. QLS supports SMB1001 as an achievable way to show reasonable steps, and recommends practices work toward Gold.
Holds SMB1001 Gold certification itself - a peak body willing to meet the bar it's recommending to its own members.
The Legal Practitioners Liability Council, covering around 8,000 Victorian practitioners, publicly points members to SMB1001 Gold as the benchmark.
Its Model Participation Rules consultation draft names SMB1001 as one of three recognised Cyber Security Frameworks, and would deem certification to satisfy a conveyancer's "secure use of systems" obligation if it commences as drafted. Still a consultation draft as at late October 2026 - not yet in force.
Are you enrolled with AUSTRAC, and do you know what client ID you're now required to collect?
If you had a breach tomorrow, what would you show the OAIC and your insurer?
When were your security policies last reviewed, and by whom?
Has anyone independent actually checked your controls?
We assess, your IT provider implements, CyberCert certifies. That split is what keeps the assessment independent of whoever did the work.
We work out whether your services are actually captured and where your data risk sits. If you're not captured, we tell you straight.
Readiness assessment against your target tier. Evidence review, interviews, configuration checks. Fixed fee.
Uplift to Silver or Gold: controls explained, policies tailored, taken through to certification.
Senior-only delivery, no graduate handover. Figures AUD, exclude GST. The CyberCert subscription is paid to CyberCert directly; our clients get a 35% discount link.
We'll work out whether your services are actually captured, where your data risk sits, and whether a readiness assessment is the right next step. If it's not, we'll say so.
Coastal Cyber · Sunshine Coast, QLD · dj@coastalcyber.com.au