AML in Real Estate Software: UAE, Australia and Canada Compared

TL;DR

Three of your target markets now expect property businesses to do real anti-money laundering (AML) work, and each regulator wants it done slightly differently. The UAE Ministry of Economy supervises brokers and agents and expects reports through the goAML platform. Australia's AUSTRAC began regulating real estate professionals on 1 July 2026. Canada's FINTRAC has regulated brokers, sales representatives and developers for years. If you run a brokerage, developer sales arm or portal across these markets, the practical question is no longer "do we need to comply?" but "can our software prove that we did?"

This guide compares the three regimes on the points that shape system design: who is covered, what must be collected, what must be reported, how long records are kept, and what the compliance programme must contain. It then turns that into a build checklist for CRM, deal and document software. We have kept to what regulators have published and flagged anything we could not verify from a primary source.

This article is general information about software design, not legal advice. Check obligations with your compliance adviser or the regulator before you configure anything.

Why AML is now a software problem, not a policy binder problem

For a long time, property AML sat in a PDF policy and a folder of scanned passports. That works until a regulator asks you to show, for one transaction, who the customer was, what you checked, when you checked it, who approved it and what you did when something looked odd. If the answers are spread across email, WhatsApp, a shared drive and three spreadsheets, the audit is painful even for a well-intentioned agency.

Two things have changed. Regulators have widened the net (Australia is the freshest example), and the expectation of a documented, risk-based programme has become normal. A programme is only as good as its evidence trail, and the evidence trail is a data-model question. Where does the customer record live? Is it linked to the deal? Does the system stop a deal from moving to "sale agreed" before checks are complete? Can you produce the file for a single transaction in a few minutes?

That is the lens for the rest of this article.

The three regimes at a glance

Treat the table as a map, not a rulebook. The sections below explain the detail and the sources.

United Arab Emirates: Ministry of Economy and goAML

The Ministry of Economy describes its role as supervisory and regulatory over designated non-financial businesses and professions, a group that includes real estate brokers and agents. Its circular on brokers and agents applies to those "registered and licensed in the UAE, including those in free trade zones", under the executive regulations of Federal Decree Law No. 20 of 2018 and its amendments. The rules took effect from the beginning of July 2022 (Ministry of Economy circular).

What the Ministry asks brokers to keep

The circular tells licensed and registered brokers and agents to keep relevant records and transactions for a minimum of five years. It also sets out what to collect from the parties:

• For individuals, copies of the Emirates ID or a valid passport.
• For corporate buyers or sellers, the commercial licence, statutes, the register of real beneficiaries, and ID or passport copies for the people concerned, including shareholders or partners.
• Supporting documents such as receipts, contracts and sale and purchase agreements.

Note what this means for a data model. A corporate customer is not one record. It is a legal entity linked to its beneficial owners, its shareholders or partners and the individuals acting for it, each with their own identity documents. If your CRM has a flat "contact" table, you will end up storing a company's ownership structure in a notes field, which is exactly the thing an auditor will want to see.

Reporting through goAML

The Ministry's circular says brokers must submit a real estate activity report (REAR) through the Financial Intelligence Unit's goAML platform in three situations on freehold sales and purchases:

1. Cash payments, single or multiple, amounting to or exceeding AED 55,000 for the property's entire value or part of it.
2. Payment made in virtual assets, for the entire value or part of it.
3. Funds used in the transaction converted from virtual assets into cash, for the entire value or part of it.

The same page says that suspicious activity reporting does not remove the obligation to file other reports through goAML, and it lists the Suspicious Transaction Report, Funds Freeze Report, Partial Name Match Report, High-Risk Country Report and High-Risk Country Transaction Report, alongside the Suspicious Activity Report.

One caution from our own source-checking. A trade-press summary of the same circular printed the cash threshold as "55 dirhams", which is plainly a translation slip. The Ministry's own page gives AED 55,000. When you build rules from regulatory text, always take the number from the regulator, not from a news write-up.

What this implies for software

• A payment-method field on every deal that distinguishes cash, bank transfer, cheque and virtual assets, with part-payments summed so the system can notice when "multiple cash transactions" cross the threshold.
• A flag that tells a compliance officer a REAR may be due, with a link to the evidence, rather than leaving it to memory.
• Structured fields for the various goAML report types, even if filing itself happens in the portal. Capturing the facts once, in your system, avoids retyping them under time pressure.

Australia: AUSTRAC and the 1 July 2026 start

AUSTRAC states that from 1 July 2026, AML/CTF obligations apply to certain services typically provided by a new group of professions and businesses, including real estate professionals such as real estate agents, buyers' agents and property developers (AUSTRAC summary of obligations for tranche 2 entities). Its published factsheet says the obligations attach to "newly regulated services", known as designated services, so scope depends on what you actually do for a client, not simply on holding an agent's licence. AUSTRAC provides a scope-check tool for that question, and we would send any agency to it before making assumptions.

The core obligations

From AUSTRAC's factsheet and summary page:

• Risk assessment and AML/CTF programme. A written assessment of money laundering, terrorism financing and proliferation financing risk, plus policies. The programme must be documented and approved by a senior manager, and independently evaluated at least once every three years.
• A compliance officer. You must appoint a fit and proper person to oversee day-to-day implementation. Sole traders may take the roles themselves.
• Customer due diligence. Initial due diligence before providing a designated service in most cases, ongoing due diligence through the relationship, enhanced measures for higher risk and simplified measures for lower risk.
• Reporting. Suspicious matter reports within 24 hours of forming a suspicion for terrorism financing, and within three business days for other matters. Threshold transaction reports for physical currency of A$10,000 or more, within ten business days. Other report types apply in some circumstances, plus an annual compliance report.
• Records. AUSTRAC says to keep accurate and complete records for at least seven years; the factsheet says most obligations carry a seven-year retention requirement.
• Enrolment. Enrol within 28 days of providing a designated service, which AUSTRAC's factsheet notes would typically be 29 July 2026 for the new services. Changes to enrolment details are due within 14 days.

AUSTRAC's summary page also carries a note that further guidance would follow, and the page may have moved on since we read it. If you are scoping a build, re-check the current AUSTRAC guidance on the day you start.

Why the date matters for builders

The start date has passed, so an agency that runs without systems support is now working from a manual process under live obligations. The pressure points for software are the time-boxed reports (three business days is tight if the suspicion arises on a Friday), the ongoing due diligence requirement (which implies the system should resurface customers for review, not only capture them once) and the seven-year retention horizon, which affects archiving, access control and what you do when a staff member leaves.

Canada: FINTRAC and the compliance programme

FINTRAC regulates real estate brokers, sales representatives and developers. We could confirm the programme requirements directly from FINTRAC's guidance on compliance programme requirements, which applies to all reporting entities (FINTRAC compliance program requirements). That guidance lists the required elements:

• Appoint a compliance officer responsible for implementing the programme.
• Develop and apply written compliance policies and procedures that are kept up to date, approved by a senior officer if you are an entity.
• Conduct a risk assessment of your business.
• Develop and maintain a written, ongoing compliance training programme, with a documented plan for delivering it.
• Document a plan for a review of the programme to test its effectiveness, carried out every two years at a minimum. For entities, findings go to a senior officer in writing within 30 days of the review being completed.

FINTRAC adds that appointing a compliance officer alone does not satisfy the programme requirements. Sole proprietors with no employees are not required to have a training programme or training plan for themselves.

On reporting, FINTRAC's glossary defines "as soon as practicable" for suspicious transaction reports as a period between immediately and as soon as possible. In other words, there is no comfortable grace period to design around.

A law-firm summary of the changes that took effect on 1 June 2021 gives further detail on client checks in real estate (Osler). It explains that a business relationship begins the first time a client's identity is required to be verified, which then triggers beneficial ownership, ongoing monitoring and politically exposed person screening obligations. It also describes verification rules for large virtual currency transactions of $10,000 or more, politically exposed person determinations where $100,000 in cash or equivalent virtual currency is received, and five-year retention for records such as large cash transaction reports and politically exposed person determinations. That article dates from 2021, so treat it as background and confirm current thresholds on FINTRAC's own pages. We were not able to retrieve FINTRAC's real estate sector page when preparing this guide, so we have not stated sector-specific thresholds beyond what is quoted above.

What the three have in common

Strip away the local vocabulary and the regimes ask for the same five capabilities.

1. Know who you are dealing with. Identity documents for individuals, and ownership structure for companies.
2. Assess risk and write it down. A business-level risk assessment that drives how deep your checks go.
3. Name an accountable person. A compliance officer, plus senior-management approval of the programme.
4. Report quickly when something is wrong. With timing that is measured in hours or days.
5. Keep evidence for years. Five to seven, depending on the regime and the record.

These five map neatly to features, which is why one well-designed compliance module can serve several markets with configuration rather than separate builds.

Designing the compliance layer in your property software

1. A customer model that understands ownership

Model people and organisations as separate entities with relationships between them: beneficial owner, shareholder, partner, authorised signatory, power of attorney. Attach identity documents to the person or entity they belong to, with issue and expiry dates. Version the records so you can show what you knew on the date of the deal, even if the customer's details later changed.

2. Deal gating that follows the checks

Let each deal carry a compliance status that the workflow respects. A deal should not progress to the contract or exchange stage while mandatory checks are open, unless a named person overrides it with a recorded reason. The override is as important as the block. Real estate moves fast, and a system that cannot be bypassed will simply be bypassed outside the system.

3. Payment-method capture and threshold monitoring

Record how every part of the price is paid and by whom. Rules that sum cash receipts across a deal (relevant to the UAE's AED 55,000 REAR trigger and to Australia's A$10,000 threshold transaction reports) need that data to be structured. Keep thresholds as configurable values with an effective-from date and a source reference, because they change.

4. A case workflow for suspicious matters

Give compliance officers a case record that collects the facts, the deal, the people involved, the officer's reasoning and the decision to report or not report. Include a timer that reflects the relevant clock for the jurisdiction, such as Australia's 24-hour and three-business-day rules, and escalations that fire before the clock runs out. Restrict who can see these cases. Staff who handle a deal should not necessarily see that a suspicion has been raised about it.

5. Screening that runs more than once

Sanctions, politically exposed person and adverse-media screening is not a one-time gate. Australia's guidance describes ongoing due diligence, and FINTRAC's framework ties ongoing monitoring to the business relationship. Design screening as a scheduled and event-driven process: at onboarding, when a new party is added to a deal, and periodically for active customers. Use an established screening provider through an API rather than building lists yourself, and log each result with the date and list version.

6. Documents, templates and audit trails

Many of the artefacts regulators ask to see are documents: signed agreements, ID copies, source-of-funds declarations. Generate them from controlled templates, store them against the deal, and keep an immutable log of who viewed, changed or exported each one. If you already produce transaction paperwork in-house, a title and document generator tied to the same deal record keeps the evidence and the paperwork in one place.

7. Retention and deletion that agree with each other

Five years in the UAE and seven in Australia are minimums, which sits awkwardly beside privacy law's push to delete data you no longer need. Build retention rules per record type and per jurisdiction, with a hold flag for anything under review. When the retention period ends, deletion should be a deliberate, logged event, not a manual clean-up that nobody owns.

8. Reporting hand-offs

Whether you file through goAML, AUSTRAC or FINTRAC, your system's job is to assemble accurate data and keep a copy of what was filed, the acknowledgement and the date. Start with exports that match each portal's required fields. Direct integration can come later, once you have confirmed what each regulator offers for your category of reporting entity.

Build, buy or configure?

Not every agency needs custom software. A sensible decision path looks like this.

Configure what you have if you operate in one market, close a modest number of deals and your existing CRM already supports custom objects, approval workflows and document storage. Many do. Spend your effort on process and training.

Buy a specialist compliance tool if your main gap is identity verification and screening. These tools are good at one thing, and you integrate them into your deal flow through APIs.

Build or extend if you operate across several jurisdictions with different clocks and thresholds, if your sales model involves brokers, channel partners and developers on shared inventory, or if the deal record is already the centre of your operation. In those cases the compliance layer is not an add-on. It is part of the transaction workflow, and a bolt-on will leak at the seams.

Developers with broker networks face a further wrinkle: the people selling your inventory may be separate regulated entities, each with obligations of their own. A broker and channel-partner portal can collect the evidence at the point of sale and give you visibility without pretending that responsibility transfers. Whether and how obligations are shared is a legal question for your adviser.

A phased approach that works

You do not need to ship everything at once. A pragmatic sequence:

1. Map your obligations by jurisdiction with your compliance adviser. Write down each report, each threshold and each deadline with a source link.
2. Fix the data model first: people, organisations, relationships, documents and payment methods.
3. Add deal gating and the case workflow, so the process lives inside the system.
4. Integrate screening and identity verification, then automate reminders and re-screening.
5. Build reporting exports and the retention engine.
6. Rehearse an audit. Pick a closed deal, pull the full file and see how long it takes. Fix whatever slowed you down.

If you already run an integrated platform for listings, leads and transactions, the real estate data platform approach we have described elsewhere is a natural home for the compliance layer. Integrations with screening providers and government channels typically go through well-designed API development and integration, and recurring steps such as reminders, escalations and document requests are good candidates for workflow automation.

Common mistakes we would avoid

• Treating the compliance officer as the system. Regulators in all three markets want a programme, not a person. The software should make the officer's job possible, not replace the need for one.
• Hard-coding thresholds. Thresholds and deadlines change. Store them as configuration with an effective date.
• Capturing documents without structure. A folder of scans cannot answer "who owns this company?" A relationship model can.
• Ignoring the offline reality. Brokers collect documents on WhatsApp and in showrooms. Make capture from a phone easy, or the process will run around your system.
• Over-blocking. A workflow that stops every deal for minor gaps teaches staff to work around it. Block on what matters, warn on the rest.
• Forgetting access control. Compliance cases and suspicion records need tight permissions and a log of who looked.

Conclusion

The UAE, Australia and Canada approach property AML from different directions, but they ask for the same underlying things: know your customer properly, assess your own risk, name someone accountable, report quickly and keep the evidence. For brokerages and developers selling across these markets, that turns the problem into a design question about customer models, deal gating, case handling and retention.

Start by writing down your obligations with sources, then fix the data model before you add automation. A compliance layer that lives inside the transaction workflow is cheaper to maintain than a pile of spreadsheets, and far easier to defend when a regulator asks to see the file.

Syslabs builds custom software for real estate teams, from listing and transaction platforms to partner portals and document workflows, and works with international clients across time zones. If you would like to talk through how a compliance layer might fit your deal flow, scope and pricing are agreed on a consultation. You can book a meeting, and the booking page shows slots in your own time zone.