AML/CTF Tranche 2
Compliance Software for
Real Estate AgentsConveyancersAccountantsProperty DevelopersBuyers AgentsSettlement AgentsTax AgentsJewellers & Bullion DealersDealers in Precious Metals

1. Our Commitment to Privacy

AMLTranche ("we", "us", or "our") is committed to protecting the privacy of our Users and their clients. We manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy outlines how we collect, use, disclose, store, and safeguard personal information.

2. Information We Collect

To provide our compliance services, we collect the following categories of information:

2.1 User Information

• Name, email address, business name, ABN
• Contact details and account credentials

2.2 Identity Verification Data (KYC/CDD)

For the purpose of providing AML/CTF compliance services, we may facilitate the collection of:

• Government-issued identification documents (driver's licence, passport, Medicare card)
• Biometric data, including facial images (selfies) captured during identity verification
• Dates of birth and residential addresses
• Beneficial ownership details
• Screening results (sanctions, PEPs, adverse media)

Biometric Information (APP 3 — Sensitive Information): Identity verification is performed using Stripe Identity, a third-party identity verification service provided by Stripe, Inc. During the verification process, Stripe may collect biometric data including a selfie image and a scan of an identity document. This data is classified as sensitive information under the Privacy Act 1988 (Cth). We collect this information only with the individual's express consent and only where reasonably necessary for AML/CTF compliance obligations under the AML/CTF Act 2006 (Cth). If an individual does not consent to biometric data collection, identity verification cannot proceed and the designated service may not be provided.

2.3 Usage and Technical Data

• IP addresses, device identifiers, browser type
• Log data and metadata related to interactions with the Platform

Where reasonably practicable, usage data is aggregated or de-identified before analysis.

3. Purpose of Collection

We collect and use personal information for the following purposes:

• Service Delivery: To generate AML/CTF programs and facilitate identity verification and risk assessment workflows.
• Compliance: To meet statutory obligations under the AML/CTF Act 2006 (Cth), including record-keeping requirements.
• Communication: To send service updates, security alerts, and regulatory notifications.
• Platform Improvement: To analyse usage patterns and enhance AI-driven guidance.
• Legal and Security: To detect fraud, misuse, or unlawful activity.

We do not use personal information for purposes unrelated to compliance service delivery without consent.

4. Disclosure of Personal Information

We do not sell or rent personal information. We may disclose personal information to:

• AUSTRAC: Where required under examination or reporting powers.
• Service Providers: Trusted third-party providers including:
  • Stripe Identity (Stripe, Inc.) — for biometric identity verification. Stripe may process identity documents and facial images on servers located in the United States and/or European Union. Stripe maintains SOC 2, ISO 27001, and PCI DSS Level 1 certifications.
  • AWS (Amazon Web Services) — secure cloud hosting (Sydney Region: ap-southeast-2) for compliance and personal data.
  • Payment processors, communication providers, and other operational service providers.
  All service providers are subject to contractual obligations regarding confidentiality and data protection.
• Professional Advisers: Legal, accounting, or insurance advisers where reasonably necessary.
• Legal Requirement: When compelled by a court order, warrant, or law enforcement authority.

5. Data Residency and Overseas Disclosure

5.1 Australian Storage

All compliance and personal data is primarily stored on servers located in Australia (AWS Sydney Region: ap-southeast-2).

5.2 Overseas Disclosure (APP 8)

While AMLTranche stores compliance and personal data primarily in Australia, certain personal information may be processed overseas by our service providers:

• Stripe Identity — Identity verification data (identity documents and biometric/facial images) may be processed and stored on servers in the United States and/or European Union.

Important: Where personal information is disclosed to an overseas recipient, the Australian Privacy Principles (APPs) may not apply to the overseas recipient's handling of that information, and individuals may not be able to seek redress under the Privacy Act 1988 (Cth) against the overseas recipient. By consenting to identity verification, individuals acknowledge and consent to this cross-border disclosure.

We take reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with the APPs, including through contractual obligations with our service providers. We do not routinely transfer compliance data offshore unless required for identity verification, required by law, or with the individual's explicit consent.

6. Data Retention and Deletion

We retain personal information only for as long as required to:

• Fulfil legal obligations under the AML/CTF Act 2006 (Cth), including mandatory 7-year record retention requirements;
• Resolve disputes and enforce contractual agreements;
• Maintain security and audit integrity.

Where retention is no longer required, personal information is securely deleted or permanently de-identified. Users remain responsible for maintaining independent backups of compliance records where required under their regulatory obligations.

7. Data Security Measures

We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Security measures include:

• Encryption at rest and in transit
• Multi-Factor Authentication (MFA)
• Role-based access controls
• Tamper-proof audit logging with hash chain integrity
• Secure Australian-based cloud infrastructure
• Regular system monitoring and vulnerability assessment

Users are responsible for safeguarding account credentials and restricting internal access to authorised personnel only.

8. Notifiable Data Breaches (NDB Scheme)

In the event of an eligible data breach likely to result in serious harm:

• We will promptly assess the breach within 30 days as required under Part IIIC of the Privacy Act 1988 (Cth).
• We will notify affected individuals and the Office of the Australian Information Commissioner (OAIC).
• We will provide information on recommended steps individuals should take.

9. Access and Correction (APP 12 & 13)

Individuals have the right to request access to personal information we hold about them and request corrections where information is inaccurate, incomplete, or outdated. Requests may be submitted by logging into the Platform or contacting us at compliance@amltranche.com.au. We will respond within a reasonable period.

10. Direct Marketing (APP 7)

We may send service-related communications, regulatory updates, and product notifications. You may opt out of non-essential communications at any time by using the unsubscribe link provided or contacting us directly. We do not sell personal information for marketing purposes.

11. Automated Decision-Making

Where the Platform uses computer programs or AI systems to make decisions that significantly affect an individual (commencing December 2026), we will:

• Provide transparency regarding the nature of automated processing;
• Offer information about the logic involved (to the extent reasonable);
• Provide a mechanism for human review upon request.

12. Role as Data Processor

In most circumstances, AMLTranche acts as a data processor on behalf of Reporting Entities, who remain the data controller of their clients' personal information. Reporting Entities are responsible for ensuring that they have lawful authority to collect and provide personal information to AMLTranche.

13. Cookies and Tracking Technologies

The Platform may use essential cookies for authentication, session management, and security purposes. We do not use third-party advertising or tracking cookies. Analytics data, where collected, is aggregated and de-identified.

14. Children's Privacy

The Platform is designed for use by business professionals and is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email and/or in-app notification. The current version number and date are displayed at the top of this document.

16. Complaints

If you have a concern about our privacy practices, you may contact our Privacy Officer at support@amltranche.com.au. We will respond to complaints within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

1. Nature of Service

AMLTranche (the "Platform") provides software tools, automated workflows, and AI-driven guidance designed to assist businesses ("Reporting Entities") in meeting their obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the "Act"), as amended by the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) ("Tranche 2 Amendments"), and the associated AML/CTF Rules.

The Platform is a workflow and documentation tool only and does not replace the requirement for independent risk assessment, board oversight, or human compliance decision-making. The Platform is designed using a risk-based compliance-by-design framework aligned with AUSTRAC expectations.

2. No Legal or Professional Advice

The Platform, including its AI Knowledge Hub and vectorised AUSTRAC guidance, provides general information only. It does not constitute legal, financial, or compliance advice. While we strive to provide accurate summaries of AUSTRAC requirements, the User should not rely on this Platform as a substitute for professional legal advice or the full text of the Act and the AML/CTF Rules.

3. No Fiduciary Relationship

Nothing in these terms creates a fiduciary, advisory, or agency relationship between AMLTranche and the User. The User's relationship with AMLTranche is solely that of a software licensee and licensor.

4. Reporting Entity Responsibility (The "Safe Harbour" Clause)

The User acknowledges that:

• They remain the legally responsible Reporting Entity as defined by AUSTRAC.
• The use of this Platform does not automatically guarantee compliance with the Act.
• Ultimate Liability: Under Section 38 of the Act, the Reporting Entity remains legally liable for any breach of AML/CTF obligations, even when using third-party software or outsourcing arrangements.
• Where the User has designated a Compliance Officer under Section 24A of the Act, that officer's responsibilities are not diminished or transferred by virtue of using this Platform.

5. Record-Keeping Obligations (Section 104)

The Platform facilitates the 7-year record retention period required under Section 104 of the Act. However, the User acknowledges that:

• The Reporting Entity remains solely responsible for ensuring that all records are complete, accurate, and accessible to AUSTRAC upon request.
• In the event of account cancellation, the Platform will retain compliance data in read-only mode for the statutory 7-year period.
• Records generated or stored within the Platform form part of the User's obligations under the Act and must not be the User's sole record-keeping mechanism without appropriate backup procedures.
• The User is responsible for maintaining independent backups of all compliance records stored within the Platform.

6. AUSTRAC Access and Examination Powers (Section 167)

The User acknowledges that:

• AUSTRAC, pursuant to its examination and access powers under Part 15 of the Act, may require access to records held within the Platform.
• AMLTranche will cooperate with lawful requests from AUSTRAC, including producing records and providing access to stored compliance data.
• The User must promptly notify AMLTranche of any AUSTRAC access request that relates to data stored on the Platform, to the extent permitted by law.

7. Accuracy and Third-Party Data

The Platform facilitates checks against third-party databases (e.g., DFAT Consolidated Sanctions List, PEP lists, and Identity Verification providers). AMLTranche does not warrant that these external databases are 100% accurate, complete, or up-to-date at all times. Users must apply a risk-based approach to all results and exercise independent judgment.

8. AI-Generated Guidance

• Verification Required: Users must verify any AI-generated response against the cited official AUSTRAC documentation before taking regulatory action.
• Liability: AMLTranche is not liable for any regulatory fines, enforcement actions, or other consequences resulting from a User's reliance on AI-generated summaries without independent verification.

9. Tipping-Off and Confidentiality

Users are strictly responsible for ensuring that their use of the Platform does not result in a "Tipping Off" offence under Section 123 of the Act. Users must maintain the confidentiality of all Suspicious Matter Reports (SMRs), Threshold Transaction Reports (TTRs), and related investigative data stored within the Platform. Unauthorised disclosure is a criminal offence.

10. Data Security, Privacy, and Data Residency (APP 11)

We take reasonable steps to protect personal information in accordance with the Australian Privacy Principles (APP 11) under the Privacy Act 1988 (Cth). The User is responsible for maintaining login credentials, enabling MFA, ensuring only authorised personnel access sensitive data, and notifying AMLTranche of any suspected unauthorised access.

Data Residency

All compliance data is stored on Australian-based cloud infrastructure (AWS Sydney ap-southeast-2). User data is not transferred offshore unless required by law or with the User's explicit consent.

Subprocessors

AMLTranche may engage trusted infrastructure and service providers as subprocessors for the purpose of delivering the Platform. All subprocessors are subject to appropriate security and confidentiality obligations. A list of current subprocessors is available upon request.

Data Breach Notification

In the event of an eligible data breach under Part IIIC of the Privacy Act 1988 (Cth), AMLTranche will notify affected Users and the OAIC as soon as practicable in accordance with legal requirements.

11. Service Availability

The Platform is provided on a reasonable-endeavours basis. AMLTranche does not guarantee uninterrupted access. Regulatory deadlines (e.g., 24-hour TTR reporting, 3-day SMR reporting) remain the User's responsibility regardless of Platform availability. The User should maintain alternative reporting procedures to AUSTRAC in the event of service disruption.

12. No Warranty and Limitation of Liability

To the maximum extent permitted by Australian Consumer Law and applicable legislation, AMLTranche is provided "as is" without warranties of any kind, express or implied. We are not liable for any loss of data, regulatory penalties, enforcement actions, or consequential damages arising from the use of, or inability to use, the Platform.

Nothing in these terms excludes, restricts, or modifies any consumer guarantee, right, or remedy conferred by the Competition and Consumer Act 2010 (Cth) or any other applicable law that cannot be excluded by agreement.

13. Liability Cap

To the maximum extent permitted by law, AMLTranche's total aggregate liability arising out of or in connection with the Platform, whether in contract, tort (including negligence), statute, or otherwise, is limited to the total fees paid by the User to AMLTranche in the twelve (12) months immediately preceding the event giving rise to the claim.

14. Indemnity

The User indemnifies and holds harmless AMLTranche, its directors, employees, and contractors from and against any claim, penalty, loss, damage, cost (including legal costs), or regulatory enforcement action arising from or in connection with:

• The User's breach of the AML/CTF Act or associated Rules;
• The User's failure to independently verify AI-generated guidance;
• Incorrect, incomplete, or misleading information provided by the User;
• Any failure by the User to meet AUSTRAC reporting deadlines;
• Unauthorised access resulting from the User's failure to maintain adequate security.

This indemnity survives the termination or expiry of the User's subscription.

15. Suspension and Termination

AMLTranche may suspend or terminate access where reasonably necessary to protect system security, comply with legal obligations, investigate suspected unlawful activity, or address non-payment or material breach. Where practicable, prior notice will be provided.

16. Force Majeure

AMLTranche shall not be liable for any failure or delay in performance caused by events beyond its reasonable control, including cyber incidents, cloud infrastructure failures, AUSTRAC portal downtime, government actions, natural disasters, pandemics, or other force majeure events.

17. Updates to These Terms

AMLTranche reserves the right to update this Compliance Disclaimer from time to time. Material changes will be notified via email and/or in-app notification. Continued use after notification constitutes acceptance.

18. Insurance

AMLTranche maintains appropriate professional indemnity and cyber liability insurance coverage commensurate with the nature and scale of its operations.

19. Governing Law and Jurisdiction

These terms are governed by the laws of New South Wales, Australia. Any dispute shall be subject to the exclusive jurisdiction of the courts of New South Wales.

20. Severability

If any provision of these terms is found to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

21. Contact

For questions regarding this Compliance Disclaimer, contact: compliance@amltranche.com.au