Written by
Hadi Hawi, Chief Technology Officer
Reviewed by
Amos Yassa, Onboarding and Compliance Lead
Published 9 May 2026 · Last updated 9 May 2026
Buying a property in Australia is about to require a separate identity check from the real estate agent, the conveyancer, the lender, the settlement agent, and the property manager. Each of those service providers will store its own copy of your driver licence, your passport, your proof of funds. Each will run its own verification. Each will keep its own audit trail. The customer hands over the same documents five or six times. The agencies build the same compliance file five or six times. And every one of those files becomes a target.
That is the world Tranche 2 lands on 1 July 2026. The AML/CTF Amendment Act 2024 brings real estate, legal, accounting, conveyancing, and dealers in precious metals into AUSTRAC's scope, and the regulator expects every one of those service providers to verify every customer to the same standard. The reform is necessary. The way most Tranche 2 sectors are preparing for it is not.
Ratified was built around a different idea. The customer verifies once. The verification is tokenised, time-stamped, and linked to a single QR code. Every service provider in the Ratified Network can confirm that verification by scanning the code, rather than collecting and storing the underlying documents again. The customer doesn't repeat the process. The agency doesn't store another honeypot of identity files. The compliance evidence still satisfies AUSTRAC. The data exposure stops compounding.
Verified Once, Trusted Everywhere. That is the architecture, and the rest of this page explains how it works, who it serves, and why a network model is the only economically rational answer to a regulation that captures 90,000 new reporting entities at the same time.
Most of the Tranche 2 conversation is about whether your business is captured, what AUSTRAC enrolment requires, and how big the penalties are. Those are real questions. They are not the most expensive question. The most expensive question is what compliance will cost your business to operate, every month, after July 2026. And the answer to that question is dominated by one variable: how many times the same customer gets verified across the same transaction.
Consider a residential property purchase. The buyer engages a real estate agent. The agent's agency must conduct customer due diligence under AUSTRAC guidance. The buyer then engages a conveyancer to handle the contract. The conveyancer is a Tranche 2 entity and runs another full check. The buyer arranges finance and the lender, already a Tranche 1 entity, runs a third. The seller's agent runs a fourth on the seller's side. The settlement agent runs a fifth. If the property goes into rental, the property manager runs a sixth. Six identity checks. Six sets of stored documents. Six audit trails to maintain.
Run by hand, this is brutal. The Australian Government's official modelling estimates the average ongoing cost of manual AML/CTF compliance at $23,250 per business per year, with upfront costs around $28,650 for businesses above the small turnover threshold. A self-managed compliance program inside a small real estate agency takes 40 to 60 hours per month at roughly $60 an hour, or $2,400 to $3,600 a month, every month, on top of those upfront costs. Multiply that by every Tranche 2 entity in a transaction and the total industry overhead becomes very large, very quickly.
The customer wears the friction. Stringent KYC processes drive abandonment rates of 70 to 80 percent on complex digital onboarding journeys. An Encompass Corporation survey of corporate clients found 97 percent had considered abandoning a commercial relationship purely because of the friction of repeated identity checks. In the same global benchmark, 70 percent of financial institutions reported losing clients in the prior year specifically because of slow, repetitive onboarding. The friction is not a soft cost. It is a revenue line.
Repetition also multiplies cyber risk. Every time the same passport scan is uploaded to a different system, the number of potential breach points goes up. Every server that stores a copy is one more target. The average cost of an Australian data breach reached $4.26 million in 2024, and the AML/CTF Amendment Act 2024 is about to push that risk into 90,000 new businesses that have never run enterprise-grade security. Tranche 2 turns every captured agency into a high-value target unless the data architecture stops requiring those agencies to hold the documents at all.
Reusable verification is the only economically rational way out. If one verification can satisfy six service providers, the per-transaction cost falls by roughly five-sixths. The customer experience compresses to a single check. The cyber surface shrinks to a single vault, run by people whose entire job is running it. Tranche 2 explained, the Tranche 2 hub covers the regulatory detail. This page explains how to make the regulation affordable.
The Ratified Network is a directory of Australian service providers who agree to recognise the same verification standard. The customer goes through one full identity check. The check uses the Commonwealth's Document Verification Service to confirm Australian-issued documents in real time, runs the AML and beneficial ownership steps appropriate to the customer's risk profile, and produces a tokenised verification record. The record is bound to a single QR code held by the customer.
When that customer engages a second Tranche 2 service provider in the same transaction, the second provider scans the QR code instead of starting the verification process again. The Ratified platform returns a verification confirmation, time-stamped and tied to the original check, with the audit-trail evidence the second provider needs to satisfy its own AUSTRAC obligations. The provider keeps the verification confirmation. It does not need to keep the customer's underlying documents. The risk-based decision still belongs to the second provider, and ongoing monitoring obligations stay with each individual service provider, but the duplication of the verification step is gone.
The economics of the network are deliberately one-sided in the customer's favour. End-users do not pay. Service providers do not pay to join the network. Service providers pay only when they perform an AML/CTF check, on a per-scan basis. That model removes the friction that kills network adoption. A conveyancer who joins the Ratified Network costs the conveyancer nothing until the conveyancer's first scan, which means there is no commercial reason for any captured Tranche 2 service provider in Australia not to be on the network within twelve months. The more service providers join, the more transactions the QR code covers, the more valuable a single verification becomes for the customer who holds it. Verified Once, Trusted Everywhere is the slogan. The mechanism behind it is a network with zero joining cost and pricing only on use.
How the Ratified Network works in practice, the step-by-step workflow walks through the verification, the QR generation, and the scan from both sides of the transaction.
The Ratified QR code is the customer's interface with the network. One verification produces one QR code. The customer holds the code. They present it to the next service provider in the transaction. The service provider scans, confirms, proceeds.
What the QR code does and does not contain matters. The code is a cryptographic reference to a verification record held inside the Ratified platform. It is not a copy of the customer's passport, driver licence, or proof of funds. The raw documents stay inside Ratified's tokenised vault, where they belong. The QR code is a pointer to a verification confirmation, not a packet of identity documents. That distinction is the difference between a compliant data architecture and a privacy breach.
The distinction matters under Australian Privacy Principle 11. The OAIC's 2026 guidance on AML/CTF reporting entities is explicit: businesses must verify identity, but they must not retain unnecessary copies of the raw documents once verification is complete. Storing every passport scan on every agency's local server is exactly the data hoarding APP 11 forbids. A tokenised, network-shared verification confirmation, where the raw documents sit with one custodian rather than six, is the architecture APP 11 expects. Tokenised verification is also the architecture the Identity Verification Services Act 2023 anticipates, because the Act governs how commercial entities access the DVS through approved gateway providers. Ratified operates as a gateway. Each scan against the network calls the underlying verification record, not the underlying documents.
The customer experience matches the data model. One QR code, on a phone, presented at the start of each engagement with a service provider in the network. No re-uploading. No re-scanning of the licence. No third copy of the passport sitting on a small agency's hard drive. The verification record updates in real time when the customer engages a new provider, and the audit trail extends across the transaction without any of the providers needing to handle the raw identity files. The tagline writes itself, Verified Once, Trusted Everywhere, because that is exactly what the QR code does.
The architecture also explains why Ratified leans hard on Australian hosting. The verification record sits inside Australian infrastructure. The DVS calls happen inside Australian jurisdiction. The audit trail is generated and stored under Australian privacy law. We cover that in Australian hosted and APP 11 compliant detail on the security page.
A small agency's compliance problem is mostly time. A franchise network's compliance problem is mostly oversight. When a national real estate group has 200, 500, or 5,000 agents across hundreds of offices, the question is no longer "can we run a verification". The question is "can we prove that every office, in every state, ran every verification correctly, and surface the exceptions before AUSTRAC does".
The Ratified Compliance Officer Dashboard is built for that question. Every verification, every scan, every customer record, and every audit-trail entry across the entire network of offices feeds a single console. Role-based access controls let the head-office compliance lead see the whole picture, while regional managers see their region, and individual office principals see their office. Exceptions surface at the top of the dashboard. Outstanding tasks have owners. The reporting required for AUSTRAC's annual compliance reporting drops out of the dashboard rather than being assembled by hand from spreadsheets.
The dashboard matters because the Australian real estate sector is dominated by franchise networks. Ray White, LJ Hooker, Belle Property, McGrath, and Raine and Horne run agent populations in the tens of thousands across thousands of offices. Tranche 2 captures every one of those agents. Without a centralised dashboard, the head office cannot tell whether the Burnie office or the Bondi office is meeting its obligations until AUSTRAC asks. With one, the head office can audit any office at any time, in real time, with no extra effort from the office itself. That is a governance posture the franchise board can sign off on.
The dashboard also handles the boring, unglamorous, expensive parts of compliance well. Staff training records, AML/CTF program updates, beneficial ownership disclosures for trusts and corporate structures, suspicious matter reports submitted, threshold transaction reports, the seven-year retention horizon under the AML/CTF Act, all of it lives in one place, structured, searchable, exportable. When the regulator asks, the franchise can answer in minutes.
For franchise networks, this scales for your franchise covers the enterprise plan. To compare plans across the rest of the agent-band sizes, see pricing.
Ratified is powered by Tritorian fintech, an Australian company that has been operating identity verification and onboarding systems for regulated financial services since 2015. Tritorian invested more than $2 million and three years of dedicated build into the Ratified platform before launch. The platform did not arrive in response to Tranche 2. It was already running for managed investment schemes, funds and asset managers, and non-bank financial institutions when the Tranche 2 reforms were drafted, which means the Ratified architecture has a regulated-finance pedigree behind it before a single Tranche 2 customer signed up.
Every component of the platform was built in Australia by Australian engineers. The codebase was developed in Australia. The infrastructure runs on Australian-hosted cloud, under Australian jurisdiction, with no offshore processing. That matters for two regulatory reasons. First, the Privacy Act 1988 holds Australian businesses strictly liable for breaches that occur with overseas cloud providers under APP 8 cross-border disclosure rules. Second, AUSTRAC's audit-trail expectations and the OAIC's data destruction rules under APP 11 are both easier to meet when the data never leaves Australian jurisdiction in the first place.
Australian hosting is also a customer-trust signal. Ratified end-users hand over identity documents to a platform whose servers, engineers, and incident response sit inside the same legal system the customer lives under. There is no overseas vendor at the back end of the verification flow. There is no offshore data centre that holds the customer's documents under a different country's privacy regime. The Australian-built and Australian-hosted line is not a marketing line, it is the architecture the regulator expects every Tranche 2 reporting entity to be able to demonstrate, and Ratified is built so the agency can demonstrate it without having to build it.
The corporate chain behind the platform is Australian too. Ratified is operated under Caprock Pty Limited, a non-bank financial institution that sits as the parent entity in the footer. Caprock provides the regulatory surface that Tranche 2 service providers expect from their compliance vendors. The combination, Australian-built engineering through Tritorian, Australian-hosted infrastructure, and an Australian financial-services parent in Caprock, is the foundation underneath the Ratified Network. About Ratified covers the corporate structure in more detail. The team behind Ratified covers the people running it.
For the data sovereignty deep dive, including APP 11 implementation, AUSTRAC-aligned audit trails, and the differences between Australian and overseas-hosted compliance vendors, the Australian hosted and APP 11 compliant page is the canonical reference. To understand how Tranche 2 obligations interact with the Privacy Act in detail, Tranche 2 explained maps the regulatory layers.
Tranche 2 captures specific designated services. The Ratified Network serves every industry inside that scope.
Real estate agencies sit at the centre of the Tranche 2 buyer journey. Sales agents, property managers, and franchise networks all become reporting entities from 1 July 2026. The Ratified QR code resolves the worst end-user friction in real estate, the repeated identity submission across listing, contract, settlement, and tenancy, while the Compliance Officer Dashboard scales the governance up to the largest franchise networks in the country. Real estate agencies covers the full sector use case.
Conveyancers and settlement agents handle the transaction step where the buyer's identity verification feeds straight into title transfer. The Ratified Network lets a conveyancer accept the buyer's existing verification rather than rerun it, while still meeting the conveyancer's own customer due diligence obligations under the AML/CTF Amendment Act 2024. Conveyancers and settlement agents covers the workflow.
Legal practitioners providing designated services, including property transactions, trust formation, and corporate structuring, are captured by Tranche 2. The Ratified Network supports the customer due diligence, beneficial ownership, and ongoing monitoring obligations the practice has under AUSTRAC, while keeping the client experience consistent with the level of service legal clients expect. Legal practices covers the sector workflow.
Accounting practices providing designated services such as company formation, trust administration, and financial transaction services come under Tranche 2 from 1 July 2026. The Ratified Network reduces the verification burden across multi-engagement client relationships and helps the practice meet its CDD and beneficial ownership obligations. Accounting and financial services covers the sector workflow.
Dealers in precious metals and stones, professional and corporate service providers, and other captured sectors are inside the Network's scope. The Solutions hub lists every industry the Ratified Network serves and links through to the per-sector workflow.
Tranche 2 obligations commence 1 July 2026. AUSTRAC enrolment opens 31 March 2026. The window between those dates is short, and every reporting entity captured by the reform is going to be looking for a verification vendor at roughly the same time. Picking a vendor early matters for two reasons. First, vendor capacity is finite, and the agencies that move first get faster onboarding and lower implementation risk. Second, the network economics work better the earlier a service provider joins. Customers who already hold a Ratified QR code prefer providers in the network over providers outside it. Verified Once, Trusted Everywhere is a customer-experience advantage as well as a compliance one.
Three things to do next.
Register now to see the customer verification flow, the QR code experience, and the Compliance Officer Dashboard live, with your own agency's structure mapped against the dashboard. Thirty minutes, no commitment, walk-through by the Ratified team.
See pricing to compare the agent-band plans, the per-scan pricing for service providers in the network, and the enterprise pricing for franchise networks.
The Ratified Network is built so one Australian identity check is enough. Ratified, AML made simple!
