The Next Real Estate System Is the Evidence Trail

After a phone call, a CRM field may change while a buyer receives a document a few seconds later, and an AI tool may pull notes from three different places before drafting a message to a vendor. The work looks finished until somebody asks where the information came from, who allowed the action, or why the system reached that result.

Plenty of agency software can show the latest value in a field, the last person who opened a record or the time a message was sent. What it often cannot show is how the result came to exist: whether the information was supplied by the client, inferred by AI or copied from another system, whether the person had authority to act, which version of the instruction was followed and who approved the result before it reached the client.

More agency work now passes between people and systems, information is reused across several tasks, and actions can happen without one person manually carrying every step. The agency increasingly needs a record of the path from information to outcome, not only the outcome that happened to remain in the CRM.

AUSTRAC Puts the Record Into the Workflow

AUSTRAC has put a live Australian deadline around part of this problem. The new anti-money laundering and counter-terrorism financing obligations came into force on 1 July for businesses providing the relevant designated services. AUSTRAC says businesses providing the new designated services from that date must apply to enrol by 29 July 2026. Its real estate guidance says seller's and buyer's agents are likely to provide a designated service when they broker the sale, purchase or transfer of real estate, although the precise position depends on the services the business provides and their link to Australia.

The obligations began on 1 July, four weeks before the enrolment deadline. AUSTRAC said affected businesses should already have an AML/CTF program and compliance officer in place, be training staff and be ready to report. It also distinguishes enrolment from registration, which generally applies to remittance and specialised virtual asset services rather than an ordinary real estate agency.

AUSTRAC's real estate starter kit is built around a risk assessment, policies, day-to-day processes and forms that record information and demonstrate compliance. Once customised, AUSTRAC says those documents can be incorporated into the agency's existing systems and processes.

The kit is deliberately narrow. It was designed for small real estate and buyer's agencies with 15 or fewer personnel, one designated service and a relatively straightforward customer, service and risk profile. Agencies outside those characteristics need to assess what can be adapted and what stronger or additional controls they require. Even an eligible agency still has to customise the kit around the size, nature, complexity and risks of its own business.

AUSTRAC describes the work through consistent, defensible decisions, day-to-day tasks, escalation, ongoing monitoring and records that support later review. In practice, compliance becomes work moving through a system, with enough evidence attached to show what the business did and why.

The process version belongs in that trail as well. AUSTRAC's latest identified release of the real estate starter kit is version 1.1, dated 3 June 2026. Its update guidance tells agencies using the kit to apply the relevant changes and replace or retire superseded documents so people do not keep relying on outdated obligations. A record saying that a check was completed has limited value if nobody can later tell which procedure or form was used at the time.

The Record Has to Explain the Action

Inside an agency, the evidence trail needs seven connected parts: the source of the information, the person or system that acted, the permission or authority relied upon, the action taken, the version of the instruction or process used, the human approval where the risk required it, and the eventual outcome. A timestamp helps, but time alone cannot explain the decision.

A seller supplies information, an identity check is completed, a staff member follows the agency's current process, and an inconsistency may need to be escalated. The record needs to show what information was collected, where it came from, what was checked, who completed the work, which procedure applied, how the exception was handled and who approved the decision to continue. The next person can follow the file without recreating it from a scanned document, an email thread and somebody else's recollection.

A system classification can change which checks occur, whether someone is called, whether they enter an automated sequence or whether they disappear into a long-term nurture list. If that classification is based on a call summary, a portal enquiry, an inspection note or a model's inference, the agency should be able to see the basis and correct it when the result is wrong.

A buyer asks for a contract, the system identifies the property and contact, a document is selected, a message is prepared and the file is sent. A simple “sent at 3:42 pm” entry proves only the final action. A stronger record connects the buyer's request, the document version, the workflow rule, the person or system that initiated the send, any required approval and whether the message was delivered. If the wrong contract later turns out to have been attached, the agency can find the failure point and fix the process rather than simply resend the file and hope it does not happen again.

When Software Changes the CRM or Contacts a Client

Issue 18 looked at systems beginning to act around the transaction. Once that authority is granted, the principal's job expands from deciding what the system may do to deciding what evidence it must leave behind. The more steps the software carries, the less visible the path can become to the people responsible for the result.

An AI-generated client message can compress the whole problem into a few seconds. The tool may draw on CRM notes, inspection feedback, campaign data and a previous vendor report, then produce a fluent draft even when one of the source notes is old, ambiguous or attached to the wrong person. Before the message is sent, the agency needs a way to distinguish the AI draft from verified facts, see which records informed it, preserve the version that was reviewed, record the agent's changes and show who approved the final communication.

The Office of the Australian Information Commissioner deals directly with this in its guidance on commercial AI. Where AI is used with personal information, it says records should make clear when information is an AI output or probabilistic assessment rather than a fact, and should identify the data and AI system used to generate it. It also says a human user should be responsible for verifying the accuracy of personal information obtained through AI and be able to overturn a decision.

A buyer tells an agent that they are speaking with a broker, then an AI call summary changes the CRM finance field to “pre-approved”. That one field can affect buyer ranking, matching, follow-up and what appears in a vendor report. If the system keeps the source transcript or note, the automated change, the rule or model involved and the later human correction, the agency can repair both the record and the workflow that created the mistake.

Exceptions are where a thin record usually breaks down. A vendor gives an urgent instruction after hours, identity information does not match, or an automation fails halfway through and a staff member finishes the task manually. A manager may approve a one-off step outside the usual process. Those moments should not disappear because the final field looks correct. The reason for the exception, the person who handled it, the authority they relied on and the outcome belong together.

Australian-led cyber guidance on agentic AI describes the same operating requirement in more technical terms. The guidance, written mainly for government, critical infrastructure and larger operators, recommends artefacts that document an agent's actions and decision process, source references, human-readable logs of tool use, traceability for decisions and actions, and human approval for higher-impact steps. A suburban agency does not need the security architecture of critical infrastructure, but software with authority still needs a visible and reviewable history.

Good Evidence Can Mean Less Data

Keeping a better trail does not mean keeping every document, recording and message forever. The privacy side of the AUSTRAC reforms requires a more disciplined approach. The OAIC says reporting entities, including small businesses that might otherwise sit outside parts of the Privacy Act, have Privacy Act obligations when they handle personal information for or in connection with their AML/CTF responsibilities. For an otherwise exempt small business, that does not automatically bring every unrelated activity within the Act.

The OAIC suggests that a business maintain an inventory showing why personal information was collected, the legal authority for collecting it, where it is stored, who can access it, how long it will be retained and whether third parties are involved. In agency terms, the inventory connects the reason for collection with the places where identity data, CRM records and AI tools can all touch the same client relationship.

On identity documents, the OAIC says the AML/CTF Act does not require scanned copies or photocopies of the documents themselves to be kept for record-keeping purposes under the new regime. The agency can instead retain the required information from the document, the document type, what it did to identify the customer and the outcome of the verification and risk work, while considering when full copies are no longer needed and should be destroyed or de-identified.

Better evidence does not always mean more raw data. A well-designed trail keeps enough to explain the work, respects the reason the information was collected, limits access and avoids turning the CRM or compliance drive into a warehouse of identity material that nobody has a good reason to retain.

The Principal's System Test

Principals can see in a feature demonstration whether software can update the CRM, classify a client, prepare a message, request a document or advance a workflow. They also need to know whether the agency can later retrieve the information used, the actor, the authority, the action, the process version, the approval and the outcome in a form a normal operator can understand.

The history also needs to survive the supplier relationship. An impressive audit screen has limited long-term value if the agency cannot export the record, connect it to the client or property, or interpret it without the vendor's help. Principals should know which parts of the evidence trail sit inside the agency's own records, which remain with a provider, and what can be recovered if the integration changes or the service ends.

A regulator may ask, a client may dispute an instruction, or a staff member may be accused of taking the wrong action. The same record helps long before any of that happens. A colleague can pick up the file and understand what has happened, a manager can correct a bad classification before it shapes the next conversation, and an agent can explain to a vendor why a document was sent or a campaign change was made. The business can find repeated failure points and improve the rule instead of treating every error as an isolated human problem.

A clear trail also makes accountability fairer. It separates the client's original information from the system's inference, the automated action from the human decision, and the approved instruction from the final outcome. When something goes wrong, the agency has a better chance of correcting the record, protecting the client and fixing the actual cause.

Agencies have spent years trying to make their systems remember more. The next step is making them remember how the work happened.

The next useful real estate system will still have to move quickly. It will also need to leave the agency with a history it can understand, correct and stand behind when somebody asks what happened.