AML rules expose small firms to privacy breach risks

Cybercrime expert Richard Mallam has warned that new anti-money laundering rules could expose thousands of Australian small businesses to privacy breach risks and fines. The changes affect about 100,000 businesses, including accountants, real estate agents, conveyancers and jewellers.

Reforms to the Anti-Money Laundering and Counter-Terrorism Financing Act require affected firms to verify customer identities, identify who controls companies and trusts, monitor suspicious activity and keep compliance records. That means many smaller operators will need to collect and store passports, driver's licence details and other personal information they may not previously have handled at scale.

Mallam, Founder and Chief Executive Officer of VO, said the expanded rules had created a new pool of targets for cybercriminals by dispersing sensitive identity data across smaller businesses.

"Australia's sweeping new anti-money laundering laws have created a privacy ticking time bomb for thousands of small businesses now having to collect personal identification details and shoulder unprecedented responsibility for keeping that information secure," Mallam said.

He said the policy aim of tightening controls on illicit money flows had also created a data security burden for firms with limited compliance infrastructure.

"Extending this law to these businesses was aimed at stopping criminals moving dirty money, but it has created a parallel privacy crisis at a time when cybercrime is becoming more sophisticated," Mallam said.

Compliance burden

The warning highlights a practical challenge for sectors newly brought into the anti-money laundering regime. Accountants, suburban real estate agencies, conveyancers and jewellers now need processes for customer due diligence, identity checks, risk assessment and record retention.

Mallam said some of those firms were already struggling with the demands of compliance, particularly if they had not previously dealt with formal privacy and identity verification controls. He said the issue extends beyond large organisations to smaller businesses with annual turnover below AUD $3 million, which are also subject to fines under the Privacy Act if they mishandle personal information.

"We're basically creating thousands of honeypots of identity data, with these small businesses now the frontline of the nation's financial crime defences. They've become custodians of valuable personal details, making them a target for cybercriminals," Mallam said.

The concern reflects a broader tension in the rollout of financial crime rules: stronger checks can improve oversight, but they also increase the volume of sensitive data held by businesses that may have fewer resources for cybersecurity, staff training and secure record management.

Identity data

Mallam said repeated requests for copies of passports and driver's licences leave consumers with little visibility over how widely their information is shared or how long it is retained. In his view, the shift in compliance responsibility means many Australians will be asked to hand over high-value identity documents to more organisations than before.

"Australians have become conditioned to sending a passport or driver's licence every time they need to prove who they are. But once you hand over a high-value identity document, you can lose visibility and control over where that information goes, who has access to it and how long it remains in a system.

"VerifiOnce will change that and make sharing information more secure. It will establish that a person is who they say they are, provide the business with the information it legitimately needs to meet its AML obligations and dramatically reduce the amount of sensitive data sitting in thousands of separate databases.

"It will minimise cybersecurity exposure and strengthen privacy protections for consumers," Mallam said.

VO is working with VerifiMe on a digital identity product called VerifiOnce, designed to let users verify their identity once and then reuse those credentials with participating organisations. The companies say this could reduce the need for each business to separately collect and store copies of identity documents.

The model is intended to allow businesses to rely on verified credentials rather than maintain their own archives of passports and driver's licences. If adopted widely, that approach could reduce the spread of sensitive identity information across multiple databases, though uptake will depend on whether businesses and consumers accept a shared credential model.

Regulatory pressure

The anti-money laundering expansion gives small businesses a more direct role in the financial crime control system. For many, that means introducing new procedures, staff training and data-handling safeguards at the same time as they face a more complex cyber threat environment.

Mallam said this combination of stricter verification requirements and privacy liability had created a difficult position for smaller operators.

"A small suburban accounting practice or real estate agency can now be collecting highly sensitive customer information while carrying privacy obligations it might never previously have had to deal with.

"These businesses must conduct customer due diligence, verify identities, assess risk, maintain compliance programs and keep records, and they are telling me they are already struggling to comply. Under these changes, small businesses, including those with annual turnover below $3 million, are now also subject to fines under the Privacy Act.

"On one hand you have AUSTRAC telling consumers there's nothing to be alarmed about, but consumers are losing control of their data, which could be shared in 100 places, and the privacy commission is just saying, well, if businesses do the wrong thing they'll be fined, which is cold comfort for consumers," Mallam said.