Marked up 1 July 2026
We take the security of client information seriously.
Not through carelessness. Through twenty years of good filing habits meeting a rule that changed overnight. We find the copies, clear them with you present, and leave you the dated record that says so.
Open any clause for the plain English version. This is how the obligation actually lands in a practice of your size.
From 1 July 2026 a captured practice must verify the identity of its client before acting.
The practice must not retain the identity document once the verification is recorded.
The practice must be able to demonstrate that it is not retaining identity documents.
No compliance function, no dedicated information security officer, no technical staff, and roughly two hours a month spent on security in total.
Penalties reach $33 million for a body corporate, with parallel exposure under the Australian Privacy Principles over the same data.
Observed maturity against the ASD Essential Eight, with the two or three fixes worth doing first.
A public baseline, not a score we invented.
Mailboxes, shared drives, the scanner drop folder, desktops, downloads and the archive drive in the cupboard.
You see the full list before anything is touched.
Cleared location by location on your approval, logged with path, date and authorising person.
Anything you want kept is kept, and recorded as your instruction.
Dated and evidence backed, written for AUSTRAC correspondence, insurers and client questionnaires.
Written to be read by someone else, years later, without us in the room.
What to do when an identity document arrives by email, in words nobody has to look up.
Stops the pile rebuilding over the next twelve months.
Principals of small Victorian practices, three months after the obligations commenced.
We found forty one licence scans in the settlements inbox. I would have sworn we deleted those. The dated statement saying they are gone is worth more to me than the scan ever was.
Our AML software told us who the client was. It never once told us where the passport copy went afterwards. That gap was invisible until somebody went looking.
I have two hours a month for this and I am not technical. Three things to do, in plain English, that I could actually finish. That is the only reason it got done.
Illustrative statements, written to represent the practices this service is built for. Redline is a concept venture and is not yet trading.
What you run, who has access, where scans land. A fixed fee follows in writing.
The list is read through with you, then cleared as you sign off. Nothing happens off screen.
Deletion record attached to the dated statement, team briefed the same week.
Priced on staff numbers and systems rather than hours, so the figure does not move. If the call suggests you have no problem, we will say so and charge nothing.
Roadmap, not sold today: the same checks monthly at $249 a month.