IT support and cyber security for Melbourne conveyancers
IT support for conveyancers in Melbourne: PEXA MFA, ARNECC's draft MPR v8 rules as a checklist, police checks, safe harbour and settlement-fraud controls.
Key IT provides IT support for conveyancers in Melbourne with cyber security built in: the PCs, Microsoft 365 mailboxes and sign-ins behind every PEXA or Sympli settlement, watched by Key IT's 24/7 SOC service and looked after by security-certified engineers. We also turn ARNECC's draft version 8 rules into a working checklist and harden the settlement-day payment steps where conveyancing money goes missing.
Status at 15 October 2026: MPR version 8 is a consultation draft published by ARNECC on 25 May 2026. It has not been determined for Victoria, where version 7 of the Participation Rules (in effect since 28 March 2024) still applies.
What IT does a conveyancing practice need?
Nearly all of it touches client money or identity:
Electronic Lodgment Network (ELN) access.
ARNECC lists two operators approved in Victoria, PEXA and Sympli. Whichever you use, give each person their own login; PEXA also expects a supported, up-to-date browser and signing app.
Email.
Contract changes and settlement figures travel by email, so criminals target conveyancers' mailboxes.
Practice management and trust accounting.
LEAP, Smokeball, Actionstep or a conveyancing package, with its Microsoft 365 add-ins.
Verification of identity.
The rules require reasonable steps to verify each client, for example by applying the Verification of Identity Standard, so ID images sit somewhere in your systems.
Phones that sign.
PEXA supports mobile signing, so any phone used for signing is part of your IT.
What PEXA's security policy already asks of your IT
PEXA's Subscriber Security Policy (version 4.6, effective 1 September 2026) already reaches your computers:
| PEXA requirement | What it means in practice |
|---|---|
| MFA for every user | No shared logins; everyone enrols their own second factor |
| A supported operating system, kept updated, or access can be suspended | Upgrade or replace Windows 10 PCs: Microsoft ended Windows 10 support on 14 October 2025 (see the Windows 10 extended-updates deadline) |
| Antivirus that updates and scans automatically | Managed endpoint protection; Microsoft Defender is among the products PEXA names |
| No caching of PEXA passwords, PINs or passphrases | Browser password saving switched off for PEXA |
| Different PINs on the phone and the signing app | Screen-lock and PIN rules enforced on signing phones |
| Monitoring for unusual activity; access reviewed at least yearly | Sign-in alerts and a dated yearly access review |
What is ARNECC's MPR version 8, and when does it start?
It is the next edition of the Model Participation Rules, the template each state's Registrar uses for the rules ELN subscribers follow. Submissions closed on 17 July 2026 and the explanatory notes anticipated an October 2026 start, but ARNECC lists no final version, and nothing changes here until Victoria's Registrar of Titles determines new rules. The IT-relevant parts, from the draft and ARNECC's June 2026 stakeholder briefing:
| Draft rule | What it asks | Do now |
|---|---|---|
| 7.1(d) MFA | MFA for remote access, Subscriber Administrator accounts and email | Close the gaps below |
| 7.2.3(b) Police checks | A check before any user gets ELN access, not only signers and administrators | Start an HR register |
| 7.2.1 Training | Cyber awareness training before ELN access and at least yearly; yearly training for other staff | Schedule it; keep attendance records |
| 7.2.1(b) Credentials | ELN logins never shared | Remove any team login |
| 7.11 Secure use of systems | Reasonable steps to secure the ELN, your systems, admin accounts and email | Decide how you'll show those steps |
| Schedule 6 Insurance | Cyber cover; higher PI and fidelity minimums | Talk to your broker |
Which accounts need multi-factor authentication?
Under draft rule 7.1(d), three kinds: all remote access to the subscriber's systems (VPN included), every Subscriber Administrator account, and email. Check:
- Every Microsoft 365 mailbox, including part-timers and anyone reading mail on a personal phone.
- VPN, remote desktop and practice software reached from home.
- Any remote support tool that reaches your PCs, including your IT provider's. Ask how theirs is protected; "all remote access" has no exception for it.
- PEXA and Sympli administrator accounts. PEXA already requires MFA for every user.
Where you can, choose phishing-resistant methods over text-message codes; see passkeys in Microsoft 365.
Police checks for every ELN user
This is an HR task, but IT ends up holding the evidence. Victoria's current rules already require a check before a signer's first digital certificate or a Subscriber Administrator's appointment; the draft extends it to every user before ELN access. A short register covers it:
List everyone with ELN access and their role: user, signer or Subscriber Administrator.
Record each check's date and outcome. The OAIC treats a criminal record as sensitive information, so only principals should be able to open the certificates.
Create ELN access only once the check is back.
Remove ELN, email and practice-software access when someone leaves. The current rules already require ELN access to be revoked promptly; the draft adds an outer limit of five business days.
Review the list at least yearly, as PEXA already requires.
What is the cyber safe harbour, and which framework fits a small practice?
Draft rule 7.11 asks subscribers to take reasonable steps to secure the ELN, their own systems, administrator accounts and email. You can show those steps your own way, or hold certification, renewed at least yearly, against one of the specified Cyber Security Frameworks, which counts as compliance. That is the safe harbour. Two listed frameworks suit small practices:
- The Essential Eight from the Australian Signals Directorate (ASD). ASD has announced ASD Essentials as its successor, with the changeover reported to take a year or two, and the draft allows for a framework that supersedes a listed one. Our Essential Eight service builds and documents the controls.
- SMB1001 from Dynamic Standards International: five levels, written for small and medium businesses, updated annually. ARNECC's briefing describes it as endorsed by the Queensland Law Society (QLS) and the Legal Practitioners' Liability Committee (LPLC), and the QLS recommends members work towards Gold.
Our SMB1001 and Essential Eight comparison shows how much the controls overlap. As the QLS notes, SMB1001 doesn't guarantee protection against cyber incidents.
What insurance changes are proposed?
Higher minimums.
Professional indemnity and fidelity cover each rise from $1.5 million to $2 million, from 1 July 2027.
New cyber cover.
Cover for third-party cyber claims and first-party costs (incident response, business interruption, data recovery, system recovery), standalone or inside PI or fidelity cover if it meets the minimum.
Dishonesty cover.
Cover for claims from dishonest, fraudulent, criminal or malicious acts by principals, officers or employees.
Expect underwriters to ask for evidence of MFA, backups and monitoring; see what cyber insurers now require.
How do you stop settlement-day payment fraud?
Treat emailed bank details as unverified until confirmed otherwise. PEXA's policy calls email an insecure way to share bank details, requires externally emailed details to be verified separately (by phone, in person or other means) and recommends PEXA Key instead. Around that rule, four layers:
DMARC on your domain, so criminals can't send mail that passes as yours; see SPF, DKIM and DMARC explained.
External-sender tagging.
Microsoft 365 can show an External label in Outlook on outside mail, so a lookalike "other side" stands out.
Call-back verification.
Details confirmed on a number from your file, never the email, with the call noted on the matter.
Mailbox-rule monitoring.
Key IT's 24/7 SOC service flags new forwarding or deleting rules and odd sign-ins, the signs someone is inside a mailbox waiting for settlement.
How these attacks build over weeks: our anatomy of a payment-redirection scam.
Do AML/CTF tranche 2 rules apply to conveyancers?
Yes, for designated services. From 1 July 2026 the AML/CTF Act reaches professionals including conveyancers, and the OAIC treats help with a real estate sale as a designated service. The Privacy Act then covers AML/CTF personal information, even below $3 million turnover. The OAIC adds that the Act doesn't require you to keep scanned ID copies, and that copies should be destroyed or de-identified once they're no longer needed. Our AML/CTF tranche 2 guide shows where those copies pile up.
How does Key IT support conveyancing practices?
Conveyancing sits within our work for Melbourne law firms: one fixed monthly agreement covering the helpdesk (staffed Monday to Friday from 8am to 5pm, plus an on-call engineer for urgent after-hours problems at managed clients), 24/7 SOC monitoring, Microsoft 365 security, backups and Essential Eight hardening. Engineers travel from Greensborough; regional Victorian practices are supported remotely. See cybersecurity for law firms.
Frequently asked questions
Does PEXA require multi-factor authentication?
Yes. PEXA's Subscriber Security Policy requires every user to use MFA to access PEXA or perform certain actions in it. Exemptions are assessed case by case, reviewed yearly and come with IP whitelisting as a fallback second factor. ARNECC's draft goes further, extending MFA to email, remote access and administrator accounts.
Is MPR version 8 in force in Victoria?
Not as at 15 October 2026. ARNECC published consultation drafts on 25 May 2026 and closed submissions on 17 July. Its explanatory notes anticipated an October 2026 start, but no final version is listed, and Victoria's version 7 rules apply until the Registrar of Titles determines new ones.
Do I need SMB1001 certification?
Not under the draft. Certification against SMB1001, the Essential Eight or another specified framework is a safe harbour, not a requirement; you can show reasonable steps your own way instead. Certification simply gives you a dated document to point to when asked.
Can Key IT help with police-check record-keeping?
We don't run police checks; that stays with the practice and its screening provider. We can handle the IT side: matching ELN users to Microsoft 365 accounts, a restricted folder for check certificates, and a starter-and-leaver process that removes access on someone's last day.
How much does IT support cost a conveyancing practice?
Managed IT in Melbourne generally sits between $100 and $200 a user each month, a market range rather than our price. Key IT quotes one fixed per-user fee after a free review, billed month to month with no lock-in contract (see managed IT).
What our clients say
Imported from our Google reviews — real Melbourne businesses we look after, in their own words.
Read & review us on Google →Key IT are computer wizards who have become an important resource for the smooth running of our businesses. They are reliable, a pleasure to deal with and always willing to solve any technical emergency we may confront, whether it requires an on-site visit or via phone support. We highly value their work and recommend them unreservedly!
The team at Key IT have been extremely helpful to our organisation right from the beginning. They have left no stone unturned in their quest to fulfil all our IT needs — including reorganising our IT infrastructure, setting up our network and phone systems, and migrating us to Azure — and are always there to help us when needed. Their knowledge is second to none. Without the team our business would have been in turmoil.
I have always found the team at Key IT to be fast, knowledgeable and professional. We run a number of different businesses from the one server, and my office staff often need assistance solving varied issues. Key IT always comes to the rescue and gets us back on track in a timely fashion. I would have no hesitation recommending the team.
We couldn't be happier that Key IT's expert IT skills popped into our lives here at Premium Capital Finance. Their sheer professionalism is second to none, whether it's their accessibility over the phone or dropping into our office on site — they always do an exceptional job. Would recommend to anyone who needs a reliable, knowledgeable IT expert.
Thank you to the Key IT team. You have always been available, knowledgeable and ready to help with all our IT needs and issues — from expert advice and troubleshooting to hardware. We don't have the time or capability to do it ourselves, and are comfortable knowing you're just a phone call away. You consistently meet all our needs for timely service, quality workmanship, expert advice and competitive pricing. We highly recommend Key IT and their team.
We've been working with Elias at Key IT for our IT support for the last 8 years, and have been most satisfied with their knowledge and service. In an office of non-technically minded workers, whenever we face an issue, Key IT responds promptly. They are patient and professional, and explain issues in plain English. They understand our IT needs, and we call on them whenever we need an upgrade.
150+ Melbourne organisations, looked after every day
From manufacturing and healthcare to finance, body corporate and professional services — a few of the businesses whose IT and security we run every day.
Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.