AML/CTF risk assessment: how to do one for AUSTRAC
An AML/CTF risk assessment identifies and assesses the money laundering, terrorism financing and proliferation financing risks in your services, customers, delivery channels and countries. Document it and have a senior manager approve it before you provide a designated service. Review it at least every 3 years and whenever something significant changes.
This guide is for businesses regulated by the Australian Transaction Reports and Analysis Centre (AUSTRAC), including the accountants, lawyers, conveyancers and real estate agents regulated from 1 July 2026. The rules come from the AML/CTF Act, the AML/CTF Rules 2025 and AUSTRAC’s guidance, checked on 21 October 2026.
What is an AML/CTF risk assessment?
It is the first part of your AML/CTF program, required by section 26C of the AML/CTF Act. It identifies the risks you may reasonably face in providing your designated services, and assesses how serious each one is.
The second part is your AML/CTF policies: the procedures, systems and controls that manage those risks. The assessment comes first because the policies are built on it. Our AML/CTF program template covers the policies.
These obligations started on 31 March 2026 for businesses AUSTRAC already regulated. For newly regulated tranche 2 businesses, they started on 1 July 2026.
Key point
Under Australia’s AML/CTF Act, you must not start providing a designated service to a customer unless your risk assessment is up to date.
That is section 26E, and each service you provide in breach is a separate contravention. Under Australia’s AML/CTF Act (s 175), the maximum civil penalty is A$36.4 million per contravention for a company and A$7.28 million for an individual. See AML non-compliance penalties.
What must the risk assessment cover?
What your ML/TF risk assessment must have regard to
| Matter (s 26C(3)) | What to list | Higher-risk signs AUSTRAC names |
|---|---|---|
| (a) Kinds of designated services, including new or emerging technologies | Each service you provide or plan to provide | High-value transactions, including in cash or virtual assets; structures that let customers stay anonymous or disguise their source of funds |
| (b) Kinds of customers | Individuals, sole traders, companies, partnerships, trusts, associations, co-operatives, government bodies | Foreign PEPs, high-net-worth individuals, non-residents, complex legal structures, agents acting for a customer, unexplained wealth, criminal histories |
| (c) Delivery channels, including new or emerging technologies | In person, remote with staff help, remote self-service, through third parties | Self-service with no staff contact carries significant risk; third parties make it harder to know the customer |
| (d) Countries you deal with | Every country you or your customers deal in or with, where customers live or are incorporated, including Australia | Countries on the FATF grey or black lists or subject to Australian sanctions |
| (e) Information from AUSTRAC | National risk assessments, indicators of suspicious activity, direct or sector communications | Keep a register showing you considered each one |
| (f) Matters in the AML/CTF Rules | None are specified in the AML/CTF Rules 2025 | Not applicable |
Sources: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (s 26C); AUSTRAC, Step 2: Identify and assess your risks Reviewed
Section 26C(3) lists the matters you must have regard to if you provide services through a permanent establishment in Australia. They are a floor, not a limit: the assessment must cover every risk you may reasonably face.
Include the services, customers, channels and countries you plan to take on, not only current ones. AUSTRAC also expects you to use your own data on how customers are onboarded and use your services.
The steps you take must suit the nature, size and complexity of your business. A small, less complex business may have a simple one; AUSTRAC expects a large, complex business to go into depth.
How do you do an AML/CTF risk assessment?
Your ML/TF risk assessment, in the order the law sets
Australia’s AML/CTF Act and AML/CTF Rules 2025
- s 26C
Identify and assess your risks
Money laundering, terrorism financing and proliferation financing, across services, customers, channels and countries.
- Rules s 5-15
Document it
Before you first provide a designated service to a customer.
- s 26P
Senior manager approval
For the assessment and every update to it.
-
Provide designated services
Only while the risk assessment is up to date (s 26E).
- s 26D
Review it
At least once every 3 years, and on each trigger.
-
Update, record and report
Document the update within 14 days and tell your governing body in writing.
Sources: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26C, 26D, 26E, 26P); Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (s 5-15); AUSTRAC, Your AML/CTF program overview Reviewed
AUSTRAC’s risk assessment guidance sets out three stages. You identify each risk and when it may occur, then assess its scale. You may then evaluate the risks so you can prioritise them.
Start with inherent risk: the risk before any of your controls apply. AUSTRAC expects this, so you can show your policies actually address each risk. You can also assess residual risk, the risk left once your policies operate.
Write the assessment so your governing body, senior managers, AML/CTF compliance officer and relevant staff can understand and use it. Then document it before you first provide a designated service, as the AML/CTF Rules require.
How do you rate each risk?
For each risk, AUSTRAC asks how easily criminals could exploit it. Could it hide someone’s identity or source of funds? Is it easy to access, and does it let value be raised, moved or stored?
A medium complexity business can combine likelihood and impact. A small, low complexity business can rate impact alone. AUSTRAC’s example matrix gives an inherent risk rating like this:
| Likelihood | Low impact | Medium impact | High impact |
|---|---|---|---|
| Very likely | Medium | High | High |
| Likely | Low | Medium | High |
| Not likely | Low | Low | Medium |
Whatever scale you use, make the cut-off points between low and high clear. Record the reason for each rating and the data behind it, such as AUSTRAC’s national risk assessments or your own customer figures.
High risks need extra controls, such as limiting the channels and services high-risk customers can use, or closer monitoring. If you cannot manage a risk, AUSTRAC expects you to consider whether to keep serving that customer.
The assessment also feeds the risk rating you give each customer during customer due diligence. For a fuller scoring model, see our AML risk assessment methodology guide.
Do you need to assess proliferation financing?
Yes. Section 26C requires every risk assessment to cover proliferation financing, which is financing that helps spread weapons of mass destruction. AUSTRAC’s 2022 national risk assessment on proliferation financing is the place to start.
You do not need separate proliferation financing policies if you reasonably assess the risk as low and your other policies manage it (s 26F(11)). You bear the legal burden of showing that, so record your reasons.
AUSTRAC says the risk is less likely if you operate only in Australia, have no customers linked to high-risk jurisdictions, and do not move money or sensitive or dual-use goods. Either way, your policies must deal with targeted financial sanctions, so sanctions screening stays in scope.
When must you review and update it?
- In any event
- At least once every 3 yearss 26D(1)(b): the whole risk assessment
- Significant change you control
- Review and update before it happensFor example a new service, channel, technology, kind of customer or country
- Significant change you do not control
- Review as soon as practicable after itFor example a country you deal with becomes subject to targeted financial sanctions
- AUSTRAC risk information
- Review as soon as practicable after it is communicatedIncluding information sent to your whole sector
- Adverse independent evaluation
- Review as soon as practicable after the governing body receives the reportAML/CTF Rules 2025 s 5-1, where the findings concern the risk assessment
- Recording an update
- Within 14 daysRules s 5-15(2). A senior manager approves it and the governing body is told in writing (s 26P)
Sources: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26D, 26P); Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (ss 5-1, 5-15); AUSTRAC, Step 4: Review and update your AML/CTF program Reviewed
Section 26D of the Act and section 5-1 of the Rules set the triggers. A significant change is one that could significantly affect your money laundering and terrorism financing (ML/TF) risks. Examples are a new service, a move from in-person to online delivery, or a new kind of customer.
Key point
Under Australia’s AML/CTF Act, review your ML/TF risk assessment at least every 3 years, and before any significant change within your control.
Minor changes do not count. AUSTRAC’s example is a website update that does not change how you deliver your services. Information AUSTRAC sends to your whole sector, such as a newsletter item, is a trigger too.
If a review finds new or changed risks, update the assessment, then review the AML/CTF policies that deal with them. An independent evaluation, at least every 3 years, also tests the steps you took to assess risk.
Who approves the risk assessment?
A senior manager must approve the risk assessment and every update to it (s 26P). Your AML/CTF policies must name the senior managers responsible for that approval.
Your governing body, such as the board or the partners, must oversee how you identify and assess risk (s 26H). Tell it in writing about each update as soon as practicable.
Your compliance officer coordinates the day-to-day work. Unless the same person is also your governing body, they report to the governing body at least every 12 months (Rules s 5-7).
Frequently asked questions
Can AUSTRAC make you redo your risk assessment?
Yes. If the AUSTRAC CEO is satisfied your program is missing, out of date or inadequate, they can issue a written notice under section 26R. It can require you to undertake, review or update the assessment and send AUSTRAC a copy.
Which AUSTRAC information do you have to consider?
Anything AUSTRAC communicates that identifies or assesses your risks, directly or to your sector. That includes its national risk assessments and industry indicators of suspicious activity. AUSTRAC expects you to keep a register showing you considered each one.
What if you were already regulated and are not ready?
AUSTRAC expects a documented implementation plan. It should explain how you manage risks during the transition, what gaps you found and how you will close them.
Next steps
Turn your ratings into controls with our AML compliance checklist, and see what else changed in the AML/CTF Rules.
StackGo’s IdentityCheck records a High, Medium or Low risk rating, and the decision, against each client. See the Assess workflow.
Sources
The facts on this page come from these sources, checked on 21 October 2026.
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26B to 26H, 26N, 26P, 26R, 175)
- Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (ss 5-1, 5-3, 5-7, 5-10, 5-15)
- AUSTRAC, Step 2: Identify and assess your risks
- AUSTRAC, Step 4: Review and update your AML/CTF program
- AUSTRAC, Your AML/CTF program overview
- AUSTRAC, Changes to AML/CTF obligations: What you need to do (1 July 2026)
- AUSTRAC, Anti-money laundering and counter-terrorism laws cover thousands more businesses (1 July 2026)