Guide

Risk mitigation strategies: types, steps and examples

There are four risk mitigation strategies: avoid the risk, reduce it with controls, transfer it or accept it. For money laundering and terrorism financing risk, AUSTRAC expects controls that are targeted, proportionate, ongoing and effective. Outsourcing a check moves the work, not your legal liability.

By Matt Collis·Updated 21 October 2026·Reviewed 21 October 2026·Version 3·5 min read

The four risk mitigation strategies apply to money laundering and terrorism financing (ML/TF) risk as much as any other. This guide is for owners and compliance staff of regulated businesses. Since 1 July 2026, that includes accountants, lawyers, conveyancers and real estate agents regulated by the Australian Transaction Reports and Analysis Centre (AUSTRAC).

What are the four risk mitigation strategies?

The four risk mitigation strategies, applied to ML/TF risk

Strategy	Also called	What it means	AML/CTF example
Avoid	Terminate	Stop the activity that creates the risk	A business rule not to offer a particular service to specified kinds of high-risk customer
Reduce	Treat	Add controls that lower the likelihood or the impact	A limit on cash transactions, or payment by bank transfer or EFTPOS only
Transfer	Transfer	Move some financial cost to a third party, by insurance or contract	Outsourcing customer checks to a provider. You stay liable for due diligence and record keeping breaches
Accept	Tolerate	Keep a low risk, with the reason recorded	Proliferation financing risk reasonably assessed as low: no specific policy needed, but the assessment is documented

Sources: AUSTRAC, Step 3: Manage and mitigate your risks; AUSTRAC, Overview of reliance on customer identification by a third party Reviewed 21 Oct 2026

Most ML/TF risks are reduced with controls. Transfer moves cost, not liability: a business that outsources customer checks stays liable for breaches.

Every risk gets one of four treatments, or a mix of them. Risk managers often call them the 4 Ts: terminate, treat, transfer and tolerate. For the general idea, see what risk mitigation is.

Most ML/TF risks end up reduced, not avoided. Avoiding a risk means turning work away, so firms keep it for risks they cannot control at a cost they accept.

The choice turns on how likely the risk is, how much harm it would do and what the control costs. Write down the reason for each choice, because a reviewer or evaluator will ask for it.

What does AUSTRAC expect from your controls?

Under Australia’s anti-money laundering and counter-terrorism financing (AML/CTF) laws, your AML/CTF policies must appropriately manage and mitigate the risks your risk assessment finds. AUSTRAC uses “policies” to mean your policies, procedures, systems and controls together.

AUSTRAC expects those policies to be:

Targeted: aimed at the ways your own services could be exploited
Proportionate: stronger for higher risks, simpler for lower ones
Ongoing: reviewed and updated as your business and its risks change
Effective: working in practice, with a way to revise them when they do not

The parts every program must include, such as customer due diligence, are only the floor. AUSTRAC says they alone are not likely to be enough, so expect to add controls for your own risks.

Size matters. A small, less complex business may have a simple risk assessment, while a large, complex one is expected to go into more depth.

How do you choose a strategy for each risk?

Start from your ML/TF risk assessment. It must cover four risk factors: the services you provide, your customers, your delivery channels and the countries you deal with.

AUSTRAC expects you to assess inherent risk first, before any controls. You may then assess residual risk, which is the risk left once your controls are in place.

Then match the control to the rating. Higher risks need stronger controls, such as enhanced customer due diligence, while lower risks can be managed with simpler measures.

The same logic applies customer by customer. During due diligence you give each customer a risk rating, and the rating sets how much checking they get. Our Assess workflow records that rating and the decision against the client.

Acceptance is legitimate when a risk is truly low. Many businesses face little or no proliferation financing risk, for example. If you reasonably assess it as low and your other policies cover it, you need no specific policy, but you must still document the assessment.

Can you transfer ML/TF risk to a provider?

Only in part. Insurance and contract terms can move some financial cost to a third party, but they do not move your legal obligations.

You may outsource functions such as identity checks, and the provider does not need to be a reporting entity itself. AUSTRAC is clear about who carries the breach.

Key point

Under Australia’s AML/CTF regime, a reporting entity that outsources customer checks remains liable for breaches of its customer due diligence and record keeping obligations.

Reliance is different from outsourcing. Under set conditions you can rely on checks done by another reporting entity, such as a bank in the same property sale. AUSTRAC’s reliance guidance sets out when that is allowed.

What does a mitigation plan look like?

A mitigation plan, in AUSTRAC’s order

From risk assessment to reviewed controls

Step 1
Identify your ML/TF risks

Across your services, customers, delivery channels and countries.
Step 2
Assess inherent risk

Before any controls, for example by likelihood and impact.
Step 3
Choose controls

Targeted, proportionate, ongoing and effective.
Step 4
Document and approve

A senior manager approves before you provide the service.
Review and update

At least every 3 years and after significant changes.

Document each update within 14 days.

Sources: AUSTRAC, Step 3: Manage and mitigate your risks; AUSTRAC, Step 2: Identify and assess your risks; AUSTRAC, Step 4: Review and update your AML/CTF program Reviewed 21 Oct 2026

Identify and assess the risk before you choose a control, get a senior manager’s approval, then review at least every 3 years and after significant changes.

A plan follows the order of AUSTRAC’s program steps, and each step feeds the next. You cannot choose controls for a risk you have not assessed.

Your plan forms part of your AML/CTF program. A senior manager must approve the program before you provide a designated service, and you must document any update within 14 days of making it.

Give every control an owner. In a small firm that is often the AML/CTF compliance officer, who oversees and coordinates day-to-day compliance.

When must you review your controls?

Mitigation is never finished, because your services, customers and the threats around them change.

Key point

Under Australia’s AML/CTF Act, a reporting entity must review its ML/TF risk assessment at least every 3 years and after any significant change.

A significant change includes a new service, a new delivery channel such as moving online, new customer types or a new country. Changes outside your control count too, such as new sanctions on a country you deal with.

You must also review after AUSTRAC tells your sector about new risks, or after an independent evaluation makes adverse findings. That evaluation of your program is due at least once every 3 years.

Between reviews, watch for the signals that a control is failing, such as customer reviews falling overdue. Our Monitor workflow runs ongoing monitoring and re-checks, so a client verified today stays current.

Do tax practitioners have extra obligations?

Registered tax practitioners also answer to the Tax Practitioners Board. Its Code Determination 2024 added eight obligations, including quality management systems and keeping proper client records.

They apply from 1 July 2025 for practitioners with 100 or fewer employees on 31 July 2024, and from 1 January 2025 for the rest. Our guide to the Code of Professional Conduct covers them in full.

Frequently asked questions

What are the 4 Ts of risk management?

Terminate, treat, transfer and tolerate. They are another name for the four strategies: avoid, reduce, transfer and accept.

What is the difference between inherent and residual risk?

Inherent risk is the risk you face before any controls. Residual risk is what remains after your controls are in place. AUSTRAC expects your risk assessment to start with inherent risk.

Can I refuse a high-risk customer?

Yes. AUSTRAC gives business rules not to offer some services to specified high-risk customer types as an example of a policy. So is a service agreement term that lets you stop acting when a customer will not provide know your customer (KYC) information.

Does a small firm need the same controls as a bank?

No. Your policies must suit the nature, size and complexity of your business. AUSTRAC expects larger, complex businesses to have more extensive controls.

Next steps

Most of the controls in this guide happen at the customer level: identity, screening, a risk rating and ongoing checks. Those are the steps where a missed check turns into a breach.

StackGo’s IdentityCheck runs KYC and AML identity checks inside the customer relationship management (CRM) or practice management software your team already uses. See how IdentityCheck supports AUSTRAC Tranche 2 compliance, or read our AML compliance checklist.

Sources

The facts on this page come from these sources, checked on 21 October 2026.