How to Build an Australian ML/TF Risk Assessment

Part 1

What the Assessment Must Cover

The steps used must suit the nature, size and complexity of the business. The following areas must be considered.

1. Step 1

   Designated services

   List each service the business provides or plans to provide. Include new technology linked to the service.

   • How can value be placed, moved, hidden or changed?
   • Can ownership or the source of funds be hidden?
   • Can the service be used fast, remotely or through another person?
2. Step 2

   Kinds of customers

   Group customers by features that change the risk. A job title or legal form is not enough on its own.

   • Ownership and control
   • Source of wealth or funds
   • Public office, criminal links or adverse information
   • Cash-intensive, cross-border or high-risk activity
3. Step 3

   Delivery channels

   Check how customers reach the business and how the service is completed.

   • In person, online or through an agent
   • Level of staff contact
   • Use of third parties, platforms or automated systems
   • New or emerging technology
4. Step 4

   Countries

   Consider where customers, owners, funds, assets, counterparties and service steps are located.

   • Sanctions and high-risk jurisdiction information
   • Corruption, crime and terrorism financing risk
   • Quality of local AML/CTF controls
   • The reason for the country link
5. Step 5

   AUSTRAC risk information

   Current national, sector and typology information from AUSTRAC should be used where it is relevant.

Part 2

A Simple Method That Can Be Explained

A small business does not need false precision. It does need a method that is clear, repeatable and supported by facts.

1. Step 1

   Map the business

   List the designated services, customer groups, delivery channels and country links. Use real data where it is available.

2. Step 2

   Describe the misuse

   For each area, write a short risk statement. Say who could misuse what, how it could happen and what could be hidden or moved.

3. Step 3

   Rate the inherent risk

   Use a small scale such as low, medium and high. Define each rating before it is used. Record likelihood and effect if that helps the business.

4. Step 4

   Write the reason

   Point to customer data, service features, country information, AUSTRAC material and known warning signs. A rating without a reason should be challenged.

5. Step 5

   Connect the controls

   Show which AML/CTF policies manage each risk. Higher risk should lead to stronger CDD, approval, monitoring or service limits.

6. Step 6

   Name the owner and review date

   The compliance officer should know who watches each risk, what change triggers a review and when the next full review is due.

Part 3

Worked Example

This example shows the level of reasoning that should be visible. It is not a template and should not be copied without checking the facts.

Part 4

When the Assessment Must Be Reviewed

The full assessment must be reviewed at least every three years. Some events require an earlier review.

• A designated service starts or changes in a significant way.
• A customer type, delivery channel or country exposure changes.
• New or emerging technology is introduced.
• AUSTRAC gives the business or sector new risk information.
• An independent evaluation makes an adverse finding about the assessment.
• A control fails or new suspicious activity shows that the risk was understated.

Part 5

Common Mistakes

• A sector document is copied and treated as the business’s own assessment.
• Controls are used to lower the risk before the inherent risk is understood.
• All customers or services are given the same rating.
• The risk scale is not defined.
• Ratings are stated without facts, sources or reasons.
• Proliferation financing is left out without a supported low-risk assessment.
• The assessment and AML/CTF policies do not point to each other.
• The document is reviewed by date only and business changes are missed.