The matter is the unit of monitoring
A law firm's AML/CTF program should define monitoring at both levels: the client relationship and each captured matter. A client who is low risk for a routine matter can become higher risk when a new matter involves a complex cross-border transaction or an unexplained source of funds. The monitoring design should treat the matter file as the place where risk changes are actually visible.
Record the risk rating at matter opening and review it when the matter changes. The rating is not a static stamp; it is a decision that follows the facts.
Trigger events in legal work
Each trigger should have a defined response: re-verify the new party, update the risk rating, collect source-of-funds evidence or escalate. The program should say which triggers require what, so the trigger list is not a menu of hopes.
- A new party, guarantor, funder or beneficial owner joins the matter
- Trust-money movements that are unusual in amount, origin or destination
- Instructions that change the structure, parties or source of funds
- Documents that contradict the earlier CDD picture
- A matter reopened after months with different facts
Review cycles and risk tiers
AUSTRAC does not prescribe one universal high-, medium- and low-risk calendar. The program should choose frequencies that are proportionate to the practice's services and record why. A conveyancing firm may monitor intensively during the settlement window; a litigation practice may monitor by event.
- Define review frequencies for high, medium and low-risk relationships
- Connect the cycle to matter events as well as elapsed time
- Re-screen PEPs, sanctions and adverse media on the defined cycle
- Record each review with a date, decision and approver
What the monitoring record shows
Ongoing monitoring is only visible in the record. A matter file that shows the sequence - opened, rated, reviewed on a trigger, re-screened, escalated and resolved - demonstrates a control environment. A file with no reviews is a gap even when the client is low risk.
- The risk rating and the factors that set it
- Each review or trigger response with a date
- Screening results and dispositions
- Source-of-funds evidence and its assessment
- Escalations and their outcome
Official sources
Use these primary AUSTRAC pages to confirm the current rules and apply them to your circumstances.
Frequently asked questions
How often should a law firm review clients?
On a risk-based cycle defined in the program and on matter triggers. AUSTRAC does not prescribe one universal calendar; record why the selected frequencies are proportionate.
What triggers re-verification in a matter?
New parties or owners, unusual trust-money movements, changed instructions, contradictory documents and reopened matters are common triggers. The program should define the response to each.
Can a low-risk client become high risk mid-matter?
Yes. Risk follows the facts. A new matter, party or source of funds can change the assessment, and the file should show the updated rating and controls.
Does monitoring require re-screening every client every month?
No. Screening frequencies should be risk-based and defined in the program. Continuous screening tools are an option, but the practice must still record dispositions and responses.
Put it into practice
Cassandra AML turns these obligations into a working system: designated-service decisions, customer due diligence, screening, monitoring and reporting records — hosted in Sydney, free to start.
This guide is general information for Australian professionals. It is not legal advice and does not replace the AML/CTF Act, the AML/CTF Rules or AUSTRAC guidance. Confirm your specific obligations with AUSTRAC or a qualified legal adviser. See our editorial and correction standards.