How to build an ML/TF/PF risk assessment for an Australian business

Set scope and ownership before scoring risk

Define the reporting entities, business units, locations and designated services covered. Map actual delivery from customer acquisition through execution, payment and relationship exit. Include variations such as client accounts, third-party payments, remote onboarding, agents, outsourced verification and offshore support. A group-wide assessment may provide context, but each reporting entity needs enough specificity to show the risks it reasonably faces and the controls for which it is accountable.

Assign an accountable senior manager, a competent assessment lead and contributors from frontline operations, compliance, finance, technology and governance. Record the assessment period, information sources, methodology, rating definitions, assumptions and limitations. Approval should demonstrate informed challenge, not just a signature. If reliable data is missing, describe the gap, use a cautious interim treatment and set a remediation owner rather than presenting an unsupported low-risk conclusion.

Assess the mandatory and business-specific risk dimensions

AUSTRAC's program guidance expects reporting entities to consider customer types, designated services, delivery channels and foreign jurisdictions, together with other factors relevant to their business. Customer analysis can include legal form, ownership transparency, PEP exposure, cash intensity and use of intermediaries. Service analysis should identify opportunities to move, conceal, convert or legitimise value. Channel analysis covers non-face-to-face delivery, introducers, agents and technology. Jurisdiction analysis should use current, credible information rather than nationality stereotypes.

Add risks revealed by the operating model: trust or client money, rapid settlement, linked purchases, nominees, complex structures, high-value portable goods, virtual assets, unusual refund paths, privileged or confidential engagements, and staff ability to override controls. Consider ML, TF and PF separately where their indicators or consequences differ. Proliferation financing can involve trade, dual-use goods, sanctions evasion, layered ownership and payments that appear commercially ordinary, so it should not be treated as a footnote to money laundering.

Distinguish inherent risk, controls and residual risk

A useful operational model first rates the risk before controls, then evaluates the design and operation of relevant controls, and finally records the risk that remains. Define likelihood and consequence scales in plain language. Require a written rationale for material ratings and use examples to reduce inconsistent scoring. Weighting can be appropriate, but a mathematical average must not cancel a severe sanctions or ownership concern simply because other factors are low.

Control assessment should test evidence: whether CDD rules are configured, screening is current, approvals occur before service, monitoring alerts are reviewed, personnel are trained, and exceptions are resolved. A policy that is not implemented should not reduce residual risk. Link intolerable or high residual risks to a decision such as enhanced measures, restricted services, senior approval, technology change, additional monitoring or cessation. State risk appetite and escalation thresholds so frontline decisions reflect the assessment.

Use internal and external evidence

Internal evidence can include customer and matter data, transaction values, payment methods, jurisdictions, risk ratings, alerts, SMR themes, declined work, exceptions, audit findings, complaints and staff workshops. Check data completeness and avoid treating no reports as proof of no risk. Segment information far enough to reveal concentration; a firm-wide average may hide a small but exposed service line. Where volumes are low, qualitative case analysis and scenario testing can be more useful than unstable percentages.

External evidence should be current and relevant. Use AUSTRAC guidance, national and sector risk assessments, typologies, targeted financial sanctions information, credible law-enforcement material and applicable professional guidance. Record publication dates and the business inference drawn from each source. Copying a regulator's risk rating without connecting it to the firm's customers and services produces a weak assessment. Where sources conflict, document the judgement and apply a cautious control until better evidence is available.

Make the assessment a living control document

Version control matters. Preserve what the business knew, when it knew it, the change made and the decision that followed. A concise assessment that drives controls is stronger than a long document nobody uses. Test usability by selecting a risk scenario and tracing it through the program, customer file, monitoring result, training content and governance report.

• Create a risk register with scenario, cause, exposed service, customer, channel, jurisdiction, existing controls and accountable owner.
• Define evidence-based inherent and residual rating criteria, including escalation for severe risks that should not be averaged away.
• Map every material risk to policies, onboarding questions, monitoring rules, training and management information.
• Record control gaps and remediation dates, and preserve approval and challenge by senior management.
• Trigger review for new services, technologies, jurisdictions, acquisition, major incidents, typologies, sanctions changes and control failures.
• Review the broader AML/CTF program within the applicable cycle and update the assessment sooner when material change occurs.