ML/TF risk assessment — how to actually do one

The risk assessment is the foundation of the programme. Every other control — your CDD procedures, your monitoring, your reporting thresholds — should be calibrated to what it finds. It is also the document that builds the system by which you assign risk ratings to individual customers, which is where it stops being paperwork and starts driving daily work.

Three risk legs, not two. The assessment is still colloquially the "ML/TF risk assessment", but s 26C(1) requires you to identify and assess money-laundering, terrorism-financing and proliferation-financing risks. Proliferation financing covers funds connected to the manufacture, acquisition or use of nuclear, chemical or biological weapons in contravention of Australian or international law.

The six mandatory matters

Section 26C(3) makes six matters mandatory — four you will see everywhere, and two that most guidance drops:

1. Kinds of designated services provided, or proposed to be provided — including any new or emerging technologies relating to them. Name them exactly: brokering is table 5 item 1 and its customer is both seller and buyer; selling your own stock is table 5 item 2; assisting a person in a transaction, the buyer's-agent case, is table 6 item 1.
2. Kinds of customers — categorise the customers you actually deal with (Australian residents, foreign buyers, companies, trusts, PEPs, high-net-worth individuals, first-home buyers) and assess the inherent risk of each.
3. Delivery channels — face-to-face engagement is generally lower risk than non-face-to-face. Online auctions, remote signings and agent-introduced buyers each carry their own profile. New or emerging technologies sit expressly inside this limb too.
4. The countries you deal with, or will deal with, in providing the service. That is wider than the customer's nationality: it picks up where funds come from, where a corporate buyer was formed, and where a trustee sits.
5. Information AUSTRAC communicates to you — directly, or to your sector generally. Financial crime guides, national risk assessments and sector emails are mandatory inputs, and receiving one is also a statutory trigger to review the assessment.
6. Anything the Rules specify.

Two points inside that list. The assessment must cover services, customers, channels and countries you propose to take on, not only the ones you have. And s 26C(4) confirms the six do not limit the general duty in s 26C(1).

On country risk: as at the FATF statement of 19 June 2026, Iran and the DPRK are subject to countermeasures and Myanmar to enhanced due diligence proportionate to risk. Countries on that call-for-action list, on the FATF Increased Monitoring list, or under DFAT sanctions materially shift the score. Check the FATF statement each plenary — the list moves. Two of these carry separate statutory weight: Iran and the DPRK are the only countries prescribed under the AML/CTF (Prescribed Foreign Countries) Regulations 2018, and physical presence or formation in a jurisdiction for which the FATF has called for enhanced CDD is an automatic ECDD trigger under s 32(d).

Score inherent risk first

AUSTRAC expects the assessment to identify and assess your inherent risks — the risks you may reasonably face before you apply any policies, procedures, systems or controls. Residual risk, what is left after the controls, is optional and comes second.

Get this backwards and the assessment will show low risk everywhere, your policies will have nothing to attach to, and the link between s 26C and s 26F collapses.

Methodology

AUSTRAC does not prescribe one. It requires a methodology tailored to your nature, size and complexity, run in three stages: identify the risks and when they arise, assess their scale, then optionally evaluate them to prioritise.

Likelihood × impact scored on a matrix is the common way to do the assessment stage and is perfectly defensible — score the likelihood of occurrence (rare through almost certain) and the impact if it does occur (insignificant through catastrophic), combine them, and write down the reasoning. What is not defensible is a matrix with no reasoning behind the cells.

Three things carry the weight, and each maps to a stated requirement rather than a rule of thumb:

• Specificity. Does the assessment reflect your actual business — geography, customer mix, average transaction value? Section 26C(2) requires the steps to suit your nature, size and complexity, and AUSTRAC expects the document to be usable by your governing body, your senior managers, your compliance officer and the staff whose work touches the risks.
• Linkage. Do the policies actually address the risks the assessment identified? That is the express requirement in s 26F(1).
• Currency. When was it last reviewed? See below.

Reviewing it — the timing is not open-ended

Section 26D(1) requires a review if there is a significant change to any s 26C(3) matter, if AUSTRAC communicates risk information to you, or in circumstances the Rules specify — and in any event at least once every 3 years.

A significant change is one that could have a significant impact on your ML/TF risks. Not every change qualifies: updating your website in a way that does not change how you deliver services is not a trigger.

The timing rule is the operationally decisive part:

• If the change is within your control — a new service line, a new delivery channel, a new customer type, dealing with a new country — you must review and update before the change occurs.
• If it is outside your control (a country's risk shifts, sanctions land), or AUSTRAC communicates risk information to you, or an independent evaluation returns adverse findings on the assessment, you review as soon as practicable after, and update as soon as practicable after the review.

Then a senior manager approves the update, the governing body is notified in writing, and the update is documented within 14 days.

What to do next. Build it from what you actually did over the last 12 months — the property types, the buyer profiles, the payment routes, the entity structures you actually saw. If you are only weeks into the regime, use the same 12 months of pre-commencement history; the risk profile of your book did not change on 1 July. Then have a senior manager approve it (s 26P(1)), notify your governing body in writing (s 26P(2)), document it (s 26N), and set the next review date now — the statutory backstop is 3 years, and any significant change pulls it forward.