AUSTRAC expects reporting entities to maintain an AML/CTF risk assessment that accurately identifies, assesses and documents their money laundering, terrorism financing and, where applicable, proliferation financing risks. A defensible risk assessment is evidence-based, tailored to the reporting entity’s business and kept current. It is not sufficient to rely on a generic template or a one-off assessment.
Expanded Answer
An AML/CTF risk assessment is the foundation of a reporting entity’s AML/CTF program. AUSTRAC expects the assessment to identify the inherent risks arising from the products and services offered, customer types, delivery channels, jurisdictions and other relevant business characteristics. The assessment should explain why each risk has been rated and how the conclusions support the design of AML/CTF controls.
A defensible risk assessment reflects how the business actually operates rather than how it was intended to operate. It should be supported by customer data, transaction information, incidents, suspicious matter reporting, internal reviews, regulatory developments and emerging financial crime threats. The assessment should also demonstrate how residual risks have been considered after accounting for existing controls.
Key characteristics:
- Based on the reporting entity’s actual business activities.
- Supported by documented evidence rather than assumptions.
- Reviewed when products, services, customers or risk exposures change.
- Linked directly to customer due diligence, transaction monitoring, reporting and governance controls.
An assessment becomes difficult to defend when it is generic, inconsistent with business operations, unsupported by evidence or left unchanged despite significant changes to the business or financial crime environment. For further guidance, see Why AML programs fail adviser audits.
Why it matters
A weak risk assessment can undermine the entire AML/CTF program because customer due diligence, monitoring and reporting controls are expected to reflect the risks identified. Poor documentation also makes it more difficult to demonstrate compliance during an AUSTRAC review or regulatory investigation.
Unsure how this applies to you?
Get a clear answer in a 15-minute call with a compliance specialist. Book your call
Practical guidance
- Document the evidence supporting each identified money laundering and terrorism financing risk.
- Review the risk assessment whenever business activities, customers or delivery channels change.
- Verify that AML/CTF controls are proportionate to the risks identified in the assessment.
Further reading
Why AML programs fail adviser audits