Free tool · general information, not legal advice
Draft your ML/TF risk assessment
Last checked 25 September 2026 against the AML/CTF Act compilation C2026C00274, the AML/CTF Rules 2025 (F2025L01026) and the Transitional Rules 2026 (F2026L00393)
Answer questions on the four matters the Act says your risk assessment must have regard to: your services, your customers, how you deliver your services, and the countries you deal with. You get a structured first draft to copy into Word or print. It runs in your browser, and nothing is sent to us.
What this tool does, and what it does not. It follows AUSTRAC's approach: identify your risks and rate them before your controls are applied (the "inherent" risk). It then lists the controls your policies need, and leaves room for the risk that remains after them, which AUSTRAC says a business may choose to assess.1 AUSTRAC It cannot know your business. A person in your firm must check every line, explain every rating, and have a senior manager approve the result.2 s 26P Nothing you type leaves this page.
s 26C the law, read in the authorised textAUSTRAC guidance the regulator's published guidance, which is not law
The draft builder needs JavaScript, which is switched off or blocked in this browser. The questions below still show what your risk assessment has to cover, and our how-to guide walks through each step.
Your answers
Tick every line that is true for your business. Leave a line unticked if you are not sure, and note it for your review.
How the tool rates each factor
This is our starting rule, not AUSTRAC's method. Three lines make their factor high on their own: foreign politically exposed persons, for whom the Act requires enhanced due diligence s 32; online self-service with no staff involved, which AUSTRAC says carries significant risks; and a country on the FATF lists or subject to Australian sanctions, which AUSTRAC expects to be rated high. Otherwise, for each factor, no ticked risk lines gives low, one or two gives medium, and three or more gives high. Lines that only describe you, such as your kinds of customer or dealing in person, are not counted. The overall rating is the highest factor. Change any rating you disagree with, and write down why: AUSTRAC expects each rating to be explained by its likelihood or impact, based on the information you consulted.3 AUSTRAC
ML/TF risk assessment: first draft
Business: [Business name]. Sector: [Sector]. Personnel: [Number]. Drafted: [Date].
Status: draft, not approved. This draft is not yet our risk assessment. It becomes one when we have checked it, completed every blank, and a senior manager has approved it.
1. Purpose and scope
This document is our ML/TF risk assessment. It identifies and assesses the risks of money laundering, terrorism financing and proliferation financing that we may reasonably face in providing our designated services. s 26C(1) The steps we took suit the nature, size and complexity of our business. s 26C(2) It has regard to the kinds of designated services we provide, the kinds of customers we serve, our delivery channels, the countries we deal with, and information from AUSTRAC about the risks of our services. s 26C(3)
We first identified our inherent risks: the risks before our policies are applied. We then recorded the controls that address them, and the risk that remains. AUSTRAC
2. Our designated services
- Brokering the sale, purchase or transfer of real estate (Table 5, item 1).
- Selling our own real estate without an independent agent (Table 5, item 2).
- Acting in a sale, purchase or transfer of real estate (Table 6, item 1).
- Acting in a sale or purchase of a company or trust (Table 6, item 2).
- Receiving, holding or managing a client's money or property for a transaction (Table 6, item 3).
- Equity or debt financing for a company or trust (Table 6, item 4).
- Creating or restructuring companies or trusts (Table 6, item 6).
- Acting as, or arranging, a director, secretary, trustee, partner, attorney or nominee shareholder (Table 6, items 7 and 8).
- Providing a registered office or principal place of business address (Table 6, item 9).
- [List each designated service we provide, with its table and item.]
3. Inherent risk
Ratings are low, medium or high. Each one needs a reason: the likelihood or impact of the risk, and the information we used.
| Factor | What we found | Inherent risk | Why (our reasons) |
|---|---|---|---|
| Designated services s 26C(3)(a) |
|
[Our reasons] | |
| Customers s 26C(3)(b) |
|
[Our reasons] | |
| Delivery channels s 26C(3)(c) |
|
[Our reasons] | |
| Countries s 26C(3)(d) |
|
[Our reasons] |
Overall inherent risk (the highest factor):
4. Proliferation financing
We have no dealings with high-risk or sanctioned countries. We assess our proliferation financing risk as low, and consider that our money laundering and terrorism financing policies can manage it, so we do not keep separate proliferation financing policies. s 26F(11) We must be able to show that this assessment is reasonable. s 26F(12) [Our reasons for rating it low]
We deal with a country on the FATF lists or subject to Australian sanctions. We have not assessed our proliferation financing risk as low. Our policies deal with it, including our targeted financial sanctions policies. Rules 5-3 [Describe the risk and the controls.]
5. Controls: how our policies address these risks
- Initial customer due diligence before we provide a service: identity, beneficial owners, politically exposed person and sanctions status, and the nature and purpose of the relationship. s 28 [Policy reference]
- For real estate transactions, when we may finish initial customer due diligence after the service starts. For the parties the Rules name, the window ends at the earlier of 28 days after exchange of contracts and 3 days before the day first agreed for settlement. s 29 Rules 6-32 [Policy reference]
- For customers we do not meet in person, how we collect and verify their details remotely. As for every customer, verification uses reliable and independent data. s 28 [Policy reference]
- Ongoing customer due diligence and monitoring for unusual transactions and behaviours. s 30 [Policy reference]
- Enhanced customer due diligence where the risk is high, for a foreign politically exposed person, and in the other cases the Act lists. s 32 [Policy reference]
- Senior manager approval before we act for a foreign politically exposed person, or a domestic or international-organisation one where the risk is high, and establishing their source of wealth and source of funds. Rules 5-5 Rules 6-23 [Policy reference]
- Rules for relying on another business's customer checks. s 37A s 38 [Policy reference]
- Targeted financial sanctions policies. Rules 5-3 [Policy reference]
- Threshold transaction reports within 10 business days for physical currency of $10,000 or more. s 43 [Policy reference]
- Suspicious matter reports within 3 business days of forming the suspicion, or 24 hours for terrorism financing. The period is 5 business days where some of the information may be privileged and the privilege belongs to someone else. s 41 [Policy reference]
- Personnel due diligence and training. s 26F(4) [Policy reference]
6. Residual risk
The risk that remains once our policies are in place. AUSTRAC
| Factor | Residual risk | Why |
|---|---|---|
| Designated services | [Low, medium or high] | [Our reasons] |
| Customers | [Low, medium or high] | [Our reasons] |
| Delivery channels | [Low, medium or high] | [Our reasons] |
| Countries | [Low, medium or high] | [Our reasons] |
7. Approval, review and records
- Approved by a senior manager. s 26P Name, position and date: [ ]
- Any update is notified in writing to our governing body as soon as practicable. s 26P
- Documented before we first provide a designated service. Each update is documented within 14 days. Rules 5-15
- We do not start a designated service for a customer unless this assessment is up to date. s 26E
- Reviewed when there is a significant change to our services, customers, channels or countries, when AUSTRAC gives us information about our risks, and in any event at least once every 3 years. s 26D Also reviewed after an independent evaluation with adverse findings. Rules 5-1 Next review due: [ ]
Drafted with the free generator at amlcompliant.com.au, published by Wani Meridian Pty Ltd trading as AMLCompliant. A starting point, not legal advice. Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.
If you have 16 or more personnel
AUSTRAC's starter kits for accounting practices, real estate businesses and legal practices are designed for 15 or fewer personnel. Outside that profile, AUSTRAC says you cannot rely on a starter kit to meet its expectations.4 AUSTRAC A draft like this one is still a useful start, but get advice on the full assessment.
Next steps
- Read the method. Our how-to guide explains each step, with the sections that require it.
- Get the full document. Each sector edition of our kit has a full risk assessment document built on AUSTRAC's free starter kit for that sector, with the approval and review record. AUSTRAC's starter kits themselves are free from its program starter kits page (opens in a new window).
- Have it done for you. Our Set-up service tailors the kit to your firm from your intake.
Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.
Sources
Law is quoted from the authorised text on the Federal Register of Legislation, opened 25 September 2026. AUSTRAC pages are guidance, not law. They open in a new window, and linking to them does not mean AUSTRAC endorses this page.
-
AUSTRAC, "Step 2: Identify and assess your risks" (guidance): identify, assess and evaluate; focus on inherent risks; a business may choose to assess residual risk. austrac.gov.au
-
AML/CTF Act ss 26B to 26F, 26N and 26P, compilation C2026C00274; AML/CTF Rules 2025 (F2025L01026) Rules 5-1, 5-3, 5-5, 5-15, 6-23 and 6-32. legislation.gov.au/C2006A00169/latest/text and legislation.gov.au/F2025L01026/latest/text
-
AUSTRAC, "Step 2: Identify and assess your risks" (guidance): the kinds of service, customer, channel and country it describes as higher risk, including foreign politically exposed persons, remote self-service, and countries on the FATF lists or subject to Australian sanctions.
-
AUSTRAC, program starter kits, "Getting started" pages for the accountant, real estate and legal profession kits, release 1.1, 10 June 2026 (guidance). The kits "are not a substitute for legal advice". austrac.gov.au
Questions
- Is the draft my risk assessment?
No. It is a structured starting point. Your risk assessment must have regard to your services, customers, delivery channels and countries (s 26C(3)), be approved by a senior manager (s 26P) and be documented before you first provide a designated service (Rules 5-15). You need to check every line, explain every rating and add what the tool cannot know.
- What about proliferation financing?
The risk assessment covers money laundering, terrorism financing and proliferation financing (s 26C(1)). If you reasonably assess your proliferation financing risk as low, and your money laundering and terrorism financing policies can manage it, you do not need policies that deal specifically with proliferation financing (s 26F(11)). If you rely on that, the burden of showing it is yours (s 26F(12)).
- How often is it reviewed?
When a trigger in s 26D happens: a significant change to your services, customers, channels or countries; information from AUSTRAC about your risks; or a circumstance in the Rules. In any event, at least once every 3 years. Your policies must also deal with reviewing it after an independent evaluation with adverse findings (Rules 5-1).