Understanding AML/CTF Risk Assessment

As Australia moves closer to implementing new Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) obligations for property and legal sectors, practitioners need to prepare for the practical impact. A core theme in compliance is risk assessment, the foundation of any AML/CTF program.

In the article we detail what risk assessment involves, why this matters and how firms can start preparing.

You can revisit our webinar to learn more.

Why Risk Assessment is core to AML/CTF?

Without understanding the risks your business faces, it’s difficult to design policies and procedures that effectively prevent misuse of your services. 

Historically, programs were split into ‘Part A’ (framework and policies) and ‘Part B’ (customer due diligence, KYC). Moving forward these elements will be integrated, but the fundamentals remain: 

ML/TF Risk Assessment: Identification and assessment of risks must be based on a clear and comprehensive methodology that supports: 

• an expansive identification of risk;
• robust and defensible assessment of risk; and 
• the identification and assessment of both inherent risks to be mitigated and residual risk to be managed.

AML/CTF Policy: Define how you manage and mitigate money laundering and proliferation financing risks identified and ensure compliance with the general requirements of the AML/CTF Act and Rules. 

Risk Assessment Requirements

Risk assessment is fundamentally an assessment of a firm’s vulnerability to money laundering, terrorist financing and proliferation finance. Effectively, a robust AML/CTF risk assessment considers how your legitimate services might be misused by criminals. 

Firms should consider: 

• Services – could your offering facilitate money laundering?
• Customers – do you know the type of customer you’re dealing with – individual, company or complex structures
• Nature, size and complexity
• Jurisdictions/ International sanctions – is your client linked to high-risk or sanctioned countries?
• Proliferation financing
• Typologies – common methods criminals use to launder money
• National Risk Assessment Outcomes
• Industry specific indicators

Understanding Inherent and Residual Risk 

Effectively the requirement is that firms identify, mitigate, and manage risks.  

In AML, risk assessments distinguish between inherent and residual risks – it’s important firms identify inherent risks and mitigate those through controls and then manage the residual risk on an ongoing basis.

These two forms of risk can be differentiated as follows: 

• Inherent risk refers to the natural exposure to ML/TF, it is the level of risk before applying any controls.
• Residual risks refer to those risks which remain after applying policies, due diligence and monitoring.  

Having controls in place like CDD, sanction screening and transaction monitoring can help reduce risks but cannot eliminate them directly.  

Practical steps to start assessing risks

While the upcoming regime introduced new obligations, many firms already have solid foundations through ethical duties and client due diligence processes. 

To begin: 

1. Know your business: Understand your services, clients and transaction types;
2. Understand your customers;
3. Data Sourcing: Obtaining data from various sources can help create a comprehensive customer risk profile;
4. Assess the risks; and
5. Review and determine whether to implement the starter kits or use other AML risk and compliance resources.

The priority is to formalise risk assessments and align policies with practice. Start by reviewing your client base, transaction types and engagement methods.  

AUSTRAC is also set to release program kits for small businesses in Tranche 2 sectors. These kits are designed to increase the effectiveness of AML/CTF programs and reflect sector-wide money laundering, terrorism financing and proliferation financing risk and industry practice.    

By approaching risk assessment as an ongoing process, firms not only meet regulatory requirements but also protect themselves from being misused.  

AML on demand 

To help you prepare, PEXA is hosting an AML webinar series on demand. Watch our second session The next step: Understanding AML Risk Assessment.  

Hosted by PEXA’s General Manager – Practitioners, Rukshana Sashankan, we are joined by industry experts Bobbie Wan, Head of Regulatory Policy and Strategy at The Law Society of NSW, Neil Jeans, Partner – Risk Consulting at Grant Thornton and Jeremy Moller, Senior Advisor – Risk Advisory from Norton Rose Fulbright. 

Watch Now