Proliferation Financing Risk for Tranche 2 Firms

If you are a Tranche 2 reporting entity, your business-wide risk assessment must now cover proliferation financing alongside money laundering and terrorism financing. For a firm that works only in Australia and has no overseas links, the exposure is often low, and the task is not to build a separate document. The task is to assess your customers, countries and delivery channels honestly, reach a reasoned rating, and record why you reached it. This guide shows how a small firm does that under section 26C of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), and how it connects to sanctions screening during customer due diligence.

TL;DR

• AUSTRAC expects your risk assessment to cover money laundering, terrorism financing and proliferation financing together. AUSTRAC calls the three “ML/TF risks”.
• Assess proliferation financing through the same three lenses you already use: customers, countries and delivery channels.
• A low rating is acceptable when it is reasonable and documented. An undocumented “low” is not.
• Whether a customer is designated is established during CDD, by checking the DFAT Consolidated List at onboarding and again as the list changes.
• Every potential match needs a person to review it and record the outcome.

Table of Contents

• What proliferation financing means in the Act
• What section 26C requires of your risk assessment
• Assessing proliferation financing through customers, countries and delivery channels
• Keeping it proportionate: recording a low-risk judgement
• Targeted financial sanctions and the CDD connection
• A step-by-step approach for a small firm
• Our perspective: judgement stays with your officer
• How AML Guard supports the screening control
• Common mistakes to avoid
• FAQ
• Sources

What proliferation financing means in the Act

Proliferation financing is the funding of the spread of weapons of mass destruction. Our reading of the Act should not rest on that plain-language summary, so here is the legal definition. Section 5 of the AML/CTF Act states that “proliferation financing means conduct that amounts to” a set of listed matters. Those matters include offences against the Charter of the United Nations Act 1945 or its regulations that are prescribed for this purpose; offences against the Autonomous Sanctions Act 2011, or contraventions of its regulations, that involve sanctions addressing the proliferation of weapons of mass destruction (and others that are prescribed); and the provision of assets or financial services, or other dealing with assets, in contravention of a prescribed Commonwealth law that implements an international agreement on the proliferation of weapons of mass destruction. It also covers corresponding offences under State, Territory and foreign law, and any other offence against Commonwealth, State or Territory law that is prescribed. Read the current text of the Act for the exact wording, because some of the offences are prescribed by regulation.

Two features of this definition matter for a small firm.

First, it is anchored in Australian sanctions law. Proliferation financing, for your purposes, is closely tied to dealing with people, entities and assets that Australian sanctions law restricts. That is why sanctions screening is the practical control for most small firms. DFAT cautions that sanctions and AML/CTF controls alone may be insufficient for every business, so read the section on keeping it proportionate before you settle on a rating.

Second, it sits inside the term your program already uses. AUSTRAC’s guidance asks you to identify and assess your money laundering, terrorism financing and proliferation financing risks and refers to them collectively as ML/TF risks. There is no separate proliferation financing program to write. There is one risk assessment, and proliferation financing is one of the risks in it.

What section 26C requires of your risk assessment

Section 26C requires you to undertake an assessment that identifies and assesses the risks of money laundering, financing of terrorism and proliferation financing you may reasonably face in providing your designated services, with steps appropriate to the nature, size and complexity of your business. Where you provide those services at or through a permanent establishment in Australia, you must have regard to the kinds of services and customers, the delivery channels, the countries you deal with and any risk information AUSTRAC has communicated to you (section 26C(3)). In practice, expect the assessment to be:

1. Tailored to your business, with a methodology suited to your size, services and customers.
2. Documented clearly enough that a supervisor can follow your reasoning.
3. Approved by a senior manager that your AML/CTF policies designate for the purpose (section 26F(4)(c)).
4. Reviewed at least every three years, and sooner when there is a significant change to your services, customers, delivery channels or countries, or when AUSTRAC communicates information about your risks (section 26D). For a significant change within your control, the review comes before the change.

The approval and review requirements come from the Act: section 26F(4)(c) for approval and section 26D for review. AUSTRAC’s Step 2 guidance explains how to carry out the assessment, and asks you to document it so that your governing body, senior managers, compliance officer and staff can understand and use it. A point worth repeating to a small team: the value of the assessment depends on understanding how your business could be exploited, not on filling in a template. Ask how your services, delivery channels and customer types could be misused to hide the identity of a party or the source of their wealth, then write down what you found.

If you are still building the wider document, our guide to the AML risk assessment for real estate agencies walks through the whole structure. This article deals only with the proliferation financing strand.

Assessing proliferation financing through customers, countries and delivery channels

You do not need new categories. The three you already use for money laundering and terrorism financing are the right frame. The skill is in asking the proliferation question of each one, and in recording an answer that reflects your actual book of business rather than a generic one.

Customers

Start with who you act for. List your customer types: owner-occupier vendors and purchasers, investors, companies, trustees, estates, and so on. For each, ask whether any realistically carries a link to a designated person or entity, or to conduct that would breach sanctions law.

For most firms the honest answer is that the customer base is domestic, individual and easy to identify. Record that. But note where the picture gets harder: customers that are companies or trusts, where ownership and control are layered, and customers who act through an intermediary. Beneficial ownership is the point at which a designated person could sit behind a structure, so the quality of your beneficial ownership determination is a proliferation financing control as well as a money laundering one.

A useful way to write this down is a short table in your assessment:

Fill in the second column from your own records. Do not copy figures from anyone else’s assessment.

Countries

Geography is the second lens. Ask where your customers are resident, where they are incorporated, where their funds come from, and whether any of your work has a cross-border element. DFAT’s advisory note calls Iran and the DPRK countries of specific concern and points to the FATF’s calls to action on them. Section 32 of the Act also requires enhanced CDD where the customer, a beneficial owner, a person on whose behalf the customer is receiving the service or a person acting for the customer is an individual physically present in, or a body corporate or legal arrangement formed in, a high risk jurisdiction for which the FATF has called for enhanced due diligence. Those lists change, so check them when you assess, and if you name a country in your assessment, cite the page that identifies it and its date.

AUSTRAC’s Step 2 guidance says your business is less likely to face proliferation financing risk if you meet all four of these criteria: you only operate in Australia; you do not provide designated services to customers located in, or with connections to, high-risk jurisdictions; your services do not involve moving money, sensitive or dual-use goods or technologies, including to countries or third parties involved, directly or indirectly, with proliferation financing; and you do not offer a service relevant to proliferation financing. So the questions for your file are plain ones:

• Do we act for customers who live or are incorporated outside Australia?
• Do any transactions involve funds sent from overseas accounts?
• Does any service we provide involve moving money, or dealing in goods or technology, for a customer?
• Do we offer any service that could be relevant to proliferation financing, such as setting up companies or trusts for clients?

If you do act for overseas buyers, read our note on overseas buyer AML checks before you finalise this section, because that is where a rating of “low” most often needs to be revisited.

Delivery channels

The third lens is how you meet and verify customers. Face-to-face onboarding in your office carries different risk from remote onboarding by email, and different again from instructions received through a third party. For proliferation financing, the channel question is whether you can be confident of who is actually on the other side. Ask:

• Do we onboard customers we never meet?
• Do we rely on another reporting entity’s customer due diligence, and if so, how do we satisfy ourselves that it is sound?
• Do payments reach us from a party other than our customer?

Each answer feeds your rating and your controls. A firm that verifies identity with document capture and a liveness check, and that records who paid whom, has a stronger answer than one relying on emailed photocopies.

Keeping it proportionate: recording a low-risk judgement

A common misconception is that every business needs complex, separate proliferation financing policies. The Act is proportionate. Under section 26F(11) you are not required to have policies, procedures, systems and controls that specifically deal with proliferation financing if you reasonably assess the risk as low under section 26C or 26D, and reasonably assess that your money laundering and terrorism financing controls can appropriately manage and mitigate it. Section 26F(12) puts the burden on the person relying on that exception, so the reasoning has to be on file. AUSTRAC’s Step 2 guidance says the same in its section on proliferation financing risk, and its Step 3 guidance on AML/CTF policies is the place to confirm how your policies must manage and mitigate the risks you have identified. The DFAT Advisory Note on sanctions and proliferation financing makes a similar point from the sanctions side: reasonable precautions and due diligence depend on context, so what suffices for a local agency differs from what a large financial institution needs. It also adds a caution: sanctions and AML/CTF controls alone may be insufficient for all businesses, because some proliferation financing indicators sit outside sanctions controls.

That flexibility only helps you if the reasoning is on the page. When you rate proliferation financing as low, your file should show:

1. What you considered. Customer types, countries, delivery channels, and the services you offer.
2. What you found. For example, that your customers are domestic individuals and the work involves no goods or technology.
3. Why that supports the rating. A sentence or two connecting the facts to the conclusion.
4. What controls apply regardless. Screening against the DFAT Consolidated List at onboarding, with ongoing re-screening.
5. What would change the rating. A trigger you will act on, such as taking an overseas customer or a customer with a complex ownership structure.
6. Who approved it and when. The senior manager’s sign-off, and the date of the next review.

Notice what this list does not contain: a catalogue of proliferation indicators of your own. DFAT’s advisory note publishes red flags and indicators, which it says should not be treated as an exhaustive list, and it names the sectors the FATF treats as higher risk, including trust and company service providers, which in Australia may include law firms, accounting firms and corporate service providers. It also lists front or shell companies and professional intermediaries among the methods used against Australia, often involving clients who give incomplete or inconsistent information. Read it, note any indicator that fits your work, and record why the others do not. A firm that sets up companies or trusts for clients, or whose customers have overseas links, should not default to a low rating without doing that.

Example wording for a small agency

The following is illustrative, not a template to paste. Adapt it to your own facts.

We act for individual vendors and purchasers, predominantly resident in Australia. We do not deal in goods or technology. We rarely act for companies or trusts, and when we do, we determine beneficial ownership and screen the people involved. We assess our proliferation financing risk as low. This is managed through sanctions screening at onboarding and ongoing re-screening, with each potential match reviewed by our compliance officer. We will reassess if we begin acting for overseas customers or for customers whose ownership we cannot readily determine.

That paragraph is short, specific and testable. A supervisor can compare it with your customer records and see whether it is true.

Targeted financial sanctions and the CDD connection

Proliferation financing risk and sanctions compliance meet at one point: knowing whether the person in front of you is designated. That is established as part of customer due diligence.

The DFAT Consolidated List is the reference. It is maintained by the Australian Sanctions Office and covers individuals, entities and vessels subject to Australian sanctions, including those listed under United Nations Security Council regimes or by the Foreign Minister under autonomous sanctions laws. DFAT describes it as a key resource for due diligence checks. Some of the UN Security Council regimes it reflects are aimed at preventing proliferation, which is the link between your sanctions screening and this risk.

Three consequences follow for your procedures.

Screen at onboarding. Check every customer, and where the customer is a company or trust, the beneficial owners and controllers you have identified. A designated person can hold an interest indirectly, which is why the ownership step matters.

Re-screen over time. The list changes. DFAT updates it regularly, and the page shows the date it was last updated, so check it on the day you screen. A customer who was clear at onboarding may not be clear later. Point-in-time checking is a weak control for an ongoing relationship, and manual checking against a spreadsheet is prone to error.

Know what a match means. DFAT’s guidance is that dealing with a person or entity on the list is a serious criminal offence, and that if you identify a match you should seek legal advice before proceeding with any dealings involving that person, entity or vessel, or any assets they own or control. If you hold, or think you may hold, an asset owned or controlled by a listed person, DFAT says you must hold (“freeze”) it, inform the Australian Sanctions Office and notify the Australian Federal Police as soon as possible. Do not improvise this. Write the escalation step into your procedure: who reviews a potential match, who decides, whom you notify, and how the decision is recorded. Where a match raises doubts that call for a closer look at the customer, our guide to enhanced due diligence triggers sets out what follows.

A step-by-step approach for a small firm

If you have a working ML/TF risk assessment already, adding proliferation financing is usually a short, careful piece of work, not a project.

1. Read the definition. Confirm the current wording in the Act, and note it in your assessment with the date you checked.
2. Review your customer list. Identify any customer types with complex structures, overseas links or intermediaries.
3. Review your geography. Note where customers live, where entities are incorporated and where funds originate.
4. Review your channels. Note how you onboard, who you rely on and who pays you.
5. Rate the risk. Use the same scale as your other ML/TF risks, so the result sits comfortably within the whole assessment.
6. Write the reasoning. Use the six-point record above.
7. Link the controls. Point to your screening procedure and your escalation steps.
8. Obtain approval. Have a senior manager approve it and diarise the review.
9. Train your people. Staff who onboard customers need to know what a screening hit looks like and whom to tell. Our note on AML training for real estate covers what agencies must do.

Our perspective: judgement stays with your officer

We build AML Guard for Australian Tranche 2 reporting entities, and the pattern we see is that firms overcomplicate proliferation financing or ignore it. Neither serves them. The firm that overcomplicates writes policies nobody follows. The firm that ignores it has nothing to show a supervisor when asked.

The workable middle is to treat proliferation financing as one more question your risk assessment answers, and to let the answer flow into the controls you already run. That is why our guided wizards generate the risk assessment, the AML/CTF policies, the compliance action plan and the staff training manual from the same set of answers. If your assessment records that you screen at onboarding and re-screen on an ongoing basis, your policies and training say the same. A supervisor checks that consistency, and a downloaded template cannot give it to you.

We also hold a firm view on where automation stops. The platform automates the lookups and the record keeping. It does not make the decision. When a screening result needs interpreting, an officer reviews the match and records the outcome, and that review sits in the audit trail. A tool that quietly clears or blocks customers without a person in the loop would remove the very judgement the regime expects you to exercise.

How AML Guard supports the screening control

AML Guard runs sanctions, PEP and adverse media screening as part of customer due diligence at onboarding, then re-screens ongoing so a later change does not go unnoticed. An officer reviews each match, and the reasoning is recorded in a tamper-evident audit trail that holds records for 8 years, above the Act’s seven-year minimum. For companies, beneficial ownership determination runs from the ACN, and trusts and SMSFs are reached through their corporate trustee, so the people behind a structure are screened, not just the entity.

See how the pieces fit on the AML Guard pricing page, or book a demo to walk through a screening match from alert to recorded decision.

Common mistakes to avoid

• Copying a generic paragraph. A sentence that could sit in any firm’s assessment proves nothing about yours.
• Rating low without saying why. The rating is acceptable only if it is reasonable and documented.
• Naming countries without a source. If you cannot cite an official page, do not list it.
• Screening once. The Consolidated List changes, so a clean result at onboarding is not a permanent one.
• Leaving the match process vague. Decide in advance who reviews a hit, and write it down.
• Forgetting the review trigger. A new service, a new customer type or an overseas customer is a reason to revisit the rating, not just the three-year cycle.

FAQ

Do small firms need a separate proliferation financing assessment?

No separate document is required. AUSTRAC’s guidance has you identify and assess proliferation financing as one of your ML/TF risks within the business-wide risk assessment. What you do need is a clear, documented conclusion on it, with the reasoning behind your rating.

Is a low-risk rating acceptable?

Yes, where it is reasonable and documented. Section 26F(11) of the Act lets you rely on your existing money laundering and terrorism financing controls, without separate proliferation financing policies, if you reasonably assess the risk as low and those controls can manage it. AUSTRAC says a business is less likely to face proliferation financing risk if it only operates in Australia, serves no customers in or connected to high-risk jurisdictions, does not move money or sensitive or dual-use goods or technologies, and offers no service relevant to proliferation financing. Your record should show the facts you relied on and what would cause you to reassess.

How does the DFAT Consolidated List relate to proliferation financing?

The list covers persons, entities and vessels subject to Australian sanctions, including those listed under UN Security Council regimes. Some of those regimes target proliferation. Checking whether a customer is designated is therefore part of your CDD, and it is your main practical control for this risk.

What should we do if a customer matches the Consolidated List?

Do not proceed with the dealing while you resolve it. DFAT describes dealing with a listed person as a serious criminal offence and advises that if you identify a match you seek legal advice before proceeding with any dealings involving that person, entity or vessel, or any assets they own or control. Escalate to your compliance officer straight away.

How often should we review the assessment?

Section 26D requires a review at least once every three years, and also when there is a significant change to your services, customers, delivery channels or countries, or when AUSTRAC communicates information about your risks. For a significant change within your control, such as acting for your first overseas customer or taking on a new service line, review before the change occurs. For one outside your control, review as soon as practicable afterwards.

Sources

• Step 2: Identify and assess your risks, AUSTRAC
• Step 3: Manage and mitigate your risks, AML/CTF policies, AUSTRAC
• Advisory Note: Sanctions and proliferation financing, DFAT
• Consolidated List, DFAT
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006, Federal Register of Legislation

Recommended

• Tranche 2 AML/CTF for Australian law firms
• AML risk assessment template for Tranche 2 firms
• AML training for law firms under Tranche 2
• AML/CTF policy template for Tranche 2 firms