Proliferation Financing: Defending a Low Rating

A low proliferation financing (PF) rating is hardest to defend when your firm creates or runs the structures that other people use to hold assets and move money. Selling shelf companies, setting up or restructuring companies and trusts, supplying nominee directors, trustees or shareholders, and providing a registered office address are all services that DFAT’s Australian Sanctions Office describes as attractive to proliferators. If your Tranche 2 business offers any of them, your risk assessment needs a documented reason for every rating it gives, and “we only act for local clients” is rarely enough.

This article is about that narrower question: how to test a low rating against the services in section 6, Table 6 of the AML/CTF Act that create or run structures, which indicators DFAT publishes, and which controls give the rating something to stand on. The definition of proliferation financing, the section 26C requirement, the section 26F(11) exception and the form of a low-risk record are set out in our proliferation financing risk guide for Tranche 2 firms. We do not repeat them here.

TL;DR

• Services that create or run structures (shelf companies, company and trust formation, nominee roles, registered office) sit closest to the methods DFAT names, so a low PF rating needs more evidence than it does for a business that only brokers transactions.
• DFAT’s advisory note names trust and company service providers as a sector proliferators use to obscure links to designated persons, and lists front or shell companies as a known methodology.
• The controls that support a defensible rating are: screening every beneficial owner against the DFAT Consolidated List, policies so no assets reach a designated person (Rules 5-3), enhanced CDD where risk is high (section 32), and a suspicious matter report where grounds arise (section 41).
• Record the reasoning, the screening results and the officer’s decision together, so the rating can be explained to a supervisor years later.

Table of Contents

• Why structure-creating services change the PF question
• What DFAT says about trust and company service providers
• DFAT’s indicators, applied to your services
• Why a low rating becomes hard to defend
• Four controls that support the rating
• Keeping a record that holds up
• Our perspective
• Bringing the controls into one workflow
• A short test before you keep a low rating
• FAQ
• Sources

Why structure-creating services change the PF question

Most Tranche 2 businesses deal with a transaction that already exists: a property is being sold, a settlement is being completed, a matter is being run. A firm that creates or runs a structure is in a different position, because it produces the vehicle itself. A new company, a trust or a nominee arrangement can then be used by someone else to hold assets, open accounts or trade, and the firm’s name sits at the start of that chain.

The services in question are, in practical terms:

• selling shelf companies;
• creating or restructuring companies and trusts;
• acting as, or arranging for another person to act as, a nominee director, trustee or shareholder;
• providing a registered office address.

These are the section 6, Table 6 services that matter for this question. They apply to trust and company service providers, and in practice also to the law firms and accounting practices that offer them alongside their other work. If your practice provides none of them, the analysis below is less pressing, though the same indicators still apply to any customer you onboard.

Other services in the same Table, such as acting in a real estate transaction, carry their own exposure. AUSTRAC’s real estate risk insights state that the national assessments of terrorism financing and proliferation financing identified no specific risks for the real estate sector, while stressing that awareness of those risk environments is essential. That is a statement about a sector. It does not transfer to a firm that forms companies and trusts for clients, because a different service is a different risk.

What DFAT says about trust and company service providers

The Australian Sanctions Office published its advisory note on sanctions and proliferation financing on 27 August 2025. It is the clearest official statement of how proliferators use the services this article is about, and it is worth reading in full before you finalise a rating.

The note lists trust and company service providers among the sectors at higher risk of exploitation. The stated reason is that they create corporate entities which proliferators use to obscure the link between a financial transaction and a designated person or entity. The note adds that in Australia this may include law firms, accounting firms, corporate service providers, and financial planners and self-managed super funds. In other words, the category is defined by the service, not by the label on your business card.

The note also names two methodologies targeting Australia and the region that map directly onto your services:

1. Front or shell companies. This covers establishing, or using pre-existing, companies to conduct trade or move funds that support proliferation. The note says these companies often have limited or no physical or online presence. A shelf company and a registered office address are, by their nature, a way of giving a company a presence.
2. Professional intermediaries. This covers trust and company service providers who can be unknowingly used to provide services for proliferation finance, which the note says often involves clients who provide incomplete or inconsistent information.

The word “unknowingly” matters. The exposure described is that of a legitimate firm that does not realise what its work is being used for. That is why the question is one of controls and records, not of intent.

DFAT’s indicators, applied to your services

DFAT’s note lists potential red flags or indicators. We summarise them closely here, without adding any of our own, and show where each is likely to surface when you form or run a structure.

The note also lists indicators tied to export documentation, including incorrect commodity classification codes and unusual shipping routes or transhipment points. A firm that forms a company will rarely see shipping documents. If a client does show you any, treat them as relevant.

The pattern across the table is plain. Almost every indicator is about who stands behind an entity, what it does, and whether the story hangs together. Those are exactly the things you are in a position to establish before you create the entity, which is why the rating cannot be treated as a formality.

Why a low rating becomes hard to defend

A rating is defensible when a reader who has never met your client can follow the reasoning from your services to your conclusion. For firms that create or run structures, four weaknesses recur.

The rating rests on the client base alone. “Our clients are local families and small businesses” describes who you act for today. It says nothing about who might ask for a shelf company next year, or who stands behind a nominee arrangement you have agreed to supply. A rating should address the service as well as the current clients.

Nominee and registered office services are treated as administrative. DFAT’s methodologies single out structures with obscured ownership and little physical presence. A nominee role or a registered office address supplies exactly those two features, so rating them as clerical sits badly with the advisory note.

Beneficial ownership is recorded but not tested. Naming the owners is not the same as screening them. If the people behind a company or trust have not been checked against the DFAT Consolidated List, the rating has no control to point to.

The reasoning is not recorded. A rating that someone reached in their head, or in a conversation, cannot be reproduced for a supervisor. The decision and its basis need to be written down at the time.

None of this means every such firm must rate itself high. It means the rating has to be earned with evidence, and the evidence has to be on file.

Four controls that support the rating

The following controls are the ones that give a PF rating something to stand on. They sit inside the AML/CTF program you already have to maintain. The AML/CTF policies guide explains how policies are structured in general.

Screen every beneficial owner against the Consolidated List

DFAT’s guidance note for real estate professionals states that before providing a designated service, a reporting entity must establish on reasonable grounds the identity of the customer and any beneficial owner where the customer is a legal entity. It must also establish whether any of those persons, including anyone acting for the customer, is designated for targeted financial sanctions. That note is written for real estate, but the sequence it describes applies to any reporting entity: identify, then establish designation status.

For a structure-creating service, this means screening each beneficial owner, not only the person who instructs you. Where a company sits above a trust or another company, the screening follows the ownership chain until you reach the natural persons.

Policies so no assets reach a designated person (Rules 5-3)

Your policies need to be written so that your firm does not make assets available to a designated person or entity. Rules 5-3 is the provision to read for this. In a structure-creating practice, the policy should say what happens when a screening hit appears before or after the entity is formed, who decides, and how the work is stopped or held while that decision is made.

A policy that exists only on paper does not meet this. Staff need to know the steps, and the steps need to match the risk assessment that justifies them.

Enhanced CDD where risk is high (section 32)

When a customer, a structure or a service is rated high risk, section 32 calls for enhanced customer due diligence. DFAT’s countermeasures include seeking further information on the ultimate beneficial ownership of companies and trusts. For a firm that supplies nominee roles or builds layered structures, enhanced CDD is the natural response to an ownership picture that does not explain itself.

The practical triggers are the indicators in the table above: an ownership chain with no obvious natural person at the top, a stated purpose that does not match the client’s profile, or incomplete and inconsistent information that persists after you ask.

A suspicious matter report where grounds arise (section 41)

If enquiries leave you with grounds for suspicion, section 41 requires a suspicious matter report. AUSTRAC’s real estate program guidance sets the timing: 24 hours for suspicions relating to terrorism financing, and 3 business days for other suspicions. A PF concern that also involves a designated person should be escalated to your AML/CTF compliance officer straight away, so the reporting decision is made inside the window and not after it.

Keeping a record that holds up

A supervisor will want to see how you reached a rating, not only that you hold one. AUSTRAC’s record keeping overview says records must be reasonably necessary to show that you are meeting your CDD and program obligations. Its examples include the current documented risk assessment, earlier versions, approvals, and the steps taken to conduct and review the assessment. Program records are kept from the time they are made until 7 years after they are no longer relevant.

For each entity you create, restructure or administer, a sound file shows:

1. the service provided and the reason it was rated as it was;
2. who the beneficial owners are and how that was established;
3. the screening results against the Consolidated List, with the date and the list consulted;
4. any indicator that arose and how it was resolved;
5. the name of the officer who made the decision, and when;
6. any enhanced CDD undertaken, or the reason none was needed;
7. any suspicious matter report made, and the grounds.

The point of keeping these together is that the story reads in order. If the screening result sits in one system, the officer’s decision in an email and the ownership notes in a spreadsheet, the file has to be rebuilt every time somebody asks about it.

Our perspective

Firms that create and run structures tell us the same thing: the rating is not the hard part. The hard part is showing, a long time afterwards, why they rated a shelf company, a nominee appointment or a registered office the way they did.

We built AML Guard for Tranche 2 reporting entities, including trust and company service providers, law firms and accounting practices. Its guided wizards produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment, so the policy on screening beneficial owners starts from the risks you assessed.

On a single matter, AML Guard keeps one case record holding each identity check, screening result and officer decision. Beneficial ownership determination runs from a company’s ACN, with an officer approving each one. A trust or SMSF is reached through its corporate trustee, which is determined on its own ACN. The platform automates the lookups and the record keeping, not the decisions, which stay with your people.

AML Guard

Bringing the controls into one workflow

If your firm provides any of the structure-creating services, AML Guard keeps the screening results, the ownership determination and the officer’s decision for each matter in one case record. AML Guard is not self-service; every firm starts with a demo. See the pricing page for the subscription and per-check fees.

Book a demo and bring a structure-creating matter from your own practice to walk through.

A short test before you keep a low rating

Before you leave a PF rating at low for a structure-creating service, run through these questions and write the answers down.

1. Does the rating name the specific service, such as shelf company sales or registered office provision, and not only the business as a whole?
2. Have you considered each DFAT indicator against that service and recorded the result?
3. Is every beneficial owner screened against the Consolidated List, with the result saved?
4. Does a policy under Rules 5-3 say what happens if a designated person turns up?
5. Is there a clear trigger for enhanced CDD under section 32?
6. Does your compliance officer know how a section 41 matter is escalated?
7. Can another person follow the file from the rating to the decision without asking you?

If any answer is no, the rating is the weak point, and it is easier to repair now than to explain later. Related guides cover what an AML program must contain for conveyancers and AML training for staff, both relevant when you bring staff into the screening and escalation steps.

FAQ

Does a firm that only forms companies for Australian clients still face PF risk?

Yes, it can. DFAT’s advisory note identifies the creation of corporate entities as the exposure, and the note says the use of intermediaries is often unknowing. A purely domestic client base is one fact to weigh, not a conclusion. The rating should also consider who might ask for the service and who ultimately benefits from the entity.

Which DFAT indicators matter most for a registered office or nominee service?

The indicators about obscured ownership, lack of transparency and parties that do not fit their profiles. A registered office and a nominee both give a company a presence or a name without showing who is behind it. Incomplete or inconsistent information from the client, which DFAT links to intermediary misuse, is the one to watch for at onboarding.

Should every beneficial owner be screened, or only the customer?

Every beneficial owner. DFAT’s guidance describes the requirement to establish on reasonable grounds whether the customer, any beneficial owner and anyone acting for the customer is designated. For a trust or a layered company, screening only the instructing person leaves the structure unchecked.

When does a PF concern become a suspicious matter report?

When your enquiries leave you with grounds for suspicion, section 41 applies. Timing depends on the suspicion: AUSTRAC sets 24 hours for terrorism financing and 3 business days for others. Raise the matter with your compliance officer as soon as grounds appear.

Sources

• DFAT Advisory Note: Sanctions and proliferation financing
• AUSTRAC: Risk insights and indicators of suspicious activity for the real estate sector
• DFAT: Guidance Note on sanctions compliance for real estate professionals
• AUSTRAC: Step 2, Use your real estate program
• AUSTRAC: Record keeping overview

Recommended

• Proliferation Financing Risk for Tranche 2 Firms
• AML risk scoring that stands up to AUSTRAC
• AML risk assessment template for Tranche 2 firms
• AML risk assessment for real estate agencies