Risk-Based AML/CTF: How the Act Builds It

A risk-based approach to AML/CTF means you identify the money laundering and terrorism financing (ML/TF) risks your business actually faces, write policies that match them, rate each customer, and apply more or less due diligence according to that rating. It does not mean you choose which obligations to follow. Every obligation applies to a Tranche 2 reporting entity, and you must follow your own policies. What the risk-based approach decides is how much effort goes where, and the Act expects you to be able to show your reasoning.

This guide sets out how the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) builds the approach, from the business-wide risk assessment to the rating given to an individual customer, with the records that make the reasoning visible to AUSTRAC.

TL;DR

• The risk assessment (section 26C) comes first: it covers your designated services, customers, delivery channels, countries and information AUSTRAC communicates.
• Your AML/CTF policies (section 26F) must suit the nature, size and complexity of your business and respond to that assessment.
• Each customer gets a risk rating that decides the CDD you apply: simplified only where risk is low, enhanced where section 32 requires it.
• The risk assessment is reviewed at least every 3 years and on significant change (section 26D).
• Risk-based is not optional: every obligation applies, and you must follow your own policies (section 26G).

Table of Contents

• What “risk-based” does and does not mean
• Step 1: The business-wide ML/TF risk assessment (section 26C)
• Step 2: AML/CTF policies suited to your business (section 26F)
• Step 3: A risk rating for each customer
• Documenting risk ratings so they stand up
• Review and update (section 26D)
• Common failures in applying the approach
• Our perspective
• Putting the approach into practice with AML Guard
• FAQ
• Sources

What “risk-based” does and does not mean

The phrase is easy to misread as flexibility to do less. The Department of Home Affairs describes it differently: reporting entities design measures commensurate with their ML/TF risk, and that risk varies with customers, services, delivery channels and jurisdictions. The same department gives a real estate illustration: an ordinary suburban owner-occupier sale carries a different risk profile from a luxury property purchase by an international high-net-worth buyer, so the controls should not be identical.

Three points follow from this.

1. Risk decides proportion, not applicability. The obligations to enrol, appoint a compliance officer, perform customer due diligence, report and keep records apply regardless of how low your risk looks.
2. Your policies bind you. Under section 26G, once you write a policy you must comply with it. An over-ambitious policy you do not follow is a compliance failure of its own.
3. Reasoning must be documented. A rating with no recorded basis cannot be defended to a supervisor, however sensible it was at the time.

Tranche 2 obligations for real estate, legal, accounting, and trust and company service providers commenced on 1 July 2026 and are in force. The question for an agency, firm or practice is no longer whether the approach applies but whether your documents and day-to-day files show it working.

Step 1: The business-wide ML/TF risk assessment (section 26C)

Everything else rests on this document. AUSTRAC’s guidance on identifying and assessing your risks says the assessment must consider the risks in your current and planned designated services. Section 26C directs you to look at:

• the kinds of designated services you provide, including new technologies connected with them;
• the kinds of customers to whom you provide, or will provide, designated services;
• the delivery channels you use, such as face-to-face, remote or through intermediaries;
• the countries you deal with; and
• information AUSTRAC communicates to you, such as risk assessments and guidance for your sector.

AUSTRAC’s step 2 guidance breaks the work into three parts: identify the risks you may reasonably face, assess the scale of each one (which can include its likelihood and impact), and evaluate them so you can prioritise how you address them. It expects the assessment to start from your inherent risks: the risks you face before any policies or controls are applied.

Identify, assess, prioritise

Identify means listing where risk could arise in your particular business. For real estate, AUSTRAC’s risk insights for the sector include a customer quickly buying or selling properties for no clear reason, offering to pay more than market value, or making part of the payment in cash, and its starter kit treats a purchase over A$1.5 million without a mortgage as a medium-risk factor. A buyers agent, a developer selling off the plan and a suburban sales agency will each produce a different list.

Assess means judging, for each identified risk, how likely it is and how serious the consequences would be before any controls are applied. This is the inherent risk. Keep the scale simple and consistent, for example low, medium and high, and write down why each risk sits where it does.

Evaluate and prioritise means deciding which risks need the strongest response. This is where proportion enters: the risks you rank highest should attract the most demanding policies and checks.

A worked example

Consider a mid-sized agency that sells residential property and also acts for investors. Its assessment might record:

The figures are illustrative. What matters is the pattern: each row links an observation to a rating and a response, so the policies visibly come from the assessment. Our guide to AML risk assessment for real estate agencies goes through the real estate risk factors in more detail.

Step 2: AML/CTF policies suited to your business (section 26F)

Policies are the procedures, systems and controls that manage the risks you identified. Section 26F requires them to suit the nature, size and complexity of your business. AUSTRAC’s program overview states that the program must be written, approved by a senior manager, contain the risk assessment and the AML/CTF policies, and be followed.

In practice, a sole-principal agency and a multi-office group should not have identical policies. The smaller business may have one officer approving every high-risk determination. The larger one may need delegations, escalation paths and a clear division between front-line agents and the compliance officer. Both must be able to explain why their arrangements fit their size.

Good policies share a few features:

• They name the trigger and the action. “Where a customer is rated high, the compliance officer approves before the agency acts” is testable. “High-risk customers will be treated carefully” is not.
• They cite the assessment. Each major control should trace to a risk in the assessment.
• They can be performed by your people. A policy requiring a check nobody has time or tools to run will be breached, and under section 26G a breach of your own policy is a breach of the Act.
• They are approved. Senior manager approval is part of the program’s validity, not a formality.

AUSTRAC’s real estate program starter kit includes a risk assessment, policies, day-to-day processes and forms, and is designed so agencies can customise it to their own nature, size, complexity and risk profile. Customisation is the operative word: adopting any template without tailoring it does not meet the requirement.

Step 3: A risk rating for each customer

The business-wide assessment tells you where risk sits in general. The customer rating applies that picture to a specific person or entity in front of you. AUSTRAC’s real estate program starter kit guidance has agencies assign a low, medium or high rating using relevant risk factors, then scale the controls to match.

The usual factors mirror section 26C:

• Who the customer is: an individual, a company, or a trust acting through a corporate trustee; whether the structure is simple or layered; whether any party is a politically exposed person.
• What they are asking for: the type of transaction, whether it is financed, and whether the price or timing is unusual.
• How they deal with you: in person, remotely, or through an intermediary.
• Where they are connected: residence, nationality, source of funds and the countries involved.

How the rating decides the CDD

The rating is not a label. It determines what you do next.

Two points of precision. Under section 31, simplified CDD is available only where the customer’s risk is low and section 32 does not apply. And enhanced CDD is not only for customers you rate high: section 32 also requires it where, for example, a suspicious matter reporting obligation has arisen and you propose to keep acting, or where the customer, a beneficial owner or a person acting for the customer is a foreign politically exposed person, or is physically present in (or, for a company or trust, was formed in) a high-risk jurisdiction for which the FATF has called for enhanced due diligence. Your policies should say how you recognise each of these, so the decision is not made ad hoc.

AUSTRAC’s July 2025 factsheet for Tranche 2 reporting entities adds the timing: initial CDD is generally required before you provide a designated service, ongoing CDD is required throughout the relationship, and enhanced measures apply when risk is high. Our overview of Tranche 2 customer due diligence covers the individual steps.

Ratings are not fixed

A rating reflects what you knew when you assigned it. If a buyer who was low risk at the listing stage later proposes to pay through an unfamiliar overseas entity, the rating should be revisited and the CDD adjusted. Your policies should say what events prompt a re-rating.

Documenting risk ratings so they stand up

AUSTRAC says you must make and keep records relating to your designated services and your AML/CTF obligations. The Act does not prescribe a form for a rating note, so what follows is our recommended practice, built to make the reasoning reviewable. For each customer, a file should show:

1. The rating and the date it was assigned, with the name of the person who assigned it.
2. The factors considered, grouped by customer, service, channel and country, including the ones that pushed the rating up or down.
3. The CDD applied, and why that level followed from the rating.
4. The officer’s decision, where one is required, including any conditions attached.
5. Any change, with what triggered it and what was done in response.
6. Links to supporting evidence: verification results, screening outcomes, ownership determination and source of funds material.

A reviewer reading the file should be able to reconstruct why you did what you did without asking anyone. If the only record is the rating itself, the reasoning has been lost, and it is the reasoning a supervisor tests.

Review and update (section 26D)

The risk assessment must be reviewed at least every 3 years and also on significant change, for example when you add a new designated service, take on a new class of customer, adopt a new delivery channel, expand into new markets, or receive relevant information from AUSTRAC. Where the change is within your control, the review comes before the change happens; otherwise, as soon as practicable after it. AUSTRAC’s program overview says the program must be reviewed and updated so it remains current as circumstances change.

Separately, AUSTRAC’s independent evaluation guidance says your program must be independently evaluated at a frequency that suits the nature, size and complexity of your business, and at least once every 3 years. That evaluation is distinct from the section 26D review of the assessment, so your calendar should track them separately.

When the assessment changes, check the chain downstream:

• Do the policies still address every risk now rated high?
• Do any customer ratings need to be reassessed?
• Does the staff training reflect the revised policies? Our note on AML training for real estate explains what agencies must cover.

Common failures in applying the approach

• A template adopted unchanged. The assessment describes a business that is not yours, so the policies do not fit your size or services.
• Documents that disagree. The risk assessment calls remote clients high risk, but the policies treat them like walk-in customers.
• Ratings without reasons. Files show “medium” and nothing else.
• Policies nobody follows. Section 26G makes this a breach in its own right.
• No review trail. The assessment was never revisited after the business added a new service.

Each of these is a consistency problem, not a knowledge problem. The people involved usually understand the rules; the documents and the day-to-day practice have drifted apart.

Our perspective

We built AML Guard for Australian Tranche 2 reporting entities because the risk-based approach is a chain, and a chain is only as strong as its weakest link. The assessment, the policies and the training manual need to agree with each other, and the customer file needs to show those documents operating.

That is why AML Guard’s guided wizards produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment. A downloaded template starts with no knowledge of your risk assessment.

We are equally firm about where judgement sits. The platform automates lookups and record keeping, not decisions: for companies, beneficial ownership is determined from the ACN, and an officer approves each determination. The decision is the officer’s, and the case record shows it was theirs.

Putting the approach into practice with AML Guard

For agencies, buyers agents, developers, conveyancers, law firms, accounting practices and trust and company service providers, AML Guard keeps one case record holding each identity check, screening result and officer decision, with ACN-based beneficial ownership determination and an officer approving each one. The guided wizards for the risk assessment, program, customer acceptance policy and training manual sit alongside it.

AML Guard is not self-service; every firm starts with a demo. Book a demo to walk through a risk assessment and a customer file with us, or see the pricing page for the subscription and per-check fees.

FAQ

Is the risk-based approach optional for small agencies?

No. Risk-based describes how you calibrate your controls, not whether you have them. Every obligation applies to a reporting entity of any size, and section 26F requires policies suited to the nature, size and complexity of your business, so a small agency can have a simpler program but not a smaller set of obligations.

Can I use simplified CDD for most customers?

Only where the customer’s risk is low, section 32 does not apply, and your policies allow it. You should record why the customer was rated low. If anything in the transaction raises the risk, such as an unusual structure or an unfinanced purchase, the rating and the CDD level should be revisited.

How often must I review the risk assessment?

At least every 3 years and whenever there is a significant change to your services, customers, delivery channels, countries or the information AUSTRAC communicates (section 26D). Many businesses also schedule a lighter annual check so changes are not missed between formal reviews.

What happens if my policies say one thing and my staff do another?

Section 26G requires you to follow your own policies, so a gap between written policy and practice is a compliance failure even if the practice was reasonable. Fix it by either changing the practice or amending the policy through the approval process, and record which you did and why.

What should a documented risk rating include?

The rating, the date, who assigned it, the factors weighed, the CDD level applied, the officer’s decision where required and any later changes with their triggers. The aim is that someone who was not involved can follow the reasoning from the file alone.

Sources

• What it means to be regulated under the AML/CTF regime, Department of Home Affairs
• Step 2: Identify and assess your risks, AUSTRAC
• Risk insights and indicators of suspicious activity for the real estate sector, AUSTRAC
• Step 5: Conduct an independent evaluation, AUSTRAC
• Your AML/CTF program overview, AUSTRAC
• Real estate program starter kit: Getting started, AUSTRAC
• Step 2: Use your real estate program, AUSTRAC
• AML/CTF obligations factsheet for Tranche 2 reporting entities, AUSTRAC

Recommended

• AML risk scoring that stands up to AUSTRAC
• What Is an AML/CTF Program? A Plain-English Guide for Property Professionals
• AML for accountants: which services are captured
• Real estate AML obligations: when CDD starts