AUSTRAC's Step 1.1: Get your risk assessment sorted

Now that we’ve unpacked what AUSTRAC’s starter kits mean - and who they are suitable for - it’s time to rework the documents so they suit your business. The full guidance can feel dense and complex, so we have broken it down into the most useful components below, making it easier for you to customise based on your services, clients and risk profile.

What does AUSTRAC require for risk assessment?

AUSTRAC requires every reporting entity to prepare a written, business-specific money laundering and terrorism financing risk assessment that covers:

• The services you provide and how criminals could misuse them
• What kind of customers you deal with (e.g. individuals, companies, trusts, overseas clients, politically exposed persons (PEPs))
• Your delivery channels (e.g. face-to-face, remote digital, intermediaries)
• Where you and your clients are geographically based and where funds are from
• A structured method for rating inherent risk, controls and residual risk
• Your plan for ongoing reviews of your risk assessment (and AML/CTF program)

This document needs to be completed before 1st of July 2026 and approved by senior management. You’ll also need to ensure all relevant staff are trained and ready to stick to it when the new rules come into play.

How can the starter kit help?

For small firms and agencies, AUSTRAC expects practical, operationally accurate risk assessment, but they are realistic about the capabilities of a leaner team. They’ve supplied a document suitable for smaller, low risk firms and practices, but they are expecting more than just a cut-and-paste job.

You should tailor this risk assessment so that it:

• Maps your actual services
• Covers the risks of your actual customer base
• Explains why certain customers or services you provide are at a higher risk
• Documents your controls (e.g. identify verification, beneficial owner checks)

This is the first thing that AUSTRAC will check in an audit, so it’s important to show your reasoning and ensure it accurately reflects your business.

Ready to get started? With the Tranche 2 changes approaching, now is a good time to start making your custom risk assessment for real estate or legal services.

What are some of the most common client risks?

At APLYiD, we help take the complexity out of this step. Our platform comes loaded with a risk assessment template fully customisable to match your services, client types and delivery model. As clients move through our guided flow, we automatically apply your scoring logic and assign a Low, Medium or High risk rating based on the inputs. No spreadsheets. No guesswork.

To give you an idea of the kind of different client risks your business might face, we’ve pulled together some of the most common client types and associated inherent and residual risks. These can be edited to suit your needs and plugged straight into your risk assessment document, to help show AUSTRAC that you’ve considered your actual customer types and the risks they pose.

What else do I need to do?

Step 1 involves preparing your business for the new rule changes, and risk assessment is just the first milestone to completing this step.

Before 1st of July 2026, you are also required to:

• Customise a policy document to suit your business
• Customise a process document to suit your business
• Get all three reviewed and signed off by senior management so it’s ready to go come 1st of July.

AUSTRAC has provided guidance documents for both real estate and legal services, but they can’t be used as is. Just like your risk assessment they need to be reworked to reflect your business. Once these documents are completed and approved they will serve as your AML/CTF program, so it’s vital your staff are in the loop and ready to stick to it from the 1st of July onwards.

Ready to get started on your policy document? Head to our next article and we’ll guide you through it.