AML Risk Assessment Template for Australian Businesses (2026)

Why this matters for Tranche 2

From mid-2026, many professional-services firms must enrol with AUSTRAC and apply a risk-based AML/CTF program. A written customer risk assessment is the backbone of that program — not a one-off PDF you never open again. The obligations map is on /tranche-2.

Two assessments people confuse

1. Enterprise / ML-TF risk assessment — your firm's overall exposure (services, delivery channels, countries, customers).
2. Customer / client risk assessment — this matter and this client.

This guide focuses on the customer assessment, with a one-page starter for your firm-wide view. If you want the section list on its own page, use the AML risk assessment template. For the questions you actually ask a client, use the customer risk assessment questionnaire.

Customer risk assessment template

A. Client profile

• Full legal name, or the entity name
• ABN/ACN if it is a company
• Nature of business or occupation
• Geographic ties (Australia only, or higher-risk jurisdictions)
• Delivery channel (face-to-face, online, or via an intermediary)

B. Product and service risk

• Which designated service are you providing?
• Is it cash-intensive, complex ownership, or a rush settlement?
• Is anyone asking you to structure the matter in an unusual way?

C. Screening and CDD outcome

• Was identity verified (KYC or KYB)?
• Any PEP, sanctions, or adverse-media flags?
• For entities, were beneficial owners identified?

D. Rating

E. Decision and review date

• Accept, decline, or escalate
• Who approved the rating
• Next review date, or the event that should trigger a review

Questionnaire prompts

Use these as a starting point and tailor them to real estate, accounting, or legal work:

1. What is the purpose of this engagement?
2. How is the transaction funded?
3. Is anyone else directing or benefiting from this matter?
4. Have you been asked to move funds in unusual ways?
5. Are you a politically exposed person, or related to one?

Pair the answers with a verified identity check via /aml-check. The questionnaire captures the story. The check captures the identity evidence.

Firm-wide risk assessment (one-page starter)

Document the services you offer that are designated services, the customer types you usually see, the countries you touch, your delivery channels, and your controls (training, CDD tooling, escalation, and how often you independently review the program). Link written program materials from /compliance-docs.

Common mistakes

• Copy-pasting a UK or EU template with no AUSTRAC context
• Rating everyone low with no rationale
• Doing an ID check but never storing why you rated the risk that way
• Never reviewing the rating when ownership or purpose changes

How FreeAML fits

FreeAML does not replace your written program. It operationalises CDD evidence — remote checks, screening, and outcomes you can export — so the risk rating is backed by a file, not a memory. The guided flow is at /risk-assessment.

Frequently Asked Questions