AML risk assessment template: customise, do not just download

A search for “aml risk assessment template” returns a document you can save and forget. The document that says what goes in the assessment — the services, the customers, the channels, the countries, and the controls — is what goes in an ML/TF risk assessment. This page is the other half: customise the template, and do not stop at the download. A heading structure you can copy into a file is the older AML risk assessment template. Use it as headings. It is not a finished assessment, and this page does not paste it again. Checked against AUSTRAC’s step 2, identify and assess your risks on 2 October 2026. This is general information, not legal advice, and it does not reproduce their method. Who must have a program is /tranche-2.

A download is the start, not the record

AUSTRAC expects a documented risk assessment of the business before you provide a designated service, and a senior manager to approve the program it sits in. A file dated the day you downloaded a template shows that you downloaded a template. It does not show that you decided which risks this firm faces, or which work you will not accept. The reviewer is looking for the edits.

Customise means the rows change

• Services. Leave out work you do not do. A conveyancer who does not form companies should not inherit a company-formation row from a generic pack. What belongs in the block is the other note.
• Customers and channels. Individuals, companies, and trusts are different rows when you see them. A remote file is a channel. Write the one you use.
• Countries. Australia is a row. An overseas client is another row, from a source you have looked up.
• Approval. Someone with authority approves the customised assessment. In a one-person practice that may be the owner. The role question is can a sole trader be their own compliance officer.

If the practice downloaded a sector starter kit, the customise steps for that kit are a different article: what you still customise in the AUSTRAC starter kit. That page is the kit. This page is any AML risk assessment template, including one that did not come from the kit. Do not file either of them unchanged.

Living risk ratings, tied to the matter

The firm assessment is the base. Each matter then carries a risk rating that has to be able to change: a new beneficial owner, a new country, a purpose that no longer matches the instruction. A PDF in a downloads folder cannot do that. FreeAML holds living risk ratings on the matters, next to the firm worksheet, so the rating the file shows is the one you last approved. When that rating means the program requires a check, the firm sends the request by email.

The FreeAML firm suite is A$0. The worksheet and the matter ratings live there. You still edit the assessment so it matches the firm, and a senior manager still approves it. FreeAML does not approve it, does not enrol the firm, and does not replace AUSTRAC’s step 2. Verification, when the program requires it, is client-pays. Amounts are on FreeAML pricing. The rating is not a fee.

Frequently Asked Questions