Risk-based approach: three tiers a small firm can defend

People search “risk based approach AML Australia” when a two-partner firm has coloured three boxes on a slide and every file still follows the same steps. Checked against AUSTRAC’s page on assigning customer risk ratings on 4 October 2026. This is general information, not legal advice. This page does not reproduce that guidance. How to start the wider assessment is the AML risk assessment quick-start. The business-level assessment is the ML/TF risk assessment. The sector map is /tranche-2.

Three names only work if the work changes

A small firm can defend low, medium, and high if a reviewer can see a different measure under each name. Low might mean the standard identification and no extra question, medium might mean a source question the program already wrote, and high might mean senior-manager approval before the designated service. AUSTRAC’s risk-rating page is the frame. This page does not reproduce that method.

If every tier collects the same documents and nobody approves anything, you have one procedure and three stickers. That is harder to defend than two tiers you actually follow. The number three is not the virtue. The difference is.

• Write the trigger. What fact moves a customer from one tier to the next. “Feels higher” is not a trigger a colleague can apply on leave.
• Write the measure. The extra step is a real step: a question, an approval, or a decision not to act. A thicker folder of the same pages is not a measure.
• Keep business risk separate. The firm’s own risk assessment is a different document. Do not paste it into the customer tier to make the tier look finished.
• Review a tier when the facts change. A new service, a new country in the instructions, or a refusal to explain funds is a reason to look again. The original sticker does not freeze the file.

A three-tier card a partner can read

Use a card the other partner can apply without you. If they cannot, the tier lives in your head and the firm does not have it.

Where the three tiers stop

This page is the customer-tier card. It is not the quick-start for a risk assessment and it is not the business-level ML/TF assessment. Those are the AML risk assessment quick-start and the ML/TF risk assessment.

What the client pays

On FreeAML the firm suite is A$0. The firm emails the client a link. Verification is client-pays. On the public list a personal KYC check is A$20 and a company or trust KYB check is A$40. Use KYB when the customer is a company or a trust. Writing the three tiers is program work, and the firm suite does not include a risk rating for your customers. Confirm the live amounts on FreeAML pricing. FreeAML does not rate your customers or approve your three tiers.

Frequently Asked Questions