Start with two different questions
A business risk assessment asks how your designated services could be used for money laundering, terrorism financing or proliferation financing. A customer assessment asks how those risks apply to a particular customer and the service you will provide. Both are needed. A business document cannot establish the identity or circumstances of every future customer.
Section 26C requires a business assessment suited to the nature, size and complexity of the business. Section 28 requires you to use reasonably available customer information before starting the designated service. The customer assessment uses the business assessment to examine a particular customer and service.
Source: Federal Register of Legislation: Sections 26C(1) to (3), 28(3) to (4).
- Describe services
Identify the designated work and how it can be misused.
- Assess business risks
Consider the business-wide factors required by section 26C.
- Assess this customer
Apply relevant facts to the customer and service under section 28.
- Select the response
Apply suitable controls and any mandatory triggers.
Connect business risk to customer decisions
The business assessment informs the customer assessment. It does not replace it.
Follow the process from top to bottom.
Identify the money laundering risk categories
Section 26C lists factors for designated services provided at or through an Australian permanent establishment. Consider the services, customers, delivery channels and countries. Include new technologies and relevant risk information communicated by AUSTRAC. Read the provision for any further matters specified in the Rules.
Describe what each category means for your work. For services, ask how value could be moved or concealed. For customers, examine relevant ownership and control risks. For delivery channels, examine how instructions reach your staff. For countries, examine the connections relevant to the service.
At customer level, section 28 connects the business assessment to the particular customer and service. Invented example: an unclear company structure prompts questions about ownership and control. It does not establish that every company is high risk.
Source: Federal Register of Legislation: Sections 26C(1) to (3), 28(3) to (4).
Describe the risk before giving it a rating
AUSTRAC distinguishes inherent risk, which exists before controls are applied, from residual risk, which remains after controls. Its guidance expects the assessment to identify and assess inherent risks. Assessing residual risk is an additional option. Keeping these views separate prevents a statement such as we use identity software from hiding the risk that the software is meant to address.
Start with the designated service and the route by which it could be misused. Then consider the relevant customer types, delivery channels and countries. Include planned changes, not only last year’s work. The assessment should describe why a risk matters in this business. AUSTRAC describes approaches that can vary with business complexity. A numerical matrix is not the only possible method.
Source: AUSTRAC: Your risk assessment obligations; Focus on your inherent risks; Steps 2.1 and 2.2.
Invented example: an intermediary instructs a transfer
Service: a small practice arranges a transfer of company assets. Possible misuse: a person without authority could direct the transfer. Evidence gap: the instruction comes through an intermediary, and the practice has not established authority.
Proposed control: a staff member checks authority through a contact route established independently. The review record identifies the supporting information, result and responsible person. This is a suggested control, not a prescribed form.
Control limit: confirmation of authority does not establish the source of the assets. At customer level, the reviewer examines the actual instruction and records any separate unresolved questions. A completed authority check does not by itself permit the service.
Sources: Federal Register of Legislation: Sections 26C(1) to (3), 28(3) to (4); AUSTRAC: Your risk assessment obligations; Focus on your inherent risks; Steps 2.1 and 2.2.
- Possible misuse
An unauthorised intermediary directs company assets in this fictional example.
- Evidence question
Who authorised this instruction, and what supports that conclusion?
- Control and limit
Examine authority. This does not establish the source of the assets.
- Customer decision
Record the result and any separate unresolved questions.
From a risk statement to a testable control
Invented example. Illustrative control design. Inherent risk is assessed before controls. This diagram does not assign a risk score.
Follow the process from top to bottom.
Link each risk to a control
Ask whether a staff member can move from each material business risk to a practical customer question or control. If a risk statement says only that money laundering is possible, it does little to guide a decision. Add the service, mechanism and relevant circumstances so the statement can be tested.
Keep the customer's explanation separate from the business's assessment of it. A later reviewer should be able to see what was known, what remained uncertain and why the selected response addressed that uncertainty. This example of documentation is a working method, not a prescribed scoring model or a confirmation of compliance.
Source: Federal Register of Legislation: Sections 26C(1) to (3), 28(3) to (4).
Turn the assessment into a usable review record
A suggested working record has six fields: service, possible misuse, relevant circumstances, rating and reasons, response, and responsible person. Add an evidence reference for each material reason. If you use numerical scores, state what the numbers mean and how you deal with mandatory customer due diligence (CDD) triggers. An average score must not be used to cancel a separate legal requirement.
Before adopting a new service, walk through one fictional customer from instruction to completion. Ask which risk statement supports each check and what happens when the check fails. Record gaps as actions with an owner. This exercise tests whether the assessment can guide work. It is not an independent evaluation or a prescribed method of proving compliance.
Source: AUSTRAC: Your risk assessment obligations; Focus on your inherent risks; Steps 2.1 and 2.2.