Use wider evidence as an input
A national risk assessment examines threats and vulnerabilities across a country. A sector assessment focuses on a particular industry or service.
These reports help a business identify relevant risks. A sector label does not establish the risk of every customer in that sector.
Source: AUSTRAC: How the indicators can help you; National risk assessments.
Read the date and the later updates
AUSTRAC published national assessments of money laundering and terrorism financing in 2024. It also published a Money laundering update 2026.
The 2026 update discusses changes since the money laundering assessment. Read it with the earlier report. Do not present the 2024 report as current incident data.
Source: AUSTRAC: Opening paragraphs and Technological innovation and regulatory changes.
Connect the information to the service
Section 26C(3)(e) applies to services provided at or through an Australian permanent establishment. It requires regard to relevant risk information that AUSTRAC communicates.
Section 26D also requires review when AUSTRAC communicates relevant risk information. The review is due as soon as practicable after that communication.
Source: Federal Register of Legislation: Sections 26C(3)(e), 26D(1)(a)(ii) and 26D(2)(c).
Record what the report changes
A fictional practice reads a sector report about misuse of company structures. It identifies which of its services involve those structures.
The practice compares the report with its own customer information and controls. It records the report date, relevant risk, assessment decision and any required action.
If a passage does not apply, it records why. It does not give every company the same rating.
Source: AUSTRAC: How the indicators can help you.
- External finding
Read the relevant report, date and later updates.
- Business relevance
Identify how the finding relates to the services provided.
- Recorded decision
Explain what the finding changes in the business assessment.
Turn wider evidence into a business decision
National and sector findings are inputs. They do not assign a risk rating to each customer.
Follow the process from top to bottom.