Australian AML/CTF · Explainer

Risk appetite and risk tolerance

Risk appetite states the risk a business is willing to accept. Risk tolerance gives practical limits. Neither can remove an AML duty.

General information only, not legal, compliance, or other professional advice. Does not confirm compliance.

From a general position to a limit

Risk appetite describes the risk a business is willing to accept to meet its objectives. Risk tolerance gives practical limits for a particular risk or objective.

For example, an appetite statement can describe which services the business will provide. A tolerance can identify a limit and the action staff take at that limit.

Source: Australian Government Department of Finance: Printed pages 1 to 3; page 4 Use of this information sheet.

A general position and practical limits
  • Risk appetite

    The risk a business is willing to accept to meet its objectives.

  • Risk tolerance

    Practical limits for a particular risk or objective.

  • Legal duties

    Internal limits cannot authorise a breach of the law.

A general position and practical limits

This distinction explains business decisions. It does not impose Commonwealth administrative requirements on every small business.

Separate evidence questions. An answer to one does not settle the others.

Use the terms with their limits

The Department of Finance uses this distinction in its Comcover learning material. That material addresses Commonwealth officials and is not mandatory.

This article uses the terms to explain business decisions. It does not apply Commonwealth administration requirements or bank prudential standards to every small business.

Source: Australian Government Department of Finance: Printed pages 1 to 3; page 4 Use of this information sheet.

An internal risk appetite cannot authorise a breach of an applicable AML/CTF duty. Policies must address legal obligations as well as risk.

For example, a low internal rating does not remove a separate enhanced CDD trigger. CDD means customer due diligence.

Source: Federal Register of Legislation: Sections 26F(1)(b) and 32.

Make the decision usable

A fictional practice decides it will accept only company work whose ownership it can understand. Its policy names the evidence and approval needed for complex structures.

If staff cannot meet those conditions, they refer the request to the responsible manager. The manager examines the evidence and the applicable duties.

The policy can restrict work more than the law requires. A manager cannot approve an exception to the law.

Source: Australian Government Department of Finance: Printed page 2: boundaries, thresholds and actions.

Sources and scope

Sources checked on 2026-09-13. This page is not continuously updated. Check the linked legislation and AUSTRAC guidance for current requirements.

How we prepare articles

This page does not cover: the full conditions for each mandatory legal trigger.

Common AML/CTF terms