Risk assessment

Understand exposure, controls and the risk that remains.

A risk assessment describes where your business could be used to launder money or finance terrorism, and how far your controls reduce that exposure. This topic separates the business-wide assessment from the rating you give each customer, because the two answer different questions.

Read the guides on the risk-based approach and on inherent and residual risk first. The guides on service, delivery channel and country risk then show the factors most small businesses weigh, and the guides on national risk assessments and financial inclusion show how to use outside information without over-reacting to it.

• Business risk assessment and customer risk

  Identify money laundering risks across your business. Connect each service and possible misuse to evidence and controls.

• Assign a customer risk rating

  Explain which customer facts support the risk rating. Keep high-risk findings and mandatory customer due diligence triggers separate.

• Assess risk in a designated service

  Describe how the work you perform can create a route for financial crime.

• Assess delivery channel risk

  Examine how customer information and instructions reach your business, and what that route means for money laundering risk.

• Country risk and specific enhanced CDD triggers

  Separate a general country risk assessment from the specific legal triggers that call for enhanced customer due diligence.

• Risk factors and mandatory CDD triggers

  A risk factor informs judgement. A legal trigger can require a specific response.

• What a risk-based approach to AML means

  A risk-based approach uses the assessed risk to select suitable AML controls. Learn how this works within Australian legal requirements.

• Inherent risk, controls and residual risk

  Inherent risk is the risk before controls. Residual risk is the risk that remains. Learn how to keep these assessments separate.

• Risk appetite and risk tolerance

  Risk appetite states the risk a business is willing to accept. Risk tolerance gives practical limits. Neither can remove an AML duty.

• Use national and sector AML risk assessments

  National and sector assessments provide wider risk evidence. Learn how to apply it to your business without copying a customer rating.

• De-risking and financial inclusion

  Blanket exclusion can prevent lawful customers from using financial services. Learn how individual risk decisions and proportionate controls differ.

• Which sectors face higher money laundering risk?

  Use Australian evidence to understand high-risk sectors. Connect the risk to your service instead of assigning every customer the same rating.