AML/CTF Business Risk Assessment Template – Accounting Practices (Australia)

A business risk assessment built for Australian accounting practices brought into the AML/CTF regime by the Tranche 2 reforms. It works through money laundering, terrorism financing and proliferation financing risk across your customers, designated services, delivery channels and jurisdictions, and draws on AUSTRAC's accounting program starter kit and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).

Use this template if you:

• provide professional services listed in Table 6 of the AML/CTF Act
• need a documented business risk assessment to support your AML/CTF program
• are enrolling with AUSTRAC as a newly regulated reporting entity
• want a worked starting point rather than an empty framework
• review and update your risk assessment at least every 12 months

It is suited to:

• accounting practices newly captured by the Tranche 2 reforms
• AML/CTF compliance officers preparing a first business risk assessment
• practices in a reporting group, where the assessment must extend to every reporting entity in that group
• practices willing to tailor the example risk factors to their own business

What this template covers:

• customer profile risks, including individuals, non-individual structures, third parties acting under authority, PEPs and sanctioned parties, cash-intensive businesses and vulnerable persons
• delivery channel risks across face-to-face service, remote onboarding, third-party arrangements and accepted payment methods
• jurisdiction risks, from Australian-only operations through to dealings with high-risk jurisdictions
• nineteen internal business practice risks, covering AUSTRAC enrolment and registration, policy currency, initial, ongoing and enhanced CDD failures, suspicious matter and threshold transaction reporting, tipping off, data breaches, training and personnel screening
• proliferation financing and targeted financial sanctions risk
• the eight designated services for accountants in Table 6 of subsection 6(5B) of the AML/CTF Act, from buying or selling an entity through to providing a registered office
• a four-step method of identification, likelihood and impact, risk scoring and control measures, with a matrix producing low, medium and high scores
• a jurisdiction risk rating table for more than 200 countries drawn from the Basel AML Index, FATF listings, prescribed foreign countries, DFAT sanctions and the EU high-risk list, plus registers for AUSTRAC risk products and version control

You receive an editable Excel spreadsheet with the general risk assessment already worked through: likelihood, impact, risk scores and control measures are populated for you. The accountant designated services tab arrives with risk factors, vulnerabilities and controls drafted, leaving the likelihood, impact and score cells marked [Insert] to complete, alongside version control fields such as [Insert Date], [AML/CTF Compliance Officer Name] and [Insert Next Review Date]. The risk factors are examples based on AUSTRAC guidance rather than a comprehensive list, so review and tailor them to your practice and obtain legal advice on your circumstances.