ML/TF/PF Risk Assessments - a practical workshop on identifying and assessing your inherent and residual risks, and your controls environment

Louise Lane, Principal, Lane Consulting & Advisory

Under the AML/CTF Act 2006 (as amended by the 2024 reforms, effective 31 March 2026) and the AML/CTF Rules 2025, every reporting entity must maintain a documented, board-endorsed enterprise-wide risk assessment (EWRA) that identifies and assesses its exposure to money laundering (ML), terrorism financing (TF) and proliferation financing (PF). For many entities, particularly those newly captured by the reforms, this is the single most consequential document in their AML/CTF program: it drives - without limitation - customer due diligence settings, transaction monitoring rules, and the allocation of compliance resourcing.

This session works through what a defensible ML/TF/PF risk assessment looks like in practice, and where AUSTRAC-reviewed assessments most commonly fall short. It draws on AUSTRAC's National Risk Assessments, FATF guidance and the ISO 31000:2018 risk management standard, translated into a practical methodology that reporting entities of varying maturity can apply and evidence.

By the end of this session, participants will be able to:

• Explain what a risk appetite statement is (and its purpose).

• Explain what a risk assessment methodology is (and its purpose).

• Explain the legal basis and regulatory expectations for an EWRA under the current AML/CTF framework.

• Distinguish inherent risk from residual risk, and apply a consistent rating methodology across customer, designated services (by product), channel and jurisdiction risk factors.

• Identify the evidentiary gaps that most commonly attract AUSTRAC scrutiny, including undocumented risk rationale and inconsistent scoring.

• Understand controls and the process of designing and testing the operation of them.

• Apply a practical, board-ready structure for presenting risk assessment findings and control uplift priorities.