INSIGHT

Revised approach to assessing ML/TF risk

By:
insight featured image

Money Laundering / Terrorism Financing (ML/TF) risk assessment is a process of identifying, assessing, and understanding the risks of money laundering and terrorist financing (ML/TF) that an organisation may face. It involves evaluating various factors to determine the level of risk and the implementation of appropriate measures to mitigate those risks. 

ML/TF risk assessment is crucial for Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) compliance because it helps organisations develop targeted strategies to mitigate their risks effectively and efficiently allocate resources to areas with higher risks, ensuring that efforts are focused where they are most needed. 

The insights gained from risk assessments help design and implement robust AML/CTF Programs tailored to the identified risks and enable ongoing monitoring and updating of AML/CTF measures to address emerging threats. 

The risk-based approach (RBA) to AML/CTF involves tailoring measures to the specific risks identified. ML/TF risk assessments support this approach by helping to prioritise risks based on their severity and likelihood, allowing for proportionate responses, supporting the customisation of AML/CTF controls and procedures to address the specific risks identified rather than applying a one-size-fits-all approach, and allowing for dynamic adjustments to AML/CTF measures as new risks emerge or existing risks evolve. 

The Financial Action Task Force (FATF) sets international standards for ML/TF risk assessments, emphasising the importance of a risk-based approach in implementing AML/CTF measures.

The AML/CTF Rules outline the requirements for risk assessments and the risk-based approach (RBA) that reporting entities must follow. 

Conducting a risk assessment: 

Reporting entities must identify the ML/TF risks they face related to their customers, products and services, delivery channels, and geographic locations. Following this they must assess the likelihood and impact of these risks, considering factors such as the nature and complexity of their business operations. 

The risk assessment's findings must be documented, including the methodology used and the rationale for the conclusions reached. 

Implementing a risk-based approach: 

Reporting entities must implement AML/CTF controls that are proportionate to the level of risk identified. Higher-risk areas require more stringent controls. 

Reporting entities must monitor transactions and customer activities to detect and respond to suspicious behaviour. 

Risk assessments must be reviewed and updated regularly to ensure they remain effective and relevant, and any changes incorporated in the AML/CTF Program. 

The Australian AML/CTF reforms under the AML/CTF Act introduce several significant changes to risk assessment requirements: 

Expanded scope of risk assessments: 

Reporting entities must now assess not only money laundering (ML) and terrorism financing (TF) risks but also proliferation financing (PF) risks. This expansion requires entities to identify and evaluate risks associated with the financing of the proliferation of weapons of mass destruction. 

This means reporting entities will need to broaden their risk evaluation processes to include PF risks, which may require additional resources and expertise to ensure a more comprehensive understanding of all potential financial crime risks. 

Risk-based, outcomes-oriented approach: 

The reforms emphasise a shift from a compliance-based approach to a risk-based, outcomes-oriented approach, with reporting entities ‘encouraged’ to tailor their AML/CTF programs to the specific risks they face, rather than following a one-size-fits-all model. 

Enhanced governance and oversight: 

There is a greater emphasis on the role of governing bodies in overseeing the identification, mitigation and management of ML/TF/PF risk. 

The specific and increased accountability requires more robust risk management practices and a stronger culture of risk management within an organisation. 

The Australian AML/CTF Act also introduces several new requirements for assessing the ML/TF risk of a particular customer before and while providing designated services.  

Risk profiling and scoring: 

Reporting entities are required to evaluate various risk factors, such as the customer's occupation, source of funds, transaction patterns, and geographic location. Based on the assessed risk factors, they are then required to assign the customer a risk score and categorize them as low, medium, or high-risk. 

Screening for risks: 

Reporting entities must screen customers against PEP lists to identify individuals who hold or have held prominent public positions, as well as their family members and close associates before they provide them with a designated service. 

Customers must also be screened against national and international sanctions lists to ensure they are not subject to any sanctions or sanction risk. 

On a risk basis reporting entities will need to consider when they will conduct adverse media checks to identify any negative news or reports associated with the customer. 

Reporting entities may face several challenges in complying with the new risk assessment requirements: 

Data quality and availability: 

Accurate risk assessments depend on high-quality data, which may not always be available. Reporting entities may struggle to obtain reliable data, particularly for PF risks, which are less well-documented than ML/TF risks. 

Reporting entities should consider whether there is a need to invest in data management systems to ensure high-quality, accurate, and up-to-date data, including collaborating with industry partners to identify reliable data sources. 

Complexity of risk assessments: 

The expanded scope and tailored approach increase the complexity of risk assessments, and reporting entities will need to develop more sophisticated methodologies to accurately assess and mitigate a wider range of risks. 

Reporting entities should seek to simplify risk assessment processes by breaking them down into manageable steps, and leverage technology and analytical tools to streamline risk assessments and improve accuracy where possible. 

Resource allocation: 

Implementing the new risk assessment requirements may require significant investment in training, technology, and personnel. Reporting entities may find it challenging to allocate the necessary resources to comply with the enhanced requirements. 

Reporting entities could seek external support or consulting services to supplement internal resources. 

Subjectivity in risk evaluation: 

Risk assessments often involve a degree of subjectivity, which can lead to inconsistencies in how risks are evaluated and managed. Reporting entities must establish standardised criteria and processes for risk evaluation to ensure consistency and provide training and calibration sessions for staff involved in risk assessments to reduce subjectivity. 

Next steps  

To address the revised risk assessment obligations under the updated AML/CTF Act, reporting entities should follow these steps: 

1 - Understand the new requirements: 

Thoroughly review the revised AML/CTF Act and associated rules to understand the new risk assessment obligations, including the inclusion of proliferation financing (PF) risks, and use resources and guidance that is provided by AUSTRAC. 

2 - Update risk assessment framework: 

Incorporate PF risks into the existing risk assessment framework alongside ML/TF risks, and create or update methodologies for identifying, assessing, and documenting ML/TF/PF risks. 

3 - Conduct comprehensive risk assessments: 

Identify all relevant ML/TF/PF risks associated with customers, products, services, delivery channels, and geographic locations. Then evaluate the likelihood and impact of these risks, considering the nature and complexity of the business. Ensure the risk assessment process, including the rationale for risk ratings and the methodologies used, is fully documented. 

4 - Strengthen governance and oversight: 

Ensure the board and senior management are detailed aware of the ML/TF/PF risk faced, actively involved in overseeing the risk assessment processes, and appropriately involved in managing the ML/TF PF risk identified through the process. 

Civil penalty provisions 

The revised AML/CTF Act introduces new civil penalty provisions in relation to the development and maintenance of an ML/TF risk assessment, increasing the regulatory risk as a result of non-compliance. These include civil penalty provisions for commencing to provide a designated service without an ML/TF risk assessment or if its risk assessment is not up to date. 

We are here to help 

Although the new AML/CTF requirements won't be enforced until 2026, it is vital to start planning and preparing for compliance with the revised AML/CTF requirements now.  

With a short lead time to compliance and limited AML/CTF experts across Australia, demand will only continue to increase as the compliance date approaches.  

If you would like to discuss any of the above with one of our AML/CTF specialists, please reach out. 

Learn more about how our Anti-Money Laundering reforms services can help you
Visit our Anti-Money Laundering reforms page
Learn more about how our Anti-Money Laundering reforms services can help you