You may have seen our earlier commentary on AML/CTF (Anti-Money Laundering and Counter-Terrorism Financing) and its implications for professional firms. At its core, AML/CTF is about understanding how your services could be misused for money laundering or terrorism financing and demonstrating that you have identified, assessed and managed that risk. This is not a paperwork exercise. It is a regulatory framework built on accountability and evidence.
Australia’s AML/CTF regime has applied to banks and financial institutions since 2006. From 1 July 2026, those obligations will extend to tranche 2 entities, including accountants, lawyers and other designated service providers. From that date, firms will be required to demonstrate to AUSTRAC that their compliance framework is risk-based, tailored to their business and operating in practice, not merely on paper.
As Tranche 2 approaches, many firms are focusing on policies, procedures and software solutions. Those elements matter, but they are not the starting point. The backbone of any AML/CTF program is firm-wide risk assessment. This is the document that defines how your business is actually exposed to money laundering and terrorism financing risk, based on the designated services you provide, the clients you act for, how transactions occur and where funds flow.
When the relevant talk about a “risk-based approach,” this is what they mean. AUSTRAC expects firms to demonstrate that their controls are grounded in a clear, evidence-based understanding of their risk profile. A generic or templated risk assessment may look compliant, but it will not reflect how your firm operates day-to-day. More importantly, it will not withstand regulatory scrutiny if challenged.
Recent reporting by Accountants Daily on AUSTRAC’s scrutiny of Airwallex is a timely reminder that AML/CTF risk is not confined to small or unsophisticated businesses. Even well-resourced organisations with policies, systems and compliance teams can attract regulatory attention if risk identification and controls are insufficiently robust or embedded. In practice, enforcement action is rarely about the absence of documents. It is about whether risk has been properly identified, assessed and translated into effective controls. That process starts with the firm-wide risk assessment.
(Read the article here: https://www.accountingtimes.com.au/profession/airwallex-faces-austrac-aml-ctf-scrutiny). Don’t risk your practice by not understanding your risks!
For professional firms, this is not a theoretical exercise. The firm-wide risk assessment drives proportionate customer due diligence, ongoing monitoring, staff training and reporting obligations. If the risk assessment is flawed, everything built on it is weakened. That exposes partners and directors to regulatory risk and creates ongoing inefficiencies, as firms either over-comply or fail to address genuine risk areas.
At DVT Mcleods, we approach this work differently because we are not outsiders to the regime. We provide the services ourselves and are subject to the same AML/CTF obligations as our clients. We have had to prepare, document and justify our own firm-wide risk assessment and operate within it. That experience gives us a practical understanding of where firms struggle, where AUSTRAC focuses its attention, and where real risk lies versus box-ticking compliance.
Our assessments are tailored, defensible and grounded in forensic accounting and regulatory experience. We do not rely on templates or abstract risk matrices. We examine how your firm operates and document risk in a way that supports compliance without undermining commercial reality.
For Tranche 2 Entities
If you provide designated services and are preparing for tranche 2, now is the time to get your firm-wide risk assessment right. Done properly, it becomes a practical tool that supports decision-making and protects your business. Done poorly, it becomes a liability.
For Advisors
Your clients may be underestimating the importance of the firm-wide risk assessment or assuming it can be dealt with later. It can’t. This is the foundation document. Engaging early gives your clients clarity, structure and confidence as the regime comes into force.
ACT EARLY. GET IT RIGHT FROM THE START.
Contact DVT Mcleods to discuss how we can help you prepare a firm-wide risk assessment that meets regulatory expectations and reflects how your business operates.
