If you’re a practicing accountant or lawyer preparing for Tranche 2, there is something critical to understand:
Your anti-money laundering compliance does not start with policies. It starts with judgement.
From 1 July 2026, any business or individual carrying on a business that provides designated services will become a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and will be regulated by AUSTRAC. Almost everything you build after that flows from one foundational document:
Your Firm-Wide Risk Assessment
If that assessment is weak, generic, or based on the wrong reasoning, your entire compliance framework becomes difficult to defend — no matter how polished your policies look.
What we are seeing across the market
We have reviewed a number of draft risk assessments across accounting and legal practices, and the same issues keep appearing.
- The first is treating the risk assessment as a template exercise. AUSTRAC starter kits are helpful, but they are not designed to reflect your specific service mix, your commercial boundaries, or the real exposure inside your practice. Regulators will not be assessing whether you filled in a template correctly. They will be assessing whether your decisions are logical, consistent and defensible.
- The second issue is confusing “we are ethical” with “we are low risk”. The regime is activity-based, not profession-based. If your firm forms entities, assists with ownership changes, manages client money, supports restructures, or facilitates business or asset sales, you are exposed to money laundering risk. That is true even if your work is entirely legitimate and conducted in good faith. Your risk assessment must reflect exposure arising from the services you provide, the types of clients you act for, the jurisdictions involved and the way services are delivered. Good intentions do not reduce financial crime risk.
- The third — and most damaging — mistake is misunderstanding inherent risk. Inherent risk is the risk that exists before controls are applied. It is not reduced because you verify identity, employ experienced staff, or have acted for a client for many years. Strong processes and verification procedures reduce residual risk. They do not change inherent risk. If this distinction is misunderstood, the entire compliance program built on top of it becomes difficult to justify.
Why this matters more than most firms realise
The Firm-Wide Risk Assessment is not a compliance form. It is your regulatory foundation.
It determines how you verify clients, when enhanced checks are required, how you monitor ongoing matters, when you escalate concerns, and what level of oversight partners or practitioners must maintain. If the reasoning in that document is generic or poorly articulated, the framework built from it will also be weak.
When supervision becomes active, the real question will be: “Explain why you assessed that risk the way you did.”
Why firms are engaging DVT Mcleods early
At DVT Mcleods, we are not theorising about Tranche 2. We are designated services providers ourselves and have completed this process within our own professional practice. We understand the commercial tension between compliance and profitability, the operational impact on staff, and what a defensible, partner-approved document must look like if it is ever reviewed.
We provide structured, objective analysis that clearly defines risk boundaries and produces board-ready documentation — not a recycled template.
Limited Spots Available
DVT Mcleods is currently accepting a limited number of firms for tailored Firm-Wide Risk Assessments ahead of the Tranche 2 commencement.
As 1 July 2026 approaches, demand for structured, defensible risk assessments will increase significantly. This work requires genuine partner involvement, careful judgement and properly documented reasoning. It cannot be rushed at the last minute.
We are deliberately limiting intake to ensure each engagement receives senior-level oversight, structured judgement and documentation that is defensible under regulatory review.
If you want your Firm-Wide Risk Assessment completed properly — before capacity tightens — contact us now to secure your place.
