Firm-wide obligation
AML/CTF — the practice as a reporting entity
Decide capture before anything else — Nothing on this page applies until the practice provides a designated service in Table 6 of subsection 6(5B) of the AML/CTF Act with a geographical link to Australia. Map the work first and record the date the mapping was approved. The program, the due diligence and the reporting all follow from that map and from the enrolment date. This is what the practice owes, not what the client owes — Every deliverable here goes to AUSTRAC, to the practice's governing body or onto the practice's compliance file. Advising a client about its own AML obligations is practice-area work and belongs elsewhere in the catalogue. Privilege and tipping off stay with the lawyer — Section 242 preserves the law of legal professional privilege, and section 41(2)(aa) allows extra time to report where some of the information is privileged. Decide the position on each item, record the basis, and let no tool write a line of the report or of what is said to the client. Use AI where the work is a register — The captured-services map and the customer due diligence record are prescribed internal records built from documents the lawyer has already collected, and that is where a tool earns its place. The risk assessment describes this practice and must be directed by the lawyer; a sector template rated as though it were the practice's own risk is a compliance failure, not a shortcut.
Jurisdiction
Tasks
GreenLawyer reviewYellowClose supervisionRedLawyer-led
| Task | How AI is used | Human involvement | What the lawyer must review |
|---|---|---|---|
| Map the practice's work against the designated services | From the practice's matter-type list and the files opened over the last twelve months, build a row for each matter type against each item of Table 6 in subsection 6(5B) of the AML/CTF Act, extract the activity the practice actually performs in that work, and mark each row captured, not captured or unresolved with the item number it turns on. | YellowClose supervision | The principal reads every row against what the practice does on those files rather than against the matter-type label: an estate administration that sells real estate engages item 1 even though the file is called probate. Test the unresolved rows on real recent examples, because conveyancing, company formations, trust restructures and holding client funds are the rows that move. The enrolment decision and its date are the principal's, not the map's. |
| Build the practice's risk assessment and AML/CTF policies | Working from the captured-services map, the client and country profile of the practice's own files and the channels it delivers through, build the risk assessment table with the lawyer and draft the matching policies section by section against the Act's programme requirements and the AML/CTF Rules, including the conduct of and response to independent evaluations. | YellowClose supervision | The assessment must describe this practice, not the sector: check that every client type, service, channel and country in it is one the practice actually has, and that each rated risk has a control in the policies naming who does what and when. Confirm the governance section names real people who have accepted the roles in writing, and that the compliance officer has the standing to stop a file. The senior manager approves the program and the governing body records it. |
| Assemble the customer due diligence record before the service starts | From the identity documents, the company or trust extracts and the engagement papers the lawyer has collected, populate the practice's CDD record: extract names, dates of birth, addresses, ACN or ABN and the ownership and control chain from the extracts, rate the file against the fixed factors in the policies, and list every field the file holds no source for. | GreenLawyer review | Read each extracted detail against the document it came from, not against the summary: a transposed date of birth or a stale company extract is a verification failure, not a typo. The beneficial owners are the lawyer's determination — a discretionary trust, a nominee holding or an offshore layer will not resolve from an extract. Nothing is provided to the customer until the record is complete, unless the policies expressly allow it. |
| Decide and record enhanced due diligence on a higher-risk client | Assemble the indicators the file actually shows — the entity structure, the countries involved, the payment route, the pattern against the practice's risk assessment — into a comparison the lawyer works from, then draft the additional-measures section of the record to the lawyer's decision on each measure. | YellowClose supervision | The lawyer decides whether the file is higher risk and which measures apply; a rating the tool produced is an input, never the decision. Source of funds and source of wealth must be verified against documents — the client's explanation on its own is not verification. If the measures cannot be completed, the question becomes whether to act at all, and that belongs to the senior manager named in the policies. |
| Prepare the suspicious matter report | Index the file into a dated chronology of instructions, transactions, communications and documents that the practitioner reads while writing the report, list the report fields for which the file holds no source, and compare the practitioner's completed text against the file for dates, amounts, names and account details. The tool writes no part of the report. | RedLawyer-led | The suspicion is the practitioner's, formed on reasonable grounds, and the grounds must be in the practitioner's own words. Identify the deadline before anything else: 24 hours where the suspicion relates to terrorism financing and 3 business days otherwise under section 41(2), extended to 5 business days under section 41(2)(aa) where some of the information is subject to legal professional privilege. Decide the privilege position on each item before it goes into the report, and say nothing to the client about the report. |
| Decide what may be said to the client once a suspicion is reported | Assemble the material the practitioner reads before deciding — the categories of information in section 123(2), the exceptions in section 123 with the ones not yet in operation marked, the conduct rules on confidentiality, instructions and termination, and a list of everyone inside and outside the practice who has already seen the escalation. The tool writes no part of the note and proposes no wording for anything said to the client. | RedLawyer-led | The practitioner writes the note. Confirm that any exception relied on is actually in operation — AUSTRAC's guidance records that section 123(5), the exception for disclosures between reporting entities, is not yet in operation. Decide the privilege position item by item rather than over the file as a whole. Work the collision with the duty to the client through the conduct rules that apply in your jurisdiction, and take an ethics ruling if the retainer decision turns on it. |
Precedents for this area
- AML/CTF program for small legal practices: AUSTRAC legal profession starter kit adoption guide (Policy, AI use Yellow). Links to AUSTRAC's legal profession program starter kit and guides a small practice through checking suitability, customising the risk assessment, policy and process documents, approving the program, keeping it current and adding controls for AI tools.
- Designated services capture map and enrolment decision record (AML/CTF Act s 6(5B), table 6) (Form, AI use Yellow). Worksheet mapping each of the practice's matter types against the nine items in Table 6 of s 6(5B), recording whether each is captured, the activity and item it turns on, exclusions, the geographical link, and the enrolment decision.
- Initial customer due diligence checklist for law practice designated services (Checklist, AI use Green). Checklist for completing initial customer due diligence before a designated service starts: identity, beneficial owners, agents and authority, PEP and sanctions screening, nature and purpose, risk rating, enhanced measures, reliance, AI-assisted verification and records.
- AI and automated tools in the AML/CTF program: control standard (Policy, AI use Yellow). Control standard to insert into a legal practice's AML/CTF program covering e-verification, screening, document checks and generative AI: approval and validation, deepfake and synthetic document risks, human review, records, change control and tipping-off safeguards.
- Suspicious matter escalation, reporting and legal professional privilege procedure (Policy, AI use Red). Procedure from internal escalation to lodgement of a suspicious matter report: when the obligation arises, the 24-hour, 3 and 5 business day deadlines, privilege review and LPP forms, what AI may and may not do, client communications and tipping off.
- Client letter: why we need to verify your identity (AML/CTF obligations) (Letter, AI use Green). Plain-English letter explaining to new clients that Australian AML/CTF law now requires the practice to identify and verify them (and their owners or controllers) before certain work starts, what is needed, how it is checked, and how their information is handled.
All precedents for AML/CTF — the practice as a reporting entity. Signed-in accounts can read the full text.