Build the practice's risk assessment and AML/CTF policies
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Working from the captured-services map, the client and country profile of the practice's own files and the channels it delivers through, build the risk assessment table with the lawyer and draft the matching policies section by section against the Act's programme requirements and the AML/CTF Rules, including the conduct of and response to independent evaluations.
- What the lawyer must review
- The assessment must describe this practice, not the sector: check that every client type, service, channel and country in it is one the practice actually has, and that each rated risk has a control in the policies naming who does what and when. Confirm the governance section names real people who have accepted the roles in writing, and that the compliance officer has the standing to stop a file. The senior manager approves the program and the governing body records it.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | Working from the captured-services map, the client and country profile of the practice's own files and the channels it delivers through, build the risk assessment table with the lawyer and draft the matching policies section by section against the Act's programme requirements and the AML/CTF Rules, including the conduct of and response to independent evaluations. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Check every client type, service, channel and country named in the assessment against the actual file list; delete the ones the practice does not have and add the ones the sample shows it does.
- Confirm each rated risk has a control that names the person, the step and the timing, not a statement that the risk is managed.
- Check the governance section names the governing body, the approving senior manager and the AML/CTF compliance officer as individuals, each with a written acceptance on file.
- Confirm the policies set out how independent evaluations are conducted and how the practice responds to adverse findings; an evaluation must occur at least once every 3 years under sections 26F(4)(f) and 116 and section 5-10 of the Rules.
- Check the reporting procedures carry the real deadlines: 24 hours for a terrorism-financing suspicion, 3 business days otherwise under section 41(2), and 10 business days for a threshold transaction under section 43(2).
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| AUSTRAC enrolment form for a reporting entity | Form | AI use Yellow | Link to AUSTRAC's enrol-a-business form in AUSTRAC Online. |
| Independent evaluation of the practice AML/CTF program | Checklist | AI use Yellow | A checklist for an independent evaluation of a legal practice AML/CTF program: who may evaluate it, what they must be given, who receives the written report, and how adverse findings are answered. |
| ML/TF risk assessment record for a legal practice | Form | AI use Red | Record of the practice's own ML/TF risk assessment under s 26C: the services, customers, channels and countries it actually has, the ratings the compliance officer gives, and the senior manager's approval. |
| First independent evaluation deadline for the practice | Checklist | AI use Yellow | A worksheet for the first independent evaluation date on AUSTRAC's transitional-rules page: the four AUSTRAC account-number patterns, and the later-of rule for an existing reporting entity. |
| Legal profession AML/CTF program review triggers | Checklist | AI use Yellow | A register of the events AUSTRAC's legal-profession maintain-and-review page says should trigger a review of the practice program, and the process or form that page names for each event. |
| Deadline to notify AUSTRAC of the AML/CTF compliance officer | Checklist | AI use Yellow | A diary for the date by which the practice notifies AUSTRAC of its AML/CTF compliance officer, using the two limbs on the transitional-rules page. |
| AML/CTF record retention schedule for the practice | Policy | AI use Yellow | Schedule of how long the practice keeps AML/CTF program records, customer due diligence records and transaction records, using the periods AUSTRAC states for ss 116, 111 and 107, and who may destroy them. |
Signed-in accounts can read the full text of each one. All precedents.
Sources
- AUSTRAC: Your AML/CTF program overview · 2026-09-27
- AUSTRAC: Step 5 — Conduct an independent evaluation · 2026-09-27
- AUSTRAC: Step 4 — Review and update your AML/CTF program · 2026-09-27
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.