---
title: "Build the practice's risk assessment and AML/CTF policies"
url: "https://ailawframework.com/obligations/aml-ctf-the-practice-as-a-reporting-entity/build-the-practice-s-risk-assessment-and-aml-ctf-policies"
type: "task"
site: "AI Law Framework"
id: "A52OB-X20260927-2"
practice_area: "AML/CTF — the practice as a reporting entity"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Build the practice's risk assessment and AML/CTF policies

> Working from the captured-services map, the client and country profile of the practice's own files and the channels it delivers through, build the risk assessment table with the lawyer and draft the matching policies…

Canonical page: https://ailawframework.com/obligations/aml-ctf-the-practice-as-a-reporting-entity/build-the-practice-s-risk-assessment-and-aml-ctf-policies  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [AML/CTF — the practice as a reporting entity](https://ailawframework.com/obligations/aml-ctf-the-practice-as-a-reporting-entity.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Working from the captured-services map, the client and country profile of the practice's own files and the channels it delivers through, build the risk assessment table with the lawyer and draft the matching policies section by section against the Act's programme requirements and the AML/CTF Rules, including the conduct of and response to independent evaluations. |
| What the lawyer must review | The assessment must describe this practice, not the sector: check that every client type, service, channel and country in it is one the practice actually has, and that each rated risk has a control in the policies naming who does what and when. Confirm the governance section names real people who have accepted the roles in writing, and that the compliance officer has the standing to stop a file. The senior manager approves the program and the governing body records it. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Line-by-line review**

Review the complete output at the level of each line, paragraph or clause; check facts, meaning and omissions.

- What the AI does: Working from the captured-services map, the client and country profile of the practice's own files and the channels it delivers through, build the risk assessment table with the lawyer and draft the matching policies section by section against the Act's programme requirements and the AML/CTF Rules, including the conduct of and response to independent evaluations.
- What the lawyer does: The assessment must describe this practice, not the sector: check that every client type, service, channel and country in it is one the practice actually has, and that each rated risk has a control in the policies naming who does what and when. Confirm the governance section names real people who have accepted the roles in writing, and that the compliance officer has the standing to stop a file. The senior manager approves the program and the governing body records it.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Check every client type, service, channel and country named in the assessment against the actual file list; delete the ones the practice does not have and add the ones the sample shows it does.
2. Confirm each rated risk has a control that names the person, the step and the timing, not a statement that the risk is managed.
3. Check the governance section names the governing body, the approving senior manager and the AML/CTF compliance officer as individuals, each with a written acceptance on file.
4. Confirm the policies set out how independent evaluations are conducted and how the practice responds to adverse findings; an evaluation must occur at least once every 3 years under sections 26F(4)(f) and 116 and section 5-10 of the Rules.
5. Check the reporting procedures carry the real deadlines: 24 hours for a terrorism-financing suspicion, 3 business days otherwise under section 41(2), and 10 business days for a threshold transaction under section 43(2).

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [AUSTRAC: Your AML/CTF program overview](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/your-amlctf-program-overview) (checked 2026-09-27)
- [AUSTRAC: Step 5 — Conduct an independent evaluation](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/step-5-conduct-independent-evaluation) (checked 2026-09-27)
- [AUSTRAC: Step 4 — Review and update your AML/CTF program](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/step-4-review-and-update-your-amlctf-program) (checked 2026-09-27)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [AUSTRAC enrolment form for a reporting entity](https://ailawframework.com/precedents/aml-ctf-the-practice-as-a-reporting-entity/form-austrac-enrol-business.md) | Form | Yellow | Link to AUSTRAC's enrol-a-business form in AUSTRAC Online. A business that provides a designated service with a geographical link to Australia must enrol. |
| [Independent evaluation of the practice AML/CTF program](https://ailawframework.com/precedents/aml-ctf-the-practice-as-a-reporting-entity/independent-evaluation-preparation.md) | Checklist | Yellow | A checklist for an independent evaluation of a legal practice AML/CTF program: who may evaluate it, what they must be given, who receives the written report, and how adverse findings are answered. |
| [ML/TF risk assessment record for a legal practice](https://ailawframework.com/precedents/aml-ctf-the-practice-as-a-reporting-entity/mltf-risk-assessment-record.md) | Form | Red | Record of the practice's own ML/TF risk assessment under s 26C: the services, customers, channels and countries it actually has, the ratings the compliance officer gives, and the senior manager's… |
| [First independent evaluation deadline for the practice](https://ailawframework.com/precedents/aml-ctf-the-practice-as-a-reporting-entity/first-independent-evaluation-deadline.md) | Checklist | Yellow | A worksheet for the first independent evaluation date on AUSTRAC's transitional-rules page: the four AUSTRAC account-number patterns, and the later-of rule for an existing reporting entity. |
| [Legal profession AML/CTF program review triggers](https://ailawframework.com/precedents/aml-ctf-the-practice-as-a-reporting-entity/program-review-trigger-register.md) | Checklist | Yellow | A register of the events AUSTRAC's legal-profession maintain-and-review page says should trigger a review of the practice program, and the process or form that page names for each event. |
| [Deadline to notify AUSTRAC of the AML/CTF compliance officer](https://ailawframework.com/precedents/aml-ctf-the-practice-as-a-reporting-entity/compliance-officer-notification-deadline.md) | Checklist | Yellow | A diary for the date by which the practice notifies AUSTRAC of its AML/CTF compliance officer, using the two limbs on the transitional-rules page. |
| [AML/CTF record retention schedule for the practice](https://ailawframework.com/precedents/aml-ctf-the-practice-as-a-reporting-entity/aml-record-retention-schedule.md) | Policy | Yellow | Schedule of how long the practice keeps AML/CTF program records, customer due diligence records and transaction records, using the periods AUSTRAC states for ss 116, 111 and 107, and who may destroy… |

Signed-in accounts can read the full text of each one.

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/obligations/aml-ctf-the-practice-as-a-reporting-entity/build-the-practice-s-risk-assessment-and-aml-ctf-policies/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*