Accountants are putting off ML/TF risk assessment

Under the Australian anti-money laundering and counter-terrorism financing laws (AML/CTF) (effective 1 July 2026), accounting practices that offer designated services are required by AUSTRAC to conduct ML/TF risk assessment and know what suspicious activity to look for with clients.

According to AUSTRAC, accountants could be vulnerable to exploitation by domestic and international criminals who may use their expertise to give the impression of respectability and legitimacy.

AUSTRAC requires accountants to evaluate risk across their client base, the types of services they offer, delivery channels of those services, and foreign jurisdiction risk.

However, Australia’s AML Readiness Report by AML compliance platform Visibl showed that while 34 per cent of the respondents surveyed rated risk assessment as their top area of concern, 18 per cent still had not completed a risk assessment, which is the mandatory first step of the entire AML/CTF compliance program.

Visibl surveyed 61 businesses, out of which 46 were accounting businesses, seven were in real estate, and three were in the legal profession.

Visibl managing director Kaan Yuksel said this lack of preparedness on risk assessment could be attributed to preoccupied accountants who have been managing multiple issues and changes, including significant tax reform proposals, the removal of merchant surcharges by the Reserve Bank of Australia, the banning of credit cards by the ATO from 2027, and Payday Super.

“I think a lot of businesses have thought they have bigger fish to fry, so to speak, relating to their commercial activities,” Yuksel told Accounting Times.

“Moreover, risk assessment is the most complex part of the regime. Outside of the four categories stated above, there’s very little guidance on what constitutes an adequate procedure. It’s not about reducing risk to nothing. It’s about managing it to an acceptable level.

“Many businesses might not understand how to carry out the risk assessment because of its complexity. But every business needs to meet this obligation. It’s the starting point to understanding the money laundering and terrorism financing risks your business might face.”

Yuksel said risk assessment is critical for accountants because criminal enterprises that are merely shell companies used for laundering money could use their registered office address, or use their accounting firm to act as a company secretary or resident director of their company.

“Your risk assessment is the foundation of your AML/CTF program. It shapes your policy, your customer checks, your staff training, and the controls you put in place,” he said.

“If it’s missing or out of date, everything built on top of it is guesswork.”

Accountants should consider a range of factors in assessing client risk when working with high-net-worth individuals who may have more complex business and financial arrangements (including offshore accounts or trust), potentially exposed persons (PEPs) due to potential exposure to fraud, bribery, corruption, and links to high-risk jurisdictions, and clients with whom have limited face-to-face interaction.

It is also critical to assess risks with clients whose business structure makes it difficult to identify the true beneficial owner, and companies operating or with major subsidiaries in high-risk jurisdictions, according to AUSTRAC.

Yuksel recommended that accountants conduct a risk assessment annually or update it every time the accounting firm has undergone a significant change.

“For example, if you decide to start service clients outside Australia, you need to consider what AML/CTF risks those jurisdictions could pose to your business,” he said.

“Similarly, if you have always serviced individual clients but start servicing companies and trusts, you would need to consider the risks they could pose.”

The Visibl survey also found that three-quarters of the respondents believe their verification of identification processes alone would satisfy their initial customer due diligence AML/CTF obligations, which is incorrect.

The report highlighted that verifying who someone is and conducting initial customer due diligence are not the same thing, even if most businesses believe this to be the case.

“A lot of the businesses that are subject to this regulation will unknowingly assume that AML is all about verifying individual client identities, when it’s a lot more than that,” Yuksel said.

“It’s also risk rating customer relationships, conducting screening on those relationships, both initially and ongoing, having compliance policies, doing due diligence on your personnel, and training your personnel. It’s a whole regime rather than a singular obligation or a singular law that’s affecting them. It changes the whole way that they operate.”