AML/CTF reforms; ML/TF risk assessment changes

Current requirement

Changes in the AML/CTF Amendment Act 

A requirement to carry out an ML/TF risk assessment is not explicitly stated in the AML/CTF Act.

There is an express obligation to carry out an ML/TF risk assessment contained within the Amendment Act. The steps taken by a reporting entity to undertake an ML/TF risk assessment must be appropriate to the nature, size and complexity of the reporting entity's business.

An ML/TF risk assessment is required to consider the risks of money laundering and financing of terrorism.

An ML/TF risk assessment is required to consider the risks of money laundering, financing of terrorism and proliferation financing.

The AML/CTF Rules do not expressly state what should be considered as part of undertaking an ML/TF risk assessment. Instead the AML/CTF Rules lists factors that should be considered by reporting entities as part of "identifying its ML/TF risk".

The Amendment Act expressly states the factors required to be considered as part of undertaking an ML/TF risk assessment, specifically:

• the kinds of designated services provided, or proposed to be provided, by the reporting entity, including any new or emerging technologies relating to those services;
• the kinds of customers to whom the reporting entity’s designated services are or will be provided;
• the delivery channels by which the reporting entity’s designated services are or will be provided, including any new or emerging technologies relating to those delivery channels;
• the countries with which the reporting entity deals, or will deal, in providing its designated services;
• information communicated either directly or indirectly by the Australian Transaction Reports and Analysis Centre (AUSTRAC) to the reporting entity that identifies or assesses the risks associated with the reporting entity's provision of its designated services; and
• the matters (if any) specified in the AML/CTF Rules.

The AML/CTF Rules contains an obligation for the AML/CTF Program to be independently reviewed at a frequency that considers the nature, size and complexity of the reporting entity's business, and the type and level of ML/TF risk that it might face. It is implied that the ML/TF risk assessment will be reviewed as part of a review of the AML/CTF Program, though an express requirement for a review of the ML/TF risk assessment is not contained within the AML/CTF Act or AML/CTF Rules.

There is an express requirement under the Amendment Act for the ML/TF risk assessment to be continually reviewed and kept up to date.

Specifically, the Amendment Act states that the ML/TF risk assessment must be reviewed on a cyclical basis (at least every three years) as well as in response to significant changes (i.e. triggers) that relate to the ML/TF risk assessment. ML/TF risk assessment triggers include:

• where there is a significant change to the factors considered when first undertaking the ML/TF risk assessment (e.g. the kinds of services provided, the kinds of customer types etc);
• where AUSTRAC communicates information that identifies or assesses risk associated with the reporting entity's provision of designated services; and
• any circumstances specified in the AML/CTF Rules arise.

A requirement for the ML/TF risk assessment to be up to date prior to providing designated services to a customer is not contained within the AML/CTF Act.

The Amendment Act contains an express requirement for the ML/TF risk assessment to be up to date prior to providing designated services to a customer.

There is no express requirement for the governing board and senior management to have oversight of the ML/TF risk assessment within the AML/CTF Act. The AML/CTF Rules requires that the governing board and senior management of a reporting entity have oversight of, and approve, Part A of the AML/CTF Program. It is implied that this would require oversight of the ML/TF risk assessment.

The Amendment Act states that the governing body must have appropriate ongoing oversight of the identification and assessment of risks for the purposes of the ML/TF risk assessment. Further, the Amendment Act includes an express requirement for:

• any updates to the ML/TF risk assessment to be notified, in writing, to the governing body as soon as practicable after they are made; and
• the ML/TF risk assessment (including any updates) to be approved by senior management.