Low risk doesn't mean ‘good’ and high risk doesn't mean ‘bad’

One of the biggest mindset shifts businesses need to make under Tranche 2 has nothing to do with legislation. It has to do with how they interpret risk. As more businesses begin completing customer due diligence and risk assessments, we're hearing the same concern time and time again:"This client came back as high risk... does that mean we can't act for them?" or "Most of our clients are coming back as medium risk. Are we doing something wrong?". The answer to both questions is no.

A risk rating is not a pass or fail.

It is not a judgement about your client.

And it certainly isn't an instruction to decline every higher-risk matter (assuming you haven’t made the decision in your Program to preclude you from acting in these transactions).

Instead, a risk rating simply tells you how much attention the transaction deserves.

Understanding that distinction is one of the most important parts of implementing an effective AML/CTF program.

Think about it like driving a car

One of the easiest ways to understand AML risk ratings is to compare them to driving. Let’s imagine that you're driving to work…

Low risk

You're driving on a quiet suburban road on a sunny morning. The conditions are good, but you still wear your seatbelt, adjust your mirrors and obey the road rules. You don't ignore safety simply because the road looks easy.

Medium risk

Now imagine it's raining. You're driving on a busy road at night, but you're still making the same journey. However this time, the conditions have changed, so you respond appropriately. You switch on your headlights, turn on your wipers and slow down. You leave a little more space between yourself and the car in front.

High risk

Now imagine you're driving on a racetrack. Again, you're still driving a car, but the environment demands a much higher level of protection. You wear a harness instead of a standard seatbelt as well as a helmet, and your car has a roll cage.

None of these things mean driving is not possible or that you should stop. They simply reflect the level of risk involved and AML risk works exactly the same way. Higher risk doesn't mean "don't proceed." What it does mean is that you need to understand the risk, apply additional controls and document your reasoning.

What a risk rating is really telling you

One of the biggest misconceptions is that a high-risk customer is a "bad" customer. This is not what a risk assessment measures. A risk rating simply reflects the likelihood that additional scrutiny may be appropriate based on factors such as:

• The customer's circumstances or the services being provided
• The ownership structure
• Geographic connections
• Transaction characteristics
• Politically exposed person (PEP) status
• or other recognised risk indicators.

Many perfectly legitimate clients will naturally fall into a higher-risk category. Here are some examples that you may well come across in your day-to-day:

• A commercial lawyer may act for a client using a complex corporate structure involving several related entities.
• A real estate agency or conveyancing firm may assist an overseas purchaser buying Australian property.
• An accountant may establish trusts for a family with substantial assets.
• A precious metals dealer may regularly transact with high-value commercial customers.

None of these examples automatically suggest criminal activity. They simply justify asking a few more questions.

High risk means "look closer"

This is where the human element of AML compliance comes in. Software like easyAML can identify factors that increase risk, and can calculate a risk rating based on an algorithm. It can prompt you to undertake additional due diligence. What it can’t do is decide for you whether you are comfortable proceeding. That decision sits with your business.

Your role is to consider the circumstances and ask:

"Have I done enough to reasonably satisfy myself that the money laundering and terrorism financing risk has been appropriately managed?"

Sometimes the answer will come quickly. Sometimes it will require further investigation. And either outcome is perfectly acceptable.

What might Enhanced Customer Due Diligence look like?

Enhanced Customer Due Diligence (ECDD) isn't a single, fixed process. It's a collection of additional measures that you can apply where a customer presents a higher level of risk. It is important to understand that what ECDD looks like will be different each time, and that you don't need to undertake every possible check, every single time.

The appropriate response depends on the nature of the risk you've identified. For example, you might decide to:

• Ask additional questions about the purpose of the transaction
• Obtain evidence of the customer's Source of Funds (SOF) or Source of Wealth (SOW)
• Verify a customer's occupation or business activities through independent sources
• Request further information about a company's ownership structure or beneficial owners
• Obtain supporting documentation to explain unusual transaction patterns
• Increase the level of ongoing monitoring throughout the client relationship.

These are all examples of measures that may help you become comfortable that the identified risks have been appropriately addressed. The exact combination of measures will depend on your business, your AML/CTF Program and the circumstances of the individual matter.

The most important step? Document your thinking.

This is the part many businesses overlook. Completing ECDD or additional due diligence is only half the process. You also need to document why you were satisfied (or not). For example:

Perhaps your conveyancing client initially received a high-risk rating because funds were coming from overseas. After requesting additional documentation, you establish the funds came from the sale of a long-held family property and the explanation is supported by bank statements.

You've addressed the concern, and now you need to document it.

Or perhaps your law firm is acting for a company with a layered ownership structure. You obtain ASIC records, identify the beneficial owners, verify their identities and understand the commercial purpose of the structure.

Again, document it.

The same principle applies if you decide not to proceed and/or lodge a Suspicious Matter Report. Your records should clearly demonstrate:

• What elevated the customer's risk rating
• What additional information you collected
• What checks you completed
• Who reviewed the matter
• Why you were satisfied (or not satisfied)
• What decision was ultimately made.

If AUSTRAC ever reviews your business, they're unlikely to be asking why a customer received a high-risk score. They're far more interested in understanding what you did about it.

Risk ratings aren't permanent

Another important point to remember is that risk ratings are not fixed forever. A customer may initially receive a high-risk rating because of limited information, an overseas connection or a complex ownership structure. However, once you've completed appropriate ECDD and satisfied yourself that the risk has been appropriately managed, you may decide to proceed with confidence. Likewise, an initially low-risk customer may become higher risk over time if their behaviour changes or new information comes to light.

This is why ongoing monitoring is such an important part of AML compliance. Risk is something you continue to assess throughout the customer relationship.

Confidence comes from process (AUSTRAC doesn’t expect perfection)

Many businesses are nervous the first time they see a medium or high-risk customer, and that’s completely understandable. But remember that the risk rating is not telling you to stop. It's simply telling you to slow down, look more closely and apply appropriate controls. Just like driving in different conditions - the destination hasn't changed, only the precautions have.

Your safety features don't drive the car, but they DO help you drive it safely

When you buy a modern car, it comes with features like airbags, ABS brakes and lane assist. None of those systems drive the car for you, and none remove your responsibility as the driver. What they do do, though, is help you identify risks earlier, respond appropriately and make better decisions when conditions change.

That's exactly how we see easyAML.

The platform doesn't replace your judgement or make compliance decisions on your behalf. Instead, it helps you to streamline compliance and identify higher-risk matters, with guardrails to help you through additional due diligence, all the while maintaining the audit trail you'll need if your compliance is ever reviewed.

You're still in the driver's seat. We simply help make the journey safer [more compliant].

Turning risk ratings into confident decisions

At easyAML, we've designed our platform to do more than simply assign a risk score. We help businesses understand why a customer has been assessed at a particular risk level, and guide them through appropriate enhanced due diligence where required, as well as providing an end-to-end compliance solution where you can document the reasoning behind every decision.

That means you're not just identifying higher-risk matters, but that you've also got the evidence to demonstrate how you assessed them, what additional steps you took and why you were comfortable proceeding.

The takeaway here? It's not the risk rating itself that matters most. It's how your business responds to it.

Get started with easyAML for free today. There are no lock-in contracts, no credit card required and no commitments.