AML Risk Assessment for Law Firms: What to Include

A law firm can be a target for money laundering or terrorism financing risks not because of the profession itself, but because of how legal services can be used to move money, structure ownership or legitimise transactions. An Anti-Money Laundering (AML) risk assessment helps identify where those risks may arise in practice and how they should be managed before they become compliance gaps.

For Australian law firms, this has become particularly important in light of the Tranche 2 Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) reforms. From 1 July 2026, law firms that provide designated professional services will be required to have an AML/CTF program in place before they begin those services.

At its core, a risk assessment is about understanding where your practice is exposed and how that exposure is controlled in real workflows. It should reflect the way your firm actually operates, not just meet a template requirement.

What Is an AML Risk Assessment for Law Firms?

An AML risk assessment for law firms is a documented evaluation of the money laundering, terrorism financing and proliferation financing risks a legal practice may be exposed to when providing designated services.

For a law firm, this involves assessing risk across areas, such as:

• Types of legal services provided
• Client profiles
• Matter types
• Use of trusts, companies and other legal structures
• Property and high-value transactions
• Handling or movement of client funds
• Delivery methods, including remote instructions
• Exposure to foreign jurisdictions
• Complexity of beneficial ownership
• Source of funds and source of wealth considerations
• Politically exposed persons (PEPs), sanctions and adverse information
• Internal controls, staff capability and escalation pathways

The outcome of the assessment should help the firm determine where standard due diligence is sufficient, where enhanced due diligence is required and where additional controls or escalation procedures are needed.

Why Law Firms Need an AML Risk Assessment

Law firms can be attractive to criminals because legal services may be used to give transactions a sense of legitimacy. A criminal may try to use a lawyer to move funds, create a company, structure ownership, buy property, manage a trust or explain away the origin of assets.

Most clients are legitimate. The risk assessment is not about assuming clients are doing something wrong. It is about identifying where the firm could be vulnerable and building a defensible process for managing that risk.

An AML risk assessment helps a law firm:

• Understand which legal services carry higher money laundering and terrorism financing (ML/TF) risk
• Decide how client due diligence should work
• Identify high-risk client or matter scenarios
• Set clear escalation triggers
• Support AML/CTF program development
• Train staff on real risks in the firm
• Document risk decisions
• Avoid applying the same checks to every client without context
• Show senior management and the AML/CTF compliance officer where attention is needed

Without a risk assessment, the firm’s AML/CTF program can become generic. With a proper risk assessment in place, the program can reflect how the firm actually operates and the risks it genuinely faces.

AML Risk Assessment vs Client Risk Assessment

Law firms should not confuse the overall AML risk assessment with individual client risk ratings.

An AML risk assessment looks at the firm’s overall ML/TF exposure. It considers the firm’s services, clients, delivery channels, locations and operating model.

A client risk assessment, on the other hand, looks at the risk of one specific client or matter.

• Focus. AML Risk Assessment for the Firm: Whole legal practice. Client Risk Assessment: One client or matter.
• Purpose. AML Risk Assessment for the Firm: Identify overall ML/TF exposure. Client Risk Assessment: Decide client-level risk rating and due diligence.
• Timing. AML Risk Assessment for the Firm: Built into the AML/CTF program. Client Risk Assessment: During onboarding and matter review.
• Example. AML Risk Assessment for the Firm: Property and trust work may be higher risk. Client Risk Assessment: A client using offshore funds may be high risk.

Both are connected. The firm’s AML risk assessment should shape how client risk ratings are assigned.

Need help with an AML risk assessment for your law firm? Speak with One AML about practical AML/CTF program development, risk assessment and Tranche 2 readiness.

When Risk is Assessed

Customer risk assessment should not be treated as a one-off exercise. It needs to be applied at key points throughout the client lifecycle to ensure the risk rating remains accurate and relevant.

In a law firm context, risk should be assessed when a client is first onboarded and before any designated service is provided. It should also be revisited whenever there are changes to the client’s circumstances, the nature of the matter or the way instructions are being delivered.

Risk should be reassessed when new information comes to light, including changes in ownership or control, variations in transaction behaviour or when funds or assets no longer align with the client’s expected profile. It should also be updated where there are new geographic links, sanctions exposure, PEP status or adverse information identified during the engagement.

Ongoing customer due diligence reviews should also trigger reassessment where appropriate. The key principle is that the risk rating should reflect the client’s current situation, not just the information available at onboarding.

Core AML Risk Factors for Law Firms

AML risk in law firms is generally not driven by a single factor. It arises from a combination of client characteristics, matter types, financial flows and behavioural indicators. A practical risk assessment should consider these factors together rather than in isolation.

1. Legal services and matter type risks

Certain legal services may present higher exposure to money laundering or terrorism financing risks, particularly where they involve property transactions, company formations, trust arrangements or the movement of client funds. Matters that involve high-value assets, offshore structures or unclear commercial purpose may also require closer scrutiny.

2. Client and beneficial ownership risks

Risk increases where clients have complex ownership structures, use multiple entities or involve offshore companies or trusts. Difficulty identifying the ultimate beneficial owner, or situations where control does not match legal ownership, can also indicate higher risk. Clients acting through nominees or intermediaries may require additional checks.

3. Geographic risk exposure

Clients, beneficial owners or transactions connected to higher-risk jurisdictions may present increased risk. This includes links to countries with weaker AML/CTF controls, higher corruption risk, sanctions exposure or secrecy-related concerns. Geographic risk should always be considered in context rather than as an automatic indicator.

4. Source of funds and wealth concerns

Risk may be elevated where the source of funds is unclear, inconsistent with the client’s profile or involves third parties without clear explanation. Sudden unexplained wealth, complex pre-settlement fund movements,or reluctance to provide supporting documentation can also increase concern.

5. Delivery and instruction risk

How a matter is conducted can also affect risk. Remote onboarding, reliance on intermediaries, inconsistent instructions or reluctance to engage directly with the firm may increase exposure. Matters that bypass normal intake processes or move unusually quickly may require further review.

6. PEP, sanctions and adverse information

Clients, beneficial owners or related parties who are politically exposed persons, subject to sanctions or linked to adverse media should be treated as higher risk. These factors do not automatically prevent engagement but should trigger appropriate escalation and enhanced due diligence where required.

7. Behavioural risk indicators

Client behaviour can be a strong indicator of risk when viewed alongside other factors. Examples include inconsistent or incomplete information, reluctance to explain transactions, pressure to expedite matters, avoidance of standard checks or the use of unrelated third parties in payments or instructions.

How to Conduct an AML Risk Assessment for a Law Firm

A law firm risk assessment should follow a clear process. It does not need to be overly complex, but it should be documented and usable by staff.

Step 1: Map the Firm’s Practice Areas

Start by listing the firm’s main practice areas and services.

For example,

• Residential conveyancing
• Commercial property
• Corporate and commercial
• Trusts and estate planning
• Wills and probate
• Family law property settlements
• Business sales and purchases
• Litigation
• Employment law
• Immigration
• Personal injury

Then identify which services may be captured as designated services and which may sit outside the AML/CTF scope.

Step 2: Identify Inherent Risks

Inherent risk means the risk before controls are applied.

For each service area, consider:

• What clients use this service?
• What assets or transactions are involved?
• Is money or property being moved?
• Are companies, trusts or legal arrangements involved?
• Are foreign parties involved?
• Is beneficial ownership easy to identify?
• Could the service be used to hide ownership, move funds or legitimise assets?

The goal is to identify where risk exists before assuming your current processes solve it.

Step 3: Assess Likelihood and Impact

Once risks are identified, assess how likely they are and how serious the impact could be. This helps prioritise which risks require stronger controls. The method used can be simple, as long as it is applied consistently and can be clearly explained.

Step 4: Review Existing Controls

Next, identify what controls already exist.

Examples include:

• Client intake forms
• Identity verification procedures
• Matter opening checks
• Conflict checks
• Source of funds questions
• Trust account controls
• Partner approval for high-risk matters
• Staff training
• Escalation procedures
• Document retention processes
• Sanctions or PEP screening
• AML/CTF compliance officer oversight

This step helps the firm understand which risks are already partly managed and where gaps remain.

Step 5: Identify Gaps

A gap exists when the firm faces a risk but does not have a clear control for it.

Common gaps include:

• No documented client risk rating process
• No source of funds trigger
• No enhanced due diligence process
• No clear owner for AML/CTF compliance
• No high-risk matter escalation process
• No staff training records
• No process for foreign clients
• No review process for complex trusts or companies
• No documented rationale for accepting higher-risk clients

The risk assessment should lead to practical actions, not just a completed spreadsheet.

Step 6: Link the Assessment to the AML/CTF Program

The risk assessment should feed directly into the AML/CTF program.

For example, where higher-risk factors are identified, the firm’s AML/CTF program should outline the specific controls that apply in practice. Offshore clients involved in property transactions may require enhanced due diligence and source of funds checks, while complex trust structures may require beneficial ownership reviews and partner approval before proceeding.

These links between risk and response ensure that higher-risk matters are not treated the same as routine work, and that appropriate safeguards are applied consistently.

Step 7: Review and Update the Assessment

A law firm’s risk profile can change.

The risk assessment should be updated when:

• The firm adds a new practice area
• The firm starts serving new client types
• The firm expands into new jurisdictions
• New technology changes client onboarding
• Staff identify recurring red flags
• AUSTRAC releases new guidance or risk indicators
• The firm has a compliance issue or audit finding
• The AML/CTF program is independently reviewed

The risk assessment should be a living document, not a one-off file.

Final Thoughts

An AML risk assessment for law firms should be specific, practical and closely aligned with how the firm actually operates. It should clearly identify where the practice may be exposed to risk, which services or client types create higher exposure and what controls are needed to manage those risks effectively.

For Australian law firms preparing for Tranche 2 AML/CTF obligations, this is not something to leave until the final stages of implementation. The risk assessment forms the foundation of the AML/CTF program, shaping client due diligence processes, escalation pathways, staff training and the firm’s overall compliance framework.

Need Help Preparing an AML Risk Assessment?

One AML helps Australian law firms develop practical AML/CTF frameworks tailored to their services, clients and risk exposure. We can support:

• AML risk assessments
• AML/CTF program development
• Legal profession starter kit customisation
• AML/CTF compliance officer (AMLCO) support
• Customer due diligence procedures
• Client risk rating frameworks
• Source of funds and source of wealth processes
• Staff AML/CTF training
• AUSTRAC enrolment preparation
• Independent reviews and AML health checks

The goal is not to produce a document that sits unused. It is to build a risk assessment and AML/CTF program that partners, practice managers, lawyers and support staff can confidently apply in day-to-day client intake and matter handling.

Contact us today.

‍