Customer Risk Assessment in AML: What Businesses Need to Know

Not every customer presents the same level of risk. Some relationships are straightforward, while others may involve complex structures, unusual transactions or higher exposure to money laundering or terrorism financing risks.

This is where customer risk assessment comes in. In Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) compliance, it is the process of understanding the level of risk a customer may pose so a business can apply the right level of due diligence and monitoring from the outset.

For Australian businesses preparing for AML/CTF obligations, particularly under the Tranche 2 reforms, customer risk assessment plays a practical role in how clients are onboarded, how information is verified and when additional checks or escalation may be required.

Quick Answer: What Is Customer Risk Assessment in AML?

Customer risk assessment in AML means assessing the money laundering and terrorism financing risk associated with a specific customer or client. It is usually based on information collected during customer due diligence, including who the customer is, what service they require, where they are connected, who owns or controls them, how they will fund a transaction and whether any warning signs are present.

The purpose of a customer risk assessment is to determine the level of risk a customer presents and what level of due diligence, monitoring and controls may be appropriate. Many businesses classify customers as low, medium or high risk, while others use numerical scoring systems or more detailed risk-rating frameworks. Regardless of the approach used, the risk assessment should be documented, applied consistently and linked to appropriate customer due diligence measures.

Customer Risk Assessment vs Business-Wide AML Risk Assessment

These two terms are connected, but they are not the same.

A business-wide AML risk assessment looks at the overall ML/TF risks across your business. It considers your services, customer types, delivery channels, locations, transaction types and business model.

A customer risk assessment, on the other hand, looks at the risk of one specific customer or client.

For example, a real estate agency may identify property transactions as a higher-risk service in its business-wide risk assessment. But when a specific client comes in to buy or sell a property, the business still needs to assess that customer’s individual risk profile.

• Focus. Business-Wide AML Risk Assessment: The whole business. Customer Risk Assessment: One customer or client.
• Purpose. Business-Wide AML Risk Assessment: Understand overall ML/TF exposure. Customer Risk Assessment: Decide customer-level risk and due diligence.
• Timing. Business-Wide AML Risk Assessment: Built into the AML/CTF program. Customer Risk Assessment: During onboarding and ongoing monitoring.
• Example. Business-Wide AML Risk Assessment: Property transactions may carry higher ML/TF risk. Customer Risk Assessment: A buyer using complex offshore funds may be high risk.

Both matter. The business-wide risk assessment shapes the overall AML/CTF program, while the customer risk assessment helps apply that program in real client situations.

Why Customer Risk Assessment Matters

A business cannot apply the same level of checks to every customer and expect its AML/CTF program to work well. Some customers are simple and low risk. Others may involve complex ownership, unusual funding, foreign connections, politically exposed persons, cash-intensive activity, trust structures or transactions that do not match the customer’s profile.

Customer risk assessment helps your business answer practical questions, such as:

• Do we understand who this customer really is?
• Do we know who owns or controls this entity?
• Does the service requested make sense?
• Is the transaction consistent with the customer’s background?
• Are the funds coming from a clear and legitimate source?
• Are there any sanctions, politically exposed persons (PEPs) or adverse risk concerns?
• Should this customer receive enhanced due diligence?
• Should the matter be escalated internally?
• Should we continue, pause or decline the relationship?

For businesses like law firms, accountants, real estate agents and conveyancers, this process can be critical because many client matters involve property, companies, trusts, funds movement, high-value assets or complex ownership structures.

When Should Customer Risk Be Assessed?

Customer risk should not be assessed only once and then forgotten.

A practical AML/CTF process should assess customer risk:

• When onboarding a new customer
• Before providing a designated service
• When the customer requests a higher-risk service
• When new information becomes available
• When ownership or control changes
• When transaction behaviour changes
• When funds or wealth appear inconsistent with the customer profile
• When a customer becomes linked to higher-risk jurisdictions
• When sanctions, PEPs or adverse media concerns appear
• During ongoing customer due diligence reviews

The risk rating should change if the facts change. A customer that starts as medium risk may become high risk if new red flags appear.

Key Customer Risk Factors in AML

There is no single factor that decides customer risk on its own. A customer risk rating usually comes from several risk factors considered together.

1. Customer Type

Different customer types can carry different levels of risk.

Examples include:

• Individual clients
• Companies
• Trusts
• Partnerships
• Associations
• Charities or non-profits
• Foreign companies
• Complex corporate groups
• High-net-worth individuals
• Politically exposed persons
• Customers acting through nominees or intermediaries

A customer with a simple personal profile may be easier to assess. A customer using layered entities, trusts or offshore companies may require more work.

2. Beneficial Ownership and Control

For companies, trusts and other entities, it is not enough to know the entity name. The business needs to understand who owns or controls the customer.

Higher risk may arise when:

• Ownership is complex
• Beneficial owners are hard to identify
• Control sits with people in another country
• Nominee directors or shareholders are involved
• The structure seems unnecessarily complicated
• The customer cannot explain why the structure exists

This is especially relevant for accounting firms, law firms and trust and company service providers.

3. Service or Transaction Type

Some services can carry more money laundering/terrorism financing (ML/TF) risk than others.

Higher-risk examples may include:

• Property purchases or sales
• Company creation or restructuring
• Trust formation or management
• High-value asset transactions
• Movement or management of client funds
• Use of third-party payments
• Large or unusual transactions
• Services involving offshore entities
• Transactions with unclear commercial purpose

The service requested should make sense for the customer’s profile.

4. Geographic Risk

A customer may carry higher risk if they are connected to higher-risk foreign jurisdictions. This can include where the customer lives, where their funds come from, where beneficial owners are based or where related entities operate.

Geographic risk may be relevant when there are connections to:

• Countries with weak AML/CTF controls
• Sanctioned jurisdictions
• High corruption risk jurisdictions
• Secrecy jurisdictions
• Conflict zones
• Countries linked to higher financial crime exposure

This does not mean every foreign customer is at high risk. It means geographic connections should be assessed properly.

5. Source of Funds and Source of Wealth

Source of funds means where the money for a specific transaction comes from. Source of wealth means how the customer built their overall financial position.

These checks become more important when a customer is at higher risk or when the transaction does not match what the business knows about the customer.

Examples of concerns include:

• Funds from an unclear third party
• Funds from overseas with limited explanation
• Funds inconsistent with the customer’s occupation or business
• Sudden unexplained wealth
• Complex fund movements before a transaction
• Reluctance to explain source of funds
• Documents that do not support the customer’s explanation

For real estate, legal and accounting work, source of funds and source of wealth checks can be a major part of managing customer risk.

6. Politically Exposed Persons

A PEP may present higher ML/TF risk because of their position, influence or access to public funds. It can include a current or former senior public official, close family member or close associate. PEP status does not automatically mean the person is involved in wrongdoing, but it does mean the business should assess the risk carefully.

7. Sanctions Risk

Sanctions screening helps identify whether a customer, beneficial owner or related party may be linked to sanctions restrictions.

Meanwhile, sanctions risk should not be treated as a side issue. If a customer has sanctions exposure, the business may need to stop, escalate or seek specialist advice before providing services.

8. Customer Behaviour

Behaviour can change the customer’s risk rating.

Warning signs may include:

• Avoiding basic identity questions
• Providing inconsistent information
• Pressuring staff to move quickly
• Refusing to explain funding
• Using unnecessary intermediaries
• Changing details without clear reason
• Asking for unusual transaction structures
• Making payments from unrelated third parties
• Giving information that does not match documents
• Showing limited concern about cost or commercial logic

Keep in mind that customer behaviour should be assessed alongside documents and transaction facts.

How to Do a Customer Risk Assessment in AML

A customer risk assessment should be practical, repeatable and documented. It does not need to be overcomplicated, but it should be consistent.

Step 1: Collect Basic Customer Information

Start with the information needed to identify the customer.

This may include:

• Full name or legal entity name
• Date of birth for individuals
• Address
• ABN, ACN or other identifiers for entities
• Nature of business or occupation
• Purpose of the relationship
• Service requested
• Expected transaction or activity
• Ownership and control details
• Authorised representatives

The goal is to understand who the customer is and why they need the service.

Step 2: Identify Beneficial Owners and Controllers

For companies, trusts and other entities, identify who ultimately owns or controls the customer. This helps reduce the risk of dealing only with a front entity while missing the real person behind the relationship.

Step 3: Check Risk Indicators

Review the customer against key AML risk factors.

You may consider:

• Customer type
• Service requested
• Transaction size and structure
• Source of funds
• Source of wealth
• Geographic links
• PEP exposure
• Sanctions exposure
• Adverse information
• Beneficial ownership complexity
• Behavioural red flags

The more risk indicators present, the more likely the customer may need a higher risk rating.

Step 4: Assign a Customer Risk Rating

After reviewing the information collected, assign a customer risk rating.

Many businesses use a low, medium or high framework, while others apply numerical scoring systems, such as a 1–5 scale or internal risk categories. The key requirement is that the approach is consistent and clearly linked to the customer due diligence process.

The rating should reflect the level of money laundering and terrorism financing risk identified during customer due diligence, taking into account factors, such as the nature of the customer, the type of service, geographic exposure, ownership structure and any potential red flags.

For example, a low-risk customer might have a straightforward identity and an expected service profile with no obvious risk indicators. A medium-risk customer may involve some complexity or additional factors that require closer review within standard due diligence processes. A high-risk customer may involve higher-risk jurisdictions, complex ownership structures, unclear source of funds or other risk indicators that require enhanced due diligence and escalation.

The risk rating should always be based on verified information and documented evidence, not assumptions or guesswork.

Step 5: Apply the Right Level of Due Diligence

The customer risk rating should guide the level of checks.

A low-risk customer may only need standard customer due diligence. A high-risk customer may need enhanced due diligence, additional documents, senior approval, source of funds checks, source of wealth checks or closer monitoring.

Step 6: Document the Decision

Document why the customer received that risk rating.

Your records should explain:

• What information was collected
• What risk factors were identified
• Why the customer was rated low, medium or high
• What additional checks were applied
• Whether the matter was escalated
• Whether the business accepted, rejected or continued the relationship

This is important because AML compliance depends on being able to show the reasoning behind decisions.

Step 7: Review the Risk Rating Over Time

Customer risk assessment is not a one-time task. If new information appears, the customer’s risk rating may need to change.

For example, a customer may need review if:

• Their ownership changes
• Their transaction activity changes
• Their source of funds changes
• A new beneficial owner appears
• A sanctions or PEP issue arises
• Their behaviour becomes unusual
• Their matter becomes more complex than expected

Ongoing review helps prevent outdated customer profiles from creating compliance gaps.

How Customer Risk Assessment Connects With Your AML/CTF Program

Customer risk assessment should not sit separately from the AML/CTF program. It should connect directly with your policies, procedures, systems and controls.

A practical AML/CTF program should explain:

• How customer risk is assessed
• What information staff must collect
• What risk factors must be considered
• How low, medium and high risk are defined
• When enhanced due diligence applies
• Who approves high-risk customers
• When matters must be escalated
• How records are kept
• How customer risk is reviewed over time

This is where many businesses need support. A template may give general wording, but the customer risk assessment process must work in real client situations.

Final Thoughts

Customer risk assessment is one of the most practical parts of AML/CTF compliance. It helps a business understand who it is dealing with, what risk the customer presents and what level of due diligence and controls should apply.

For newly regulated Australian businesses, especially law firms, accountants, real estate businesses and conveyancers, this process needs to be clear, consistent,and easy for staff to apply in real client situations.

Need Help With AML Customer Risk Assessment?

One AML helps Australian businesses build practical AML/CTF processes tailored to their sector, risk profile and operational needs. This includes AML/CTF program development, ML/TF risk assessments, customer risk frameworks, due diligence processes, AML/CTF compliance officer support, staff training, AUSTRAC enrolment preparation and independent AML reviews.

If your business is preparing for AML/CTF obligations, One AML can help you turn compliance requirements into a practical system your team can actually use. Contact us today.

‍