--- title: "AML/CTF Risk Assessment & Proportionate Programs | Mid-Market" description: "How mid-market firms assess AML/CTF risk and build a proportionate, risk-based program under the AML/CTF Act, with practical guidance on scope, controls and the compliance officer role." lang: en-AU json-ld: | [ { "@context": "https://schema.org", "@type": [ "LegalService", "LocalBusiness" ], "@id": "https://www.astrislaw.com/#organization", "name": "Astris Law", "legalName": "Astris Law Pty Ltd", "alternateName": [ "Astrons General Counsel", "Phronesis Litigation", "HeadStart Counsel" ], "url": "https://www.astrislaw.com", "logo": { "@type": "ImageObject", "url": "https://www.astrislaw.com/android-chrome-512x512.png", "width": 512, "height": 512 }, "image": "https://www.astrislaw.com/android-chrome-512x512.png", "description": "The Astris Law group gives directors and business owners the right legal capability for whatever their business needs, across corporate, disputes and regulatory. Not more lawyers than you need, the right one for the matter. Astris Law for one senior lawyer on high-stakes work, Astrons General Counsel for an embedded legal function, Phronesis Litigation for litigation intelligence, HeadStart Counsel for AML and CTF. One group, one standard, the right fit for each need.", "foundingDate": "2023", "founder": { "@type": "Person", "@id": "https://www.astrislaw.com/attorney/jamie-nuich#person", "name": "Jamie Nuich", "jobTitle": "Legal Practitioner Director", "url": "https://www.astrislaw.com/attorney/jamie-nuich" }, "telephone": "+61735195616", "email": "mail@astrislaw.com", "contactPoint": [ { "@type": "ContactPoint", "telephone": "+61735195616", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English", "hoursAvailable": "Mo-Fr 09:00-17:00" }, { "@type": "ContactPoint", "telephone": "+61735195616", "contactType": "reservations", "name": "New matter intake", "areaServed": "AU", "availableLanguage": "English" } ], "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": 12, "bestRating": "5", "worstRating": "1" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Katherine, Director" }, "reviewBody": "Jamie is someone any entrepreneur looking to change the game needs on their side.", "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5", "worstRating": "1" } }, { "@type": "Review", "author": { "@type": "Person", "name": "Tracy, COO" }, "reviewBody": "Jamie was approachable, took the time to really understand our business, communicated well ...", "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5", "worstRating": "1" } }, { "@type": "Review", "author": { "@type": "Person", "name": "Matthew, Director" }, "reviewBody": "... very educated in her field of law ...", "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5", "worstRating": "1" } }, { "@type": "Review", "author": { "@type": "Person", "name": "Jenny, Investor" }, "reviewBody": "For anyone needing a sharp, reliable lawyer, I can't recommend Jamie enough.", "reviewRating": { "@type": "Rating", "ratingValue": "5", "bestRating": "5", "worstRating": "1" } } ], "priceRange": "$$$", "address": { "@type": "PostalAddress", "streetAddress": "Level 2, 8 Clunies Ross Court", "addressLocality": "Eight Mile Plains", "addressRegion": "QLD", "postalCode": "4113", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -27.5783, "longitude": 153.0996 }, "hasMap": "https://maps.app.goo.gl/KcW4jYe7iW7jHYHp8", "areaServed": [ { "@type": "City", "name": "Brisbane" }, { "@type": "City", "name": "Gold Coast" }, { "@type": "State", "name": "Queensland" }, { "@type": "Country", "name": "Australia" } ], "openingHoursSpecification": { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "08:30", "closes": "17:30" }, "knowsAbout": [ "Dispute Resolution & Litigation", "Insolvency & Restructuring", "Corporate & Commercial", "Employment & Workplace Relations", "Regulatory & Compliance", "Intellectual Property, Technology & Data", "Property", "Disciplinary Law", "Administrative Law & WHS", "Anti-Money Laundering (AML/CTF)", "Corporate Law", "Commercial Litigation", "Regulatory Compliance", "Financial Services Law", "Anti-Money Laundering", "FinTech Law", "Intellectual Property" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Legal services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Dispute Resolution & Litigation", "description": "Strategic commercial litigation, debt recovery, injunctions and alternative dispute resolution for directors and business owners across Australia.", "url": "https://www.astrislaw.com/practice/dispute-resolution-litigation", "provider": { "@id": "https://www.astrislaw.com/#organization" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate & Commercial", "description": "Corporate and commercial advice for directors and business owners: company structuring, M&A, shareholder agreements, commercial contracts and director duties.", "url": "https://www.astrislaw.com/commercial-lawyers-brisbane", "provider": { "@id": "https://www.astrislaw.com/#organization" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Employment & Workplace", "description": "Practical advice on Fair Work compliance, unfair dismissal, restraints of trade and workplace disputes for directors and business owners.", "url": "https://www.astrislaw.com/practice/employment-workplace-relations", "provider": { "@id": "https://www.astrislaw.com/#organization" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Regulatory & Compliance", "description": "Defending and advising on ASIC, ACCC, AUSTRAC, NDIS Commission, AHPRA and WorkCover investigations, AML/CTF programs and Australian Consumer Law compliance for regulated businesses and professionals.", "url": "https://www.astrislaw.com/practice/regulatory-compliance-consumer-law", "provider": { "@id": "https://www.astrislaw.com/#organization" } } } ] }, "member": [ { "@type": "Person", "@id": "https://www.astrislaw.com/attorney/jamie-nuich#person", "name": "Jamie Nuich", "jobTitle": "Legal Practitioner Director", "url": "https://www.astrislaw.com/attorney/jamie-nuich", "image": "https://www.astrislaw.com/images/jamie-nuich-portrait.jpg", "hasCredential": [ { "@type": "EducationalOccupationalCredential", "credentialCategory": "degree", "name": "Bachelor of Laws (Honours)" }, { "@type": "EducationalOccupationalCredential", "credentialCategory": "degree", "name": "Bachelor of Business (Distinction)" }, { "@type": "EducationalOccupationalCredential", "credentialCategory": "professional", "name": "Solicitor of the Supreme Court of Queensland" }, { "@type": "EducationalOccupationalCredential", "credentialCategory": "professional", "name": "Solicitor of the High Court of Australia" }, { "@type": "EducationalOccupationalCredential", "credentialCategory": "certification", "name": "Nationally Accredited Mediator (NMAS)" } ], "memberOf": [ { "@type": "Organization", "name": "Queensland Law Society" }, { "@type": "Organization", "name": "Australian Disputes Centre" } ], "sameAs": [ "https://www.linkedin.com/in/jamienuich/", "https://www.qls.com.au/register-of-solicitors/jamie-leanne-nuich", "https://www.youandthelaw.com.au/organisation/98611/astris-law-pty-ltd" ] } ], "sameAs": [ "https://astrons.astrislaw.com", "https://phronesis.astrislaw.com", "https://headstartcounsel.astrislaw.com", "https://www.linkedin.com/company/astris-law", "https://www.youandthelaw.com.au/organisation/98611/astris-law-pty-ltd", "https://maps.app.goo.gl/KcW4jYe7iW7jHYHp8", "https://lawzana.com/lawyer/astris-law", "https://www.gpmg.uk/awarded-companies/astris-law", "https://www.qls.com.au/register-of-solicitors/jamie-leanne-nuich", "https://www.linkedin.com/in/jamienuich/" ], "slogan": "You don't need more lawyers. You need the right one.", "subOrganization": [ { "@type": "LegalService", "@id": "https://astrons.astrislaw.com/#organization", "name": "Astrons General Counsel", "url": "https://astrons.astrislaw.com", "description": "External general counsel for established Australian businesses: embedded, partner-level legal support combining law firm depth with in-house continuity.", "parentOrganization": { "@id": "https://www.astrislaw.com/#organization" } }, { "@type": "LegalService", "name": "HeadStart Counsel", "url": "https://headstartcounsel.astrislaw.com", "description": "AML/CTF Tranche 2 compliance counsel for Australian professional services businesses.", "parentOrganization": { "@id": "https://www.astrislaw.com/#organization" } }, { "@type": "Organization", "@id": "https://phronesis.astrislaw.com/#organization", "name": "Phronesis Litigation", "url": "https://phronesis.astrislaw.com", "description": "Astris Law's in-house litigation intelligence engine: legal research at machine speed, strategy earlier and disputes run with fewer surprises.", "parentOrganization": { "@id": "https://www.astrislaw.com/#organization" } } ], "brand": [ { "@type": "Brand", "name": "Astrons General Counsel", "url": "https://astrons.astrislaw.com" }, { "@type": "Brand", "name": "Phronesis Litigation", "url": "https://phronesis.astrislaw.com" }, { "@type": "Brand", "name": "HeadStart Counsel", "url": "https://headstartcounsel.astrislaw.com" } ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://www.astrislaw.com/#website", "name": "Astris Law", "url": "https://www.astrislaw.com", "publisher": { "@id": "https://www.astrislaw.com/#organization" }, "inLanguage": "en-AU", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://www.astrislaw.com/articles?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "SiteNavigationElement", "@id": "https://www.astrislaw.com/#navigation", "name": "Main Navigation", "hasPart": [ { "@type": "WebPage", "name": "About", "url": "https://www.astrislaw.com/about" }, { "@type": "WebPage", "name": "The Group", "url": "https://www.astrislaw.com/philosophy" }, { "@type": "WebPage", "name": "Practice Areas", "url": "https://www.astrislaw.com/practice-areas" }, { "@type": "WebPage", "name": "Articles", "url": "https://www.astrislaw.com/articles" }, { "@type": "WebPage", "name": "Contact", "url": "https://www.astrislaw.com/contact" } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "WebPage", "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#webpage", "url": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program", "name": "AML/CTF Risk Assessment: Building a Proportionate Program for Mid-Market Firms", "isPartOf": { "@id": "https://www.astrislaw.com/#website" }, "mainEntity": { "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#article" }, "inLanguage": "en-AU" }, { "@type": "Article", "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#article", "headline": "AML/CTF Risk Assessment: Building a Proportionate Program for Mid-Market Firms", "description": "An AML/CTF program is only as good as the risk assessment beneath it. This article explains how a mid-market firm assesses its money laundering and terrorism financing risk and builds a program that is genuinely proportionate, meeting the AML/CTF Act without bolting on controls built for a major bank.", "image": "https://www.astrislaw.com/images/articles/boardroom-risk-assessment.jpg", "datePublished": "2026-05-13", "dateModified": "2026-05-13", "author": { "@type": "Person", "@id": "https://www.astrislaw.com/attorney/jamie-nuich#person", "name": "Jamie Nuich", "jobTitle": "Legal Practitioner Director", "url": "https://www.astrislaw.com/attorney/jamie-nuich", "sameAs": [ "https://www.linkedin.com/in/jamienuich/", "https://www.qls.com.au/register-of-solicitors/jamie-leanne-nuich", "https://www.youandthelaw.com.au/organisation/98611/astris-law-pty-ltd" ], "hasCredential": [ { "@type": "EducationalOccupationalCredential", "credentialCategory": "Professional License", "name": "Admission to Practice", "recognizedBy": { "@type": "Organization", "name": "Supreme Court of Queensland" } } ], "affiliation": { "@type": "LegalService", "@id": "https://www.astrislaw.com/#organization", "name": "Astris Law", "url": "https://www.astrislaw.com" } }, "publisher": { "@id": "https://www.astrislaw.com/#organization" }, "about": { "@type": "LegalService", "name": "Anti-Money Laundering", "serviceType": "Anti-Money Laundering" }, "mainEntityOfPage": { "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#webpage" }, "isPartOf": { "@id": "https://www.astrislaw.com/#website" }, "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ ".article-summary", ".article-description" ] }, "inLanguage": "en-AU", "wordCount": 877, "timeRequired": "PT5M", "articleSection": [ "Insights", "Anti-Money Laundering" ], "keywords": "Anti-Money Laundering, Insights, anti, money, laundering" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://www.astrislaw.com" }, { "@type": "ListItem", "position": 2, "name": "Articles", "item": "https://www.astrislaw.com/articles" }, { "@type": "ListItem", "position": 3, "name": "AML/CTF Risk Assessment: Building a Proportionate Program for Mid-Market Firms", "item": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program" } ] }, { "@type": "FAQPage", "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#faq", "mainEntity": [ { "@type": "Question", "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#faq-1", "name": "Why does the risk assessment come before the program?", "acceptedAnswer": { "@type": "Answer", "text": "Because the program exists to manage identified risk. Without an assessment, controls are guesswork. The assessment tells you where your exposure lies so the program can respond to it." } }, { "@type": "Question", "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#faq-2", "name": "What does proportionate mean in practice?", "acceptedAnswer": { "@type": "Answer", "text": "The depth of your controls should match the risk you face. A genuinely lower-risk firm can run a leaner program. Higher-risk exposure warrants more intensive measures. It is about fit, not minimum effort." } }, { "@type": "Question", "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#faq-3", "name": "What factors should a risk assessment cover?", "acceptedAnswer": { "@type": "Answer", "text": "Commonly customers, services and products, delivery channels and jurisdictions, considered together to build a reasoned picture of where the firm's risk is concentrated." } }, { "@type": "Question", "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#faq-4", "name": "Who should be responsible for the program?", "acceptedAnswer": { "@type": "Answer", "text": "A nominated AML/CTF compliance officer within the firm, a fit and proper person with the authority to oversee compliance. Diffuse responsibility tends to mean no responsibility." } }, { "@type": "Question", "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#faq-5", "name": "How often should the program be reviewed?", "acceptedAnswer": { "@type": "Answer", "text": "Regularly, and whenever the business, its customers or the law change materially. A program that is never revisited drifts out of step with the firm it is meant to protect. This is general information, not advice on your situation. If you would like help assessing your risk and building a proportionate program, get in touch or call (07) 3519 5616." } } ] }, { "@type": "HowTo", "@id": "https://www.astrislaw.com/article/aml-ctf-risk-assessment-proportionate-program#howto", "name": "AML/CTF Risk Assessment: Building a Proportionate Program for Mid-Market Firms", "description": "An AML/CTF program is only as good as the risk assessment beneath it. This article explains how a mid-market firm assesses its money laundering and terrorism financing risk and builds a program that is genuinely proportionate, meeting the AML/CTF Act without bolting on controls built for a major bank.", "step": [ { "@type": "HowToStep", "position": 1, "name": "Define the scope of the assessment", "text": "Start by identifying which of your activities are designated services, because those are what bring you within the regime and what the assessment has to cover. Mid-market firms often run a mix of activities, only some of which are designated services. Map that scope clearly and you keep the assessment focused, avoiding both gaps and wasted effort. If the Tranche 2 reforms have brought new activities within scope for your sector, include them. Those reforms commenced on 1 July 2026 and extend designated services to many professional and real estate activities, so any newly captured service belongs in the assessment." }, { "@type": "HowToStep", "position": 2, "name": "Assess risk across the key factors", "text": "A practical risk assessment weighs several factors together. The common categories are: Customer risk, which turns on the types of customers you serve, their structures and their behaviour. Service and product risk, which turns on the designated services you provide and how they could be misused. Delivery channel risk, which turns on whether you deal face to face, remotely or through intermediaries. Jurisdiction risk, which turns on the locations connected to your customers and transactions. For each factor, form a view on the level of risk and why. The goal is a reasoned, documented picture of where your exposure sits, not a number for its own sake." }, { "@type": "HowToStep", "position": 3, "name": "Design controls that match the risk", "text": "Once the risk picture is clear, design controls that respond to it. A firm with a small number of well-understood, lower-risk customers does not need the apparatus of a major bank. A firm with higher-risk exposure should invest more. Controls usually cover how you conduct customer due diligence, how you monitor transactions, how you handle higher-risk customers through enhanced measures and how you escalate and report suspicious matters. Each control should trace back to a risk in the assessment. A control that answers no identified risk is wasted effort. A risk with no control behind it is exposure." }, { "@type": "HowToStep", "position": 4, "name": "Appoint a compliance officer and train your staff", "text": "The program needs an owner. You must appoint an AML/CTF compliance officer, a fit and proper person with the authority and standing to make compliance work. The program should name that person rather than leaving responsibility diffuse. Staff also need to understand their part. Training lets the people who onboard customers and handle transactions recognise risk and know what to do when something looks wrong. A control that exists on paper but is unknown to front-line staff does not function." }, { "@type": "HowToStep", "position": 5, "name": "Review and keep the program current", "text": "Risk is not static. Customers change, services change and the law changes. The program should provide for regular review and be updated when circumstances shift. A fresh perspective from time to time helps catch drift between what the program says and what the firm actually does. For an external view of where programs fall short, our starter kit gaps report card sets out recurring weaknesses and our anti-money laundering practice page describes how we help firms close them. It reads like a bank's program despite a far smaller and simpler business. It applies the same intensive controls to every customer regardless of risk. It identifies risks that the controls never actually address. No one in the firm clearly owns it. It has not been reviewed since it was first written. Because the program exists to manage identified risk. Without an assessment, controls are guesswork. The assessment tells you where your exposure lies so the program can respond to it. The depth of your controls should match the risk you face. A genuinely lower-risk firm can run a leaner program. Higher-risk exposure warrants more intensive measures. It is about fit, not minimum effort. Commonly customers, services and products, delivery channels and jurisdictions, considered together to build a reasoned picture of where the firm's risk is concentrated. A nominated AML/CTF compliance officer within the firm, a fit and proper person with the authority to oversee compliance. Diffuse responsibility tends to mean no responsibility. Regularly, and whenever the business, its customers or the law change materially. A program that is never revisited drifts out of step with the firm it is meant to protect. This is general information, not advice on your situation. If you would like help assessing your risk and building a proportionate program, get in touch or call (07) 3519 5616." } ] } ] } ] --- [Skip to main content](#main-content) The Astris Law Group Astris Astris Law [Astrons Astrons General Counsel ](https://astrons.astrislaw.com)[Phronesis Phronesis Litigation ](https://phronesis.astrislaw.com)[HeadStart HeadStart Counsel ](https://headstartcounsel.astrislaw.com) [![Astris Law S Icon](/assets/astris-logo-icon-kBkGra_r.png)![Astris Law](/assets/astris-logo-full-wbEHTWR5.png)](/) [About](/about)[The Group](/philosophy)[Practice Areas](/practice-areas)[Articles](/articles)[Contact](/contact)[Start here](/contact) [← Back to Articles](/articles)| [Anti-Money Laundering →](/practice/anti-money-laundering) Insights 13 May 2026 • 5 min read # AML/CTF Risk Assessment: Building a Proportionate Program for Mid-Market Firms ## Summary An AML/CTF program is only as good as the risk assessment beneath it. This article explains how a mid-market firm assesses its money laundering and terrorism financing risk and builds a program that is genuinely proportionate, meeting the AML/CTF Act without bolting on controls built for a major bank. Last reviewed 13 May 2026 · Reviewed by [Jamie Nuich](/attorney/jamie-nuich), Legal Practitioner Director ## Key Takeaways - A money laundering and terrorism financing risk assessment is the foundation of the program. - The regime is risk-based, so controls should match the risk a firm actually faces. - Risk is commonly assessed across customers, services, delivery channels and jurisdictions. - The program must name a fit and proper AML/CTF compliance officer and provide for staff training. - Programs must be kept current and reviewed as the business and the law change. ![A boardroom table set for a risk assessment review, illustrating a proportionate AML/CTF program](/images/articles/boardroom-risk-assessment.jpg) In This Article 1. [1. In Brief](#in-brief) 2. [2. Step 1: Define the scope of the assessment](#step-1-define-the-scope-of-the-assessment) 3. [3. Step 2: Assess risk across the key factors](#step-2-assess-risk-across-the-key-factors) 4. [4. Step 3: Design controls that match the risk](#step-3-design-controls-that-match-the-risk) 5. [5. Step 4: Appoint a compliance officer and train your staff](#step-4-appoint-a-compliance-officer-and-train-your-staff) 6. [6. Step 5: Review and keep the program current](#step-5-review-and-keep-the-program-current) 7. [7. Signs a program is not proportionate](#signs-a-program-is-not-proportionate) 8. [8. Frequently Asked Questions](#frequently-asked-questions) An AML/CTF program is only as good as the risk assessment beneath it. This article explains how a mid-market firm assesses its money laundering and terrorism financing risk and builds a program that is genuinely proportionate, meeting the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) without bolting on controls built for a major bank. ## In Brief The risk assessment comes first. The program is built on top of it. The regime is risk-based, so fit to risk is the guiding principle. Risk is usually considered across customers, services, channels and geography. The program names who is responsible and provides for training and review. ## Step 1: Define the scope of the assessment Start by identifying which of your activities are designated services, because those are what bring you within the regime and what the assessment has to cover. Mid-market firms often run a mix of activities, only some of which are designated services. Map that scope clearly and you keep the assessment focused, avoiding both gaps and wasted effort. If the Tranche 2 reforms have brought new activities within scope for your sector, include them. Those reforms commenced on 1 July 2026 and extend designated services to many professional and real estate activities, so any newly captured service belongs in the assessment. ## Step 2: Assess risk across the key factors A practical risk assessment weighs several factors together. The common categories are: - Customer risk, which turns on the types of customers you serve, their structures and their behaviour. - Service and product risk, which turns on the designated services you provide and how they could be misused. - Delivery channel risk, which turns on whether you deal face to face, remotely or through intermediaries. - Jurisdiction risk, which turns on the locations connected to your customers and transactions. For each factor, form a view on the level of risk and why. The goal is a reasoned, documented picture of where your exposure sits, not a number for its own sake. ## Step 3: Design controls that match the risk Once the risk picture is clear, design controls that respond to it. A firm with a small number of well-understood, lower-risk customers does not need the apparatus of a major bank. A firm with higher-risk exposure should invest more. Controls usually cover how you conduct customer due diligence, how you monitor transactions, how you handle higher-risk customers through enhanced measures and how you escalate and report suspicious matters. Each control should trace back to a risk in the assessment. A control that answers no identified risk is wasted effort. A risk with no control behind it is exposure. ## Step 4: Appoint a compliance officer and train your staff The program needs an owner. You must appoint an AML/CTF compliance officer, a fit and proper person with the authority and standing to make compliance work. The program should name that person rather than leaving responsibility diffuse. Staff also need to understand their part. Training lets the people who onboard customers and handle transactions recognise risk and know what to do when something looks wrong. A control that exists on paper but is unknown to front-line staff does not function. ## Step 5: Review and keep the program current Risk is not static. Customers change, services change and the law changes. The program should provide for regular review and be updated when circumstances shift. A fresh perspective from time to time helps catch drift between what the program says and what the firm actually does. For an external view of where programs fall short, our starter kit gaps report card sets out recurring weaknesses and our [anti-money laundering practice](/practice/anti-money-laundering) page describes how we help firms close them. ## Signs a program is not proportionate - It reads like a bank's program despite a far smaller and simpler business. - It applies the same intensive controls to every customer regardless of risk. - It identifies risks that the controls never actually address. - No one in the firm clearly owns it. - It has not been reviewed since it was first written. ## Frequently Asked Questions ### Why does the risk assessment come before the program? Because the program exists to manage identified risk. Without an assessment, controls are guesswork. The assessment tells you where your exposure lies so the program can respond to it. ### What does proportionate mean in practice? The depth of your controls should match the risk you face. A genuinely lower-risk firm can run a leaner program. Higher-risk exposure warrants more intensive measures. It is about fit, not minimum effort. ### What factors should a risk assessment cover? Commonly customers, services and products, delivery channels and jurisdictions, considered together to build a reasoned picture of where the firm's risk is concentrated. ### Who should be responsible for the program? A nominated AML/CTF compliance officer within the firm, a fit and proper person with the authority to oversee compliance. Diffuse responsibility tends to mean no responsibility. ### How often should the program be reviewed? Regularly, and whenever the business, its customers or the law change materially. A program that is never revisited drifts out of step with the firm it is meant to protect. This is general information, not advice on your situation. If you would like help assessing your risk and building a proportionate program, [get in touch](/contact) or call (07) 3519 5616. ## Sources and References - Legislation Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) - Legislation Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) - Regulator AUSTRAC guidance on AML/CTF programs ![Jamie Nuich, Legal Practitioner Director at Astris Law](/images/jamie-nuich-portrait.jpg) ### [Jamie Nuich](/attorney/jamie-nuich) Legal Practitioner Director - Admitted as a Solicitor of the Supreme Court of Queensland - Admitted as a Solicitor of the High Court of Australia - 15+ years advising directors on commercial law, litigation, regulatory investigations and workplace matters Jamie is the founder and Legal Practitioner Director of Astris Law. She has acted first-hand for directors in urgent injunction applications, shareholder disputes, ASIC prosecutions and regulator-led investigations across Federal and State jurisdictions. She is a solicitor advocate who runs her own applications and trials where appropriate, so clients keep continuity from first advice through to hearing. Commercial Litigation Corporate & Commercial Regulatory & Compliance Employment & Workplace Anti-Money Laundering (AML/CTF) Disciplinary & Professional Conduct [LinkedIn](https://www.linkedin.com/in/jamienuich/)[QLS Register of Solicitors](https://www.qls.com.au/register-of-solicitors/jamie-leanne-nuich)[You and the Law directory](https://www.youandthelaw.com.au/organisation/98611/astris-law-pty-ltd)[Astris Law profile](/attorney/jamie-nuich) Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.astrislaw.com%2Farticle%2Faml-ctf-risk-assessment-proportionate-program "Share on LinkedIn")[](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.astrislaw.com%2Farticle%2Faml-ctf-risk-assessment-proportionate-program&text=AML%2FCTF%20Risk%20Assessment%3A%20Building%20a%20Proportionate%20Program%20for%20Mid-Market%20Firms "Share on X")[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.astrislaw.com%2Farticle%2Faml-ctf-risk-assessment-proportionate-program "Share on Facebook")[](mailto:?subject=AML%2FCTF%20Risk%20Assessment%3A%20Building%20a%20Proportionate%20Program%20for%20Mid-Market%20Firms&body=An%20AML%2FCTF%20program%20is%20only%20as%20good%20as%20the%20risk%20assessment%20beneath%20it.%20This%20article%20explains%20how%20a%20mid-market%20firm%20assesses%20its%20money%20laundering%20and%20terrorism%20financing%20risk%20and%20builds%20a%20program%20that%20is%20genuinely%20proportionate%2C%20meeting%20the%20AML%2FCTF%20Act%20without%20bolting%20on%20controls%20built%20for%20a%20major%20bank.%0A%0Ahttps%3A%2F%2Fwww.astrislaw.com%2Farticle%2Faml-ctf-risk-assessment-proportionate-program "Share on Email") This article is for general information purposes only and does not constitute legal advice and should not be relied on as such. While we take reasonable care to ensure the accuracy of the information provided, we make no representations or warranties as to its completeness, currency or reliability. We accept no liability for any loss or damage arising directly or indirectly from the use of, or reliance on, this website's content. You should always seek professional advice tailored to your specific circumstances before acting on any information in this article. Liability limited by a scheme approved under Professional Standards Legislation. [ Related Practice Area Anti-Money Laundering ](/practice/anti-money-laundering) ## Design a program that matches your real risk Astris Law helps mid-market firms assess their AML/CTF risk and build programs that are proportionate and defensible. To discuss your program, book a call back on (07) 3519 5616. [(07) 3519 5616](tel:+61735195616)[Send an enquiry](/contact) ## Related Articles [Insights ### AML/CTF Compliance Checklist for Small Businesses: Meeting AUSTRAC Requirements Read more](/article/aml-ctf-compliance-checklist-small-business) [Insights ### Who Must Register with AUSTRAC? A Decision Guide for Australian Business Owners Read more](/article/who-must-register-with-austrac-australia) [Insights ### Customer Due Diligence: How Australian SMEs Should Verify Client Identity Read more ](/article/customer-due-diligence-requirements-australian-sme) [![Astris Law S Icon](/assets/astris-logo-icon-kBkGra_r.png)![Astris Law](/assets/astris-logo-full-wbEHTWR5.png)](/) You don't need more lawyers. You need the right one. ### Firm - [About](/about) - [The Astris Law Group](/philosophy) - [People](/team) - [Jamie Nuich](/attorney/jamie-nuich) - [Articles](/articles) - [Resources](/resources) - [Pricing & Fees](/pricing) - [Contact](/contact) ### Services - [Dispute Resolution & Litigation](/practice/dispute-resolution-litigation) - [Corporate & Commercial](/commercial-lawyers-brisbane) - [Insolvency & Restructuring](/practice/insolvency-restructuring) - [Employment & Workplace](/practice/employment-workplace-relations) - [Regulatory & Compliance](/practice/regulatory-compliance-consumer-law) - [Intellectual Property & Tech](/practice/intellectual-property-technology-data) - [Property](/practice/property) - [Disciplinary Law](/practice/disciplinary-law) - [Administrative Law & WHS](/practice/administrative-law-whs) - [Digital Assets](/digital-assets-australia) - [Regulated Market Entry](/regulated-market-entry) - [Regulatory Investigations](/regulatory-investigations-lawyers) ### Get in Touch - [The Legal Strategy Call](/consultation) - [Refer a Client](/referrals) - [(07) 3519 5616](tel:+61735195616) - [mail@astrislaw.com](mailto:mail@astrislaw.com) - [ Astris Law Level 2, 8 Clunies Ross Court Eight Mile Plains QLD 4113 Australia ](https://maps.app.goo.gl/KcW4jYe7iW7jHYHp8) ![Astris Law - Accredited Member of Queensland Law Society](/assets/qls-member-logo-DexInE_X.png)[![Lawzana Top Law Firm](https://lawzana.com/assets/badges/verified-law-firm.svg?v=2)](https://lawzana.com/lawyer/astris-law)[![Lawyer International Legal 100 2026 Winner](/assets/lawyer-international-legal-100-2026-CflMKG1C.png)](https://www.gpmg.uk/awarded-companies/astris-law) [The Astris Law Group](/philosophy) Astris Law The Right Lawyer [Astrons General Counsel](https://astrons.astrislaw.com) The Right Legal Partner [Phronesis Litigation](https://phronesis.astrislaw.com) The Right Intelligence [HeadStart Counsel](https://headstartcounsel.astrislaw.com) The Right AML Advice © Astris Law Pty Ltd ACN 662 641 269. Astrons General Counsel, Phronesis Litigation and HeadStart Counsel are the registered trading names of Astris Law Pty Ltd. Liability limited by a scheme approved under Professional Standards Legislation. [About](/about)[Contact](/contact)[Privacy Policy](/privacy)[Collection Notice](/collection-notice)[Terms of Service](/terms)Cookie Preferences [](tel:+61735195616) Cookies on by default · [Privacy](/privacy) SettingsOK