Get your free AML risk assessment.

Under section 84 of the AML/CTF Act 2006, every reporting entity must document an inherent ML/TF risk assessment across customers, products, channels and geographies — and update it regularly. It's the foundation document that justifies every other element of your AML program: a high-risk-customer policy without a risk assessment showing why those customers are high-risk is procedurally weak. AUSTRAC will ask to see your risk assessment first at any compliance assessment.

It's a risk-rating tool that produces a structured snapshot of your inherent risk profile and triggered obligations — not a regulator-issued certification (no such certification exists for SMEs). The output is suitable as a starting input for your formal AML/CTF Program risk assessment, which would then be expanded with your policies, controls, and residual risk ratings before adoption. Most matched providers will use the assessment as an input to their own onboarding rather than asking you to redo it.

Ours is independent and pre-engagement: it tells you what you're dealing with before you've picked a provider, which means you can choose a provider with the right sector and risk specialisation rather than discovering the mismatch six weeks into onboarding. Provider-run assessments are more detailed and form part of your formal program documentation, but they're scoped to the provider's tooling and inherently nudge you toward what they sell.

Your responses generate the personalised report we email back to you, and they inform the matched provider shortlist on the same email. We retain the data to track aggregate Tranche 2 trends (sector mix, risk-rating distributions) but never identify your business in any external reporting. Your details are not sold, not shared with any provider you haven't been matched to, and not added to any third-party mailing list.

Around three minutes for most users. The eight questions are deliberately structured: sector and size first (which determines which obligations apply), then customer and product risk factors (which determines the rating), then your existing capability (which determines the recommended path forward). No conditional question chains that triple the length.

Worth running if (a) your existing assessment is more than 12 months old, (b) you've added a new line of business since the last one, (c) it was prepared before the May 2026 AUSTRAC guidance updates, or (d) you're not confident the rating logic was rigorous. The CompareAML assessment will surface meaningful divergence quickly — same rating means yours holds up; different rating is a prompt to revisit.

High inherent risk is common in legal services with international clients, real estate at the prestige end, and any business handling third-party funds — it's not a problem in itself, it's a signal about the controls your program needs. The matched provider shortlist for high-risk profiles weights toward platforms with stronger transaction monitoring, enhanced CDD workflow, and configurable rule engines, rather than the simplest self-serve tools.

Yes — there's no limit on retakes, and AUSTRAC actually requires periodic reassessment as your business changes. Common triggers: opening a new office, taking on a new sector or service line, board or partner change, or a material change in your customer base. The retake takes the same 3 minutes.