Automated AML Risk Assessment — Four Dimensions, One Engine

A compliant ML/TF risk assessment must document your firm's assessment of money laundering and terrorism financing risk across four dimensions: client type risk, product and service risk, delivery channel risk, and geographic (jurisdiction) risk. Each dimension must be rated and documented with the controls you have in place to mitigate it. The residual risk after controls are applied determines the level of customer due diligence applied to each client. ClearAML's risk engine scores all four dimensions automatically and generates a documented output.

ClearAML rates each client across the four AUSTRAC-required risk dimensions: client type (individual, company, trust, SMSF), the service being delivered, the delivery channel (in-person, remote, digital), and jurisdiction risk. Each dimension receives a low, medium, or high rating. These are combined into a residual risk rating that determines whether standard CDD or enhanced due diligence (EDD) applies. Country risk profiles are built-in and updated based on FATF assessments and DFAT advisories.

The AML/CTF Act (section 26C) sets the risk factors that must be assessed — client type, service, delivery channel, and jurisdiction. ClearAML's scoring follows those dimensions consistently across every client. Allowing firms to dial down the weight on PEPs or high-risk countries would undermine the compliance purpose of the assessment. What firms can do is document their own risk appetite and controls in their AML Program, and ClearAML's questionnaire captures that context alongside the risk score.

Client risk assessments should be reviewed whenever there is a material change in the client's circumstances — new business activities, changes in ownership or control, new jurisdictions, or changes in the nature of the services provided. ClearAML triggers re-assessment reminders based on configurable review periods and flags when a client's screening results change in a way that may affect their risk rating.

ClearAML automatically triggers a risk re-assessment when: a screening check produces a new PEP or sanctions match; a client's jurisdiction changes; a new beneficial owner is added to a corporate or trust structure; or the review period set in your AML program lapses. All re-assessment events are logged in the client's audit trail with a timestamp and the reason for the review.