CC-101 · Lesson 3 · The core obligations, one screen each

A copied risk assessment describes someone else’s business

It is the most skipped-over part of the program and the one everything else rests on. A borrowed one does not just fail on its own — it makes every decision above it unsupportable.

23 September 2026 · Amanda Dunn · 4 min read

Of the six parts of an AML/CTF program, the risk assessment is the one most likely to be downloaded, lightly edited and filed. It is dry, it is abstract, and it does not feel like it changes what anybody does on Monday.

It changes everything anybody does on Monday. That is the problem with borrowing one.

What it is for

The whole framework is risk-based. It does not tell you to treat every customer identically — it tells you to work out where your exposure actually is and put your effort there.

Which means the risk assessment is where you decide what "higher risk" means in your business. Every later decision inherits that: who gets enhanced due diligence, how often files get reviewed, what your staff are told to watch for.

If the risk assessment came from somewhere else, every one of those downstream decisions is justified by a document describing a different business. The decisions might still be sensible. You just cannot explain why you made them.

What makes one actually yours

It does not need to be long. It needs to be specific about four things:

Your customers — who they really are. A suburban rental book and a firm selling waterfront to offshore buyers are not carrying the same exposure.
Your services — what you actually provide, including the things you do rarely.
Your geography — where your customers and their money come from.
Your delivery — face to face, remote, through intermediaries. How you meet people changes what you can verify.

Four honest paragraphs about your own business are worth more than forty pages about a generic one.

It is not a one-off

A risk assessment goes stale. You take on a different kind of client, you open in a new area, the market shifts, and the document is now describing a firm you used to be. It needs reviewing periodically and whenever something material changes — and the review needs evidencing, like everything else.

What an AML/CTF program is actually made of →The six parts, and how the risk assessment sits under the rest.

Where Curlew fits

Curlew builds your risk assessment from AUSTRAC’s starter kit for your sector and then makes you customise it — the structure is pre-built, the content is yours. It is version-controlled, so the reasoning behind a decision made eighteen months ago is still retrievable, and the review dates are tracked rather than diarised.

The customer risk rating you set at due diligence then drives the review schedule automatically: high risk comes back in a year, medium in two, low in three. The assessment stops being a document and starts being the thing that runs your calendar.