As Australia's Tranche 2 AML/CTF reforms approach, many law firms are focusing on customer due diligence, beneficial ownership identification, ML/TF risk assessments and AUSTRAC enrolment requirements.

These are all important obligations. However, one of the greatest compliance risks facing law firms may not be whether a high-risk client was accepted. The greater risk may be an inability to explain and evidence why that decision was made.

Lawyers have long understood a simple professional principle: if it is not recorded, it did not happen. The same principle increasingly applies to AML/CTF compliance.

AUSTRAC's guidance, enrolment materials and AML/CTF toolkits help firms understand what obligations exist. However, operationalising those obligations within a legal practice requires more than completing checklists. It requires firms to demonstrate how risk-based decisions were made, who made them and why.

This issue becomes particularly important when a client triggers Enhanced Due Diligence (EDD). Many EDD decisions involve professional judgement. A client may have a complex ownership structure. There may be unusual source of funds information. A politically exposed person (PEP) may be involved. There may be a high-risk jurisdiction, unusual transaction pattern or other ML/TF risk indicator requiring additional scrutiny.

In these situations, the critical question is often not whether the client was accepted or declined. The critical question is whether the firm's reasoning process was documented.

A well-structured EDD review effectively becomes an AML file note.

It records the issues identified, the enquiries undertaken, the additional information obtained, the firm's assessment of residual risk and the reasons supporting the final decision. Most importantly, it demonstrates that the firm applied a genuine risk-based approach rather than simply ticking boxes.

This is particularly relevant where a matter is later reviewed by a regulator, auditor, compliance consultant or internal reviewer. A documented decision-making process may provide significantly greater protection than relying upon individual recollections months or years later.

The challenge for many law firms is that AML compliance does not end after onboarding. Ongoing monitoring obligations require firms to periodically review clients, risk profiles and transactional activity throughout the engagement. New information may emerge which changes the original risk assessment. Clients may move into higher-risk jurisdictions, ownership structures may change or additional risk indicators may arise.

As a result, AML compliance increasingly resembles a continuous governance process rather than a one-off onboarding exercise.

This is why many firms are beginning to focus not only on ML/TF risk assessments, beneficial ownership identification and customer due diligence, but also on how those decisions are documented and reviewed over time.

The AUSTRAC toolkits provide an important foundation for understanding these obligations. However, many law firms are now discovering that the practical challenge lies in creating a repeatable workflow that captures decision-making, evidences judgement and maintains a defensible audit trail.

For legal practitioners, AML compliance is not simply about proving that a process occurred. It is about demonstrating that the right questions were asked, the relevant risks were considered and the final decision was reasonable in the circumstances.

In many respects, the most valuable AML document in a law firm may not be the checklist itself. It may be the file note explaining why the decision was made.

As more firms begin moving from awareness toward implementation, operational workflow is becoming an increasingly important part of the AML/CTF conversation. Businesses looking to better understand the practical challenges of implementing AML compliance across day-to-day operations can also read our article: “How Small Firms Can Operationalise the AUSTRAC Toolkits”.

By Daniel Ward and Amira Ward, Commercial Lawyers and Co-founders of Flagship AML — 4 minute read.

© 2026 Flagship AML. All rights reserved. This article is for general informational purposes only and does not constitute legal advice.