AML Compliance Guide
Log in Create Free Account

ML/TF risk assessment for Conveyancers — 2026 AUSTRAC Guide

If your conveyancing practice provides a designated service from 1 July 2026, you must prepare a written money laundering and terrorism financing risk assessment before you finalise your AML/CTF program. For conveyancers, this matters because property transactions can be used to hide criminal proceeds, obscure who really controls the buyer or seller, or move value through complex structures. If you do not do this properly, AUSTRAC can take enforcement action, civil penalties can reach $33.5 million per contravention, and intentional breaches can also attract criminal penalties.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

Your risk assessment is the document that shows where your practice is exposed and how serious those risks are. It must be in writing and it must rate risk across your customers, services, delivery channels and geography. For a conveyancer, that means looking closely at matters such as residential and commercial property transfers, off-the-plan purchases, cash-heavy transactions at settlement, buyers or sellers using trusts or companies, overseas parties, and work introduced through agents or done entirely by email or video. You must complete this assessment before finalising your AML/CTF program, because the program’s policies and controls are meant to respond to the risks you identified.

How a conveyancing practice should do it

  • List every service you provide and separate designated services from work that is not covered.
  • Map the customer types you deal with: individual buyers and sellers, companies, family trusts, SMSFs, attorneys, executors and overseas clients.
  • Rate the risk in each area: customer, service, delivery channel and geography.
  • Identify practical red flags in conveyancing work, such as unexplained urgency, use of complex ownership structures, third-party payments, or clients reluctant to disclose beneficial owners.
  • Set a clear risk rating for common matter types and record why you gave that rating.
  • Update the document whenever your business changes materially, such as starting interstate work, taking on commercial transactions, or onboarding clients remotely.

Timing rule

You do not need to wait until 31 December 2026 to start this. The risk assessment must be completed before you finalise your AML/CTF program, and the program must be finalised by 31 December 2026. If your practice becomes newly regulated on 1 July 2026, enrol with AUSTRAC by 29 July 2026, then move quickly on the risk assessment so your customer due diligence and escalation procedures are based on an actual written analysis.

For conveyancers, the most useful risk assessment is built around real file types rather than theory. A first-home buyer using an Australian bank loan and attending your office in person may sit at the lower end of your risk range. A purchase through a newly incorporated company with an overseas controller, remote instructions, changing payment directions and pressure to settle quickly is very different. Your document should explain those differences and what they trigger in practice, such as enhanced due diligence, source of funds questions, senior review or refusal to proceed. AUSTRAC guidance also expects records showing when and how ML/TF risk was reviewed, by whom, and version control when you update the document.

Common mistakes conveyancers make

  • Using a generic template that says nothing about property transfers, settlements or trust account exposure.
  • Treating all residential conveyancing files as low risk without looking at ownership structure, payment methods or who is really behind the client.
  • Ignoring beneficial ownership where the buyer or seller is a company or trust.
  • Forgetting remote onboarding risk when identity documents are provided electronically and you never meet the client.
  • Failing to revisit the assessment after adding new services, new locations or more overseas-connected work.

Keep the document usable. Build a matter-opening checklist that matches your risk assessment, with prompts for trusts, companies, source of funds, PEP checks, sanctions screening and unusual settlement arrangements. Train anyone who opens files or handles client money on the risk indicators you have identified, and keep records of that training. If a matter falls outside your normal profile, escalate it before you act. A risk assessment is not just paperwork for AUSTRAC; it should change how your office decides which conveyancing matters are straightforward, which need extra scrutiny, and which should not proceed.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I need a separate risk assessment for every conveyancing file?
No. You need a written business-level ML/TF risk assessment for your practice. That document should then drive how you assess individual matters, so your file opening and customer due diligence process reflects the risk categories you already set.
What if I only handle standard residential conveyancing in one state?
You still need a written risk assessment if you provide a designated service. A small, local practice may have a narrower risk profile than a firm doing commercial or cross-border matters, but you still need to document why your risk is lower or medium and what controls you use.
Does using PEXA or bank cheques mean my risk is automatically low?
No. Secure settlement platforms and ordinary banking channels can reduce some risks, but they do not remove customer, ownership or source of funds risk. You still need to assess who the client is, who really controls them, and whether the transaction has unusual features.
How much should this cost for a small conveyancing practice?
The law does not require you to buy expensive software or consultants to complete the risk assessment. Many small practices can prepare it internally using AUSTRAC guidance, provided it is specific to their actual conveyancing work, approved properly, and kept up to date.
If my work changes after 1 July 2026, when do I update the risk assessment?
Update it whenever the business changes materially. For a conveyancer, that could mean moving into commercial property, taking on more trust or company purchasers, expanding into interstate matters, or shifting from face-to-face onboarding to mostly remote clients.

Related guides