Client risk assessment for law firms and conveyancers: how to rate a client low, medium or high and what each rating requires

Why the rating matters

The regime does not ask you to treat every client as a suspect. It asks you to do more where the risk is higher and less where it is lower, and to be able to show why. The client risk rating is that why. Without it, enhanced due diligence has no trigger, review schedules have no basis, and an assessor has no way to see that your program is operating.

The four factor groups, for a legal practice

• Client: individual, company, trust or partnership; how hard the beneficial owners are to identify; whether the client or a close associate is a politically exposed person; behaviour (evasive about ownership, in a hurry, inconsistent, instructions through an intermediary).
• Matter: conveyancing a family home rates lower than forming entities, acting as nominee or registered office, moving funds through trust, or a business sale with unusual funding.
• Delivery channel: met in person with VOI done, or onboarded remotely; a third party funding or giving instructions; an introducer you do not know.
• Country: residence, incorporation, source and destination of funds. AUSTRAC and FATF publish lists of higher-risk jurisdictions.

A scoring approach that stays consistent

Ratings go wrong when they depend on which fee earner opened the matter. A simple score fixes that: give each factor a weight, add them up, set thresholds. The estimator on this page uses weights that work for professional practices: a trust 2, a company 1, a higher-risk jurisdiction 2 to 4, a matter over AU$750,000 1 and over AU$2 million 2, a politically exposed person 4, cash 3, remote onboarding 1, third-party involvement 2, unclear source of funds 4, no identity document sighted 2. Six or more is high, three to five medium, under three low. Your program can use different weights; what matters is that it has them, writes them down and applies them to every client on a designated matter.

What each rating requires

• Low: standard identification and verification (VOI as evidence), purpose recorded, review every 24 months or on a trigger (most conveyancing files close at settlement, so the review often never falls due).
• Medium: standard due diligence with closer attention to the purpose of the matter and the funds involved, review every 12 months.
• High: enhanced due diligence. Establish source of funds and, where relevant, source of wealth; a partner or principal approves before the service starts; monitor more closely; review every 6 months. Record every step.

Common high-risk situations in legal work

• A new client wants a company or trust set up quickly and will not say who will control it.
• Settlement or purchase funds arriving from a third party nobody mentioned, from several accounts or from overseas in tranches.
• A request to receive money into trust and pass it on with no legal service attached.
• Structures across several countries for what is described as a simple domestic transaction.
• A politically exposed person, or a close associate, in a large or unusual matter.

Politically exposed persons

A PEP holds or has held a prominent public position in Australia or overseas; the definition extends to immediate family and close associates. Foreign PEPs are high risk by default; domestic and international organisation PEPs are high risk when other factors are present. Ask the question at onboarding and screen against a PEP list if your tools allow.

When to re-rate

• A suspicious matter report about the client: the rating becomes high.
• A change in the matter, the structure, the funding or the people behind it.
• Funds arriving from an unexpected source or country.
• Information that contradicts what was collected at onboarding.
• The scheduled review, for relationships that continue.

Recording it

Keep the rating, the date, the factors and the reasons with the client's identification records for seven years after the matter or relationship ends. The annual compliance report asks how many clients were rated high risk; your files should produce that number without a hunt. In PracticeAML the rating is calculated from the answers recorded for each client, the review date is set from the rating, and every change is kept in the audit trail.