The wash cycle is going digital – 
AUSTRAC’s 2026 risk snapshot highlights how technology is impacting an increasingly complex and globalised financial system

The AML/TF/PF risk assessment of every reporting entity must have regard to:

“information communicated either directly or indirectly by AUSTRAC to the reporting entity that identifies and assesses the risks associated with the reporting entity’s provision of its designated services”.

If there is a significant change to this, the ML/TF/PF risk assessment of the reporting entity must be reviewed.

All reporting entities should consider AUSTRAC’s national risk assessments as part of the ML/TF/PF risk assessment. Reporting entities should therefore be reviewing these guidance materials from AUSTRAC and considering whether their ML/TF/PF risk assessments require update in light of the new guidance.

The AML/CTF Act allows reporting entities to not have to develop PF controls if the reporting entity has assessed the PF risk that they may reasonably face is low and that those risks can be appropriately managed and mitigated by its existing policies, procedures, systems and controls.

Reporting entities should be mindful to keep its position on PF risk under review and consider whether any updates in AUSTRAC’s PF risk assessment mean that this position remains. 

For example, any entity that is engaging in virtual asset connected activity, including the use of stablecoins, should consider whether its PF risk should be reconsidered having regard to AUSTRAC’s guidance. 

Reporting entities relying on this exemption should ensure that they are considering its position on an ongoing basis, including by reference to AUSTRAC's updated guidance. This assessment should also be documented by the reporting entity.

AUSTRAC’s update references regulatory gaps as a key enabler of TF, noting certain social media and crowdfunding sites and VASPs as being out of scope of the AML/CTF regime.

While those outside of the regulatory perimeter of the AML/CTF Act are unlikely to be considering AUSTRAC’s guidance, this is relevant to any reporting entity doing business with these out of scope businesses. Any reporting entity that enables the flow of funds through these businesses identified as AUSTRAC as enablers of TF should consider this as part of its own TF risk assessment and controls.
 

As well as considering whether its ML/TF/PF risk assessment is appropriately identifying relevant risks, reporting entities must consider whether their procedures, systems and controls are appropriately responsive to this risk.

Given the focus of AUSTRAC on the use of AI to precisely target vulnerabilities, reporting entities should ensure that their systems and controls are designed with a clear understanding of how their services may be targeted by criminal actors and are able to respond accordingly.

In the context of TF, AUSTRAC highlights the rapid movement of funds as being a key enabler of TF risk as it enables funds to be able to be moved before raising suspicion. Any reporting entity involved in a payments environment should therefore be considering how its controls manage and mitigate the risks associated with its service offering such as, for example, the risk associated with near instant settlement capabilities.

In the context of professional service providers coming in scope from 1 July 2026, AUSTRAC has indicated that these sectors must take a particularly considered risk‑focused approach to assessing PF exposure and embedding appropriate controls. This is particularly where those entities have a higher risk of exposure (whether directly or indirectly) to foreign nationals, entities and transactions linked to jurisdictions of proliferation or diversion concern.