High Risk Is a Rating, Not a Verdict. AUSTRAC's Note to the Banks Is Also a Manual for Your Riskiest Client.

Three months into the regime, most small firms have rated at least one client high. A fair number then stopped, because nobody told them what the rating was supposed to lead to. The instinct is to treat it as a verdict: high risk, so the client has to go.

On 30 September 2026 AUSTRAC published a short article that says otherwise. Its opening line: "Managing money laundering and terrorism financing (ML/TF) risk doesn't mean avoiding risk altogether." And further down: "A higher risk rating doesn't automatically require you to decline or discontinue a business relationship." (AUSTRAC, a risk-based approach to customers you assess to be higher risk (opens in a new tab))

Who the Article Is Actually For

Not you, on its face. The article is about debanking, which AUSTRAC describes as a financial institution declining, withdrawing or limiting banking services to customers in industries it considers higher risk. The affected sectors it names include remitters, virtual asset service providers and fintechs, along with some not-for-profit organisations, the sex work industry, adult stores, gun shops and some cash-intensive businesses. Its position is blunt: "We discourage the indiscriminate or widespread closure of accounts across entire sectors."

So why should an accountant, conveyancer or jeweller read it? Two reasons.

First, the principle is not a banking rule. It is the risk-based approach, and the guidance written for every reporting entity says the same thing in its own words. Second, the article contains the neatest summary AUSTRAC has published of what a defensible decision about a risky customer looks like, in either direction. That part transfers to a three person practice without much translation.

One caution before going further. The detailed recommendations on ending a relationship sit in guidance addressed to financial institutions (AUSTRAC, financial services for customers that financial institutions assess to be higher risk (opens in a new tab), updated 8 October 2026). Where this post borrows from it, it says so. Everything else below comes from guidance that applies to you directly.

The Same Rule, in the Guidance You Work Under

You must conduct enhanced CDD if a customer's ML/TF risk is high. That is one of six circumstances that require it. The enhanced CDD page then says this:

"You can still provide designated services to customers requiring enhanced CDD. However, you must have AML/CTF policies that appropriately manage and mitigate the ML/TF risk involved in providing them with a designated service." (AUSTRAC, enhanced customer due diligence (opens in a new tab), updated 15 July 2026)

The suspicious matter reports page goes a step further, to the client you have actually reported: "You don't have to end your relationship with a customer if you submit an SMR. You can continue to provide them with designated services." The condition is the same. You must appropriately mitigate or manage the risks, and that includes applying enhanced CDD. (AUSTRAC, suspicious matter reports (opens in a new tab), updated 9 September 2026)

Put together: a high rating does not close the file. It changes what the file has to contain.

If You Keep the Client

Keeping a high risk client is a decision with a price, and the price is work. AUSTRAC's SMR guidance gives examples of the controls it has in mind for high-risk customers:

• limiting the channels, services or thresholds they have access to
• increased monitoring of the customer's transactions and behaviours

For a small firm that might mean bank transfer only, no third party payers, a named partner on every instruction, or a review of the file every few months instead of when someone remembers. AUSTRAC's policy guidance lists the first of those itself: where you are exposed to high value cash, a transaction limit for physical currency, or asking customers to pay by bank transfer or EFTPOS only. (AUSTRAC, manage and mitigate your risks (opens in a new tab), updated 27 March 2026)

Enhanced CDD usually brings source of funds and source of wealth questions with it. The point is not a thicker file. The point is that the extra information either makes the risk manageable or tells you it is not.

Then there is the rating itself. The 30 September article says assessments of customer risk "should be current, evidence-based and documented." A client rated high in July on the strength of one unanswered question may not be high in October once it is answered. A client rated low by default may not be low. Either way the rating is supposed to move with the evidence, which is the whole case for doing the rating properly in the first place.

If You Cannot Manage the Risk

The same SMR page draws the other boundary: "If you can't appropriately mitigate or manage the risk, we expect you to consider whether to continue to provide designated services to the customer."

AUSTRAC expects your policies to have thought about this before the day it happens. The enhanced CDD page says your AML/CTF policies should set out how you respond to enhanced CDD findings, including what you will do if enhanced measures cannot manage and mitigate the customer's risk, and how you consider whether to continue providing designated services or end the business relationship. When unusual activity turns up during ongoing CDD, "stop providing designated services or limit providing designated services to the customer" is one of the listed next steps, alongside updating the risk rating, applying enhanced CDD, escalating to senior managers and submitting an SMR. (AUSTRAC, responding to unusual transactions and behaviour (opens in a new tab), updated 27 March 2026)

Two practical ideas from AUSTRAC's policy guidance make that exit easier to take when you need it (node 1294 (opens in a new tab)):

• updating the terms of your standard service agreement to allow you to stop providing services if a customer does not cooperate with requests for KYC information or otherwise falls outside your ML/TF risk appetite
• business rules not to offer particular services to specified kinds of high ML/TF risk customers, as a business decision not to bear the resourcing cost of managing the risk

Note what the second one is. It is a decision about what your firm is equipped to do, written down in advance. It is not a reflex applied to whoever makes the compliance officer nervous. And the first one is the reason a client who will not provide ID should never come as a contractual surprise.

Ending It Without Tipping Off

This is where firms get hurt, because the honest explanation is sometimes the one you are not allowed to give. If you decide to stop providing designated services to a customer, AUSTRAC says you must not:

• tell them you did this because of their suspicious activity
• provide information that establishes you submitted an SMR
• tell them you are required to submit an SMR

(AUSTRAC, suspicious matter reports (opens in a new tab))

What you can say is covered in the tipping off guidance. Where possible you should provide genuine reasons that do not indicate you are suspicious of the customer's conduct. Depending on your obligations and the situation, AUSTRAC's examples include:

• the general nature of the customer's activities falls outside your business's risk appetite
• the customer has failed to respond to requests for further details within a reasonable timeframe, or in a satisfactory way
• your business has decided not to fund the additional systems and controls that would be required to manage the regulatory obligations
• other reasons that show you have a commercial basis to end the relationship

(AUSTRAC, tipping off (opens in a new tab), updated 2 October 2026)

The word doing the work is "genuine". These are not scripts to hide behind. They are reasons that happen to be true and happen not to reveal a suspicion. AUSTRAC also says to document your interactions with the customer and any steps you took to reduce the risk of tipping off. Our longer guide to what you can and cannot say to clients covers the offence itself.

What the Bank Guidance Adds

The recommendations AUSTRAC gives financial institutions for ending a relationship are not addressed to Tranche 2 firms. They are still a sensible template, because they describe what a regulator considers a fair exit (node 994 (opens in a new tab)):

• Record the rationale in writing when you decline services to comply with your AML/CTF policies. AUSTRAC tells institutions it may review those records as part of its supervision.
• Give existing customers sufficient notice where possible, so they can find an alternative.
• Do not hide behind the Act. Telling a customer the decision was taken because their activities fall outside your risk appetite will generally not constitute tipping off. Citing vague "AML/CTF obligations" as the reason for refusing to give reasons may itself increase the risk of tipping off.
• Keep the decision to the individual customer. Do not extend it to associated individuals or family members without a separate risk assessment of each person.
• Do not blame AML/CTF for a commercial call. AML/CTF obligations should not be cited where the decision was principally taken on other grounds, such as reputation.

The same guidance notes that anti-discrimination legislation may also apply to decisions about whether to start, continue or stop providing designated services. "They are in a risky industry" and "they are from a risky place" are not assessments. The 30 September article lists what an individual assessment looks at: the customer and their business model, the services provided and how they are delivered, the countries involved, and the expected activities and transactions.

The Other Side of the Counter

There is a second way this article reaches small firms. Some of your clients run the kinds of businesses AUSTRAC names as affected, and some Tranche 2 businesses handle a lot of cash themselves. AUSTRAC's advice to an affected business is to communicate openly and help its financial institution understand its risks, for example by:

• explaining its legal structure and the individuals who ultimately own or control it
• describing its services in sufficient detail
• showing it understands and has met its licensing and regulatory requirements
• sharing the results of reviews of its own risk management systems, where permitted
• describing its customer types, without identifying individual customers
• indicating expected transaction volumes

If you are a reporting entity, most of that list is your AML/CTF program. AUSTRAC tells institutions they may ask a reporting entity customer about its program or request a copy, though it does not expect them to audit it. A program you actually run is something you can hand across a desk.

The File Note Either Way

Whichever way you go, the decision has to be findable later. For enhanced CDD, AUSTRAC says you must document the measures you apply, and that this may include (node 1321 (opens in a new tab)):

• the circumstances that required enhanced CDD
• why you applied specific measures
• any additional information you collected, and how you verified it
• whether you submitted an SMR about the customer
• any changes you made to the customer's ML/TF risk as a result
• decisions to apply additional measures, or to stop providing a designated service due to unacceptable risk

A version sized for a small firm:

1. Pull the list of clients you have rated high. If there are none after three months, ask whether that is a finding or a default.
2. For each one, write two lines: what makes them high, and what you are doing about it that you do not do for everyone else. If the second line is blank, that is the gap.
3. Check the rating is still right. Has the open question been answered? Has anything new appeared?
4. Read your engagement terms. Can you stop acting if a client will not cooperate with CDD or falls outside your risk appetite?
5. Decide in advance who makes the call to exit, and what gets said to the client. If an SMR is in the background, that sentence matters. An SMR does not wait for the file, and it does not wait for the exit conversation either.

Where AML Mate Fits

AML Mate screens every client against sanctions and PEP data when they are added, with re-screening on demand, and stores the results with an audit trail. For the clients who need more, a guided source of funds and source of wealth enquiry sits on the client's file and records why you asked, what the customer said, whether it was verified, and your conclusion. The audit-ready export pack puts the program, client register and those enquiries in one place for whoever asks how a decision was reached. If you want a quick read on where you stand first, the free compliance check scores your readiness across the six core obligations, no signup needed.

AUSTRAC's message to the banks was that risk is something you manage one customer at a time, with evidence, and write down. That is not a special rule for banks. It is the job description. A high rating is the start of that work, and sometimes the honest end of it is a polite, well documented goodbye.

This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.