AML/CTF compliance in Law App: KYC, risk ratings and VOI

From 1 July 2026, Australian law firms have AML/CTF obligations for the first time. Law App builds AML/CTF compliance into your normal file and contact workflow — flagging the matters that are caught, verifying client identity, assessing each client’s risk, and keeping the records the law requires. This guide walks through how the whole process fits together.

Setting up AML/CTF compliance on a matter

AML/CTF obligations only apply to matters that involve a designated service under the new legislation, so Law App doesn’t apply the requirements to every file — only the ones you flag. You set this on a new file, or at any time on an existing file’s Details tab.

Verifying identity and KYC — the Identity & AML tab

Identity verification happens on the contact, not on the file. Open the client in the Contacts area and go to their Identity & AML tab — this is where you complete and track everything the legislation requires for that person or organisation: the Know Your Customer questionnaire, the calculated risk rating, identity verification (VOI), and the review schedule.

Completing the KYC questionnaire

The questionnaire adjusts depending on whether the contact is an individual or an organisation. It captures PEP (politically exposed person) status, source of wealth and funds, and occupation — and, for organisations, entity type, country of registration and industry. Once it’s answered, Law App calculates the risk rating for you; you don’t score it manually.

How the risk rating is worked out

The rating is calculated from the KYC answers and shown as Low, Medium or High. Until the questionnaire is completed, the contact shows as Not assessed.

For an individual:

• High — a domestic, foreign or international-organisation PEP, or 3 or more risk questions answered “Yes”.
• Medium — a family member or close associate of a PEP, or 1–2 “Yes” answers.
• Low — not a PEP, with no risk flags.

For an organisation (the PEP question doesn’t apply):

• High — 3 or more “Yes” answers.
• Medium — 1–2 “Yes” answers.
• Low — no “Yes” answers.

If your professional judgement differs from the calculated rating, you can override it. A reason is mandatory and is recorded against the contact for your audit trail.

Periodic review dates

Law App schedules the next review date automatically, based on the risk rating:

• Low risk — review every 3 years.
• Medium risk — review every 2 years.
• High risk — review every year.

Identity verification (VOI)

The Identity & AML tab is also where you manage identity verification — both documents captured in person and electronic VOI checks run through InfoTrack. For AML you use InfoTrack for identity verification and for ASIC or other company and person searches; you don’t need to go beyond that for AML purposes.

Running your AML searches from Law App

Run your identity, ASIC and other searches from inside Law App rather than going direct to InfoTrack. Law App handles the day-to-day AML tracking for you, which is what keeps your records — and your firm’s AML policies — in order.

Understanding AML status — Required, Review and OK

Every contact and matter shows a live AML status. Here’s exactly what each one means:

• OK — all three conditions are met: a current (non-expired) VOI or ID document is on file, the KYC questionnaire is completed, and the next review date is set and still in the future.
• Review — the contact is compliant, but a review is due within 30 days, or a VOI document is expiring within 30 days. The alert tells you which of these is the reason.
• Required — one or more of those three conditions is missing: no valid VOI, KYC not completed, or the review date is overdue or not set.
• Not assessed — the KYC questionnaire hasn’t been answered yet.

A new or partly set-up contact shows Required until all three steps are done — that’s expected, not a problem. A matter’s status rolls up from its clients: if any client on the matter is Required, the matter is Required. It only turns OK once every client is compliant.

Admin override

Sometimes a client can’t complete the standard ID or KYC process. Where that happens, and depending on your firm’s policies, an admin can mark them as AML-satisfied directly from the matter’s AML alert.

• A reason is mandatory and must be recorded at the time of the override.
• The matter shows an Overridden status, so anyone on the file can see what’s happened at a glance.
• The override record shows who made it, when and why — visible on the matter for anyone who needs to review it.

Where AML status appears in Law App

You’ll see AML status in four places, so it stays in front of the people who need to act on it:

• File list — an AML status column shows at a glance which matters need attention. Non-AML matters show a quiet dash.
• Clients grid on a matter — per-client AML status, with non-compliant rows flagged.
• Contact list — a risk-rating column across all your contacts.
• Identity & AML tab — the full detail view: the status pill, an alert banner when action is needed, and a complete history of changes.

This article covers how AML/CTF compliance works inside Law App. It isn’t legal advice on your firm’s obligations under the AML/CTF legislation. For help using the tools, email support@lawsupport.com.au — email is the best way to reach us and keeps the phone line free for urgent matters — or call 07 3040 3036.