Guide
How the rules work
eAML does the routine part of anti-money-laundering work for you: it decides what to check, what to ask for and when something needs a person’s attention. It does that with rules. This page explains what a rule is, so the rest of the site is easy to read.
A rule says: when this happens, if that is true, do this
Every rule has three parts. The moment is the event that makes eAML look at it. The condition is what has to be true. The outcome is what eAML does about it.
A rule that is written as “When a vendor is added to the case, if they are an individual, add the Identity verification check” is one rule. eAML has 511 rules in all, and a business type uses between 86 and 177 of them. You only ever see their results: a check on a person’s card, a question to answer, a document to collect, a risk rating.
- When
- A vendor is added to the case
- If
- The vendor is an individual
- Then
- eAML adds the check “Identity verification” for the vendor, completed by staff.
This is a real rule, written the way every rule on this site is written.
The moments eAML looks at its rules
eAML does not watch a case all the time. It looks at its rules when something happens, and only at the rules that belong to that moment. The sections of each rules page follow the moments:
| When a case is opened | 2 rules |
|---|---|
| When someone is added to the case | 105 rules |
| When a person’s details change | 5 rules |
| When owners or officers are recorded or changed | 14 rules |
| When a bank account is added | 3 rules |
| When the property is saved | 7 rules |
| When contracts are exchanged | 22 rules |
| When a question is answered | 203 rules |
| When a check result comes back | 107 rules |
| When a document is uploaded | |
| When a payment is recorded | 23 rules |
| When someone is rated medium or high risk | 19 rules |
| When a suspicious matter report is made | 1 rule |
What a rule can do
A rule has one outcome. There are six kinds:
- Rates someone’s risk. A person is rated medium or high risk, and the reason is recorded as a risk factor on their card.
- Adds a check. Some checks run by themselves and cost nothing. Some are run by an officer through a screening or verification provider, and each run is charged to the firm. A check that costs money is never started for you.
- Asks for a document. A document appears on the person’s card for staff to upload or collect: a bank statement, a trust deed, a statutory declaration.
- Asks questions. Either a form is sent to the customer, or staff are asked to answer questions themselves.
- Asks an officer to decide. The risk rating and the senior officer’s approval are decisions only a person can make.
- Raises an alert. A banner on the case, and an item for the compliance officer.
How risk ratings work
Every person on a case has a rating: low, medium or high. A rule can raise the rating, and when it does it records the risk factor behind it, so you can always see why. The case shows the highest rating of the people on it.
A rule never lowers a rating. If the reason for a finding stops being true (for example, an answer is corrected), the finding is withdrawn from the list of risk factors, but the rating stays where it was. The one place a rating can come down is when the case officer confirms the rating at the end of the case, and that decision is recorded with the reason.
When a person is rated medium or high, eAML looks at a further set of rules: the extra steps of enhanced due diligence. They are on the “After a higher rating” page of each business type.
Your firm’s risk appetite
For many risk factors, a rule does not decide for you what to ask for. It asks what your firm has chosen. Your firm’s risk appetite records, for each risk factor, what you do about it: apply enhanced customer due diligence, require evidence of the source of funds or wealth, require payment by bank transfer, require a senior manager’s approval, and so on.
You will see this in the rules as “the firm’s risk appetite for <factor> is <choice>”. If your firm has chosen differently, a different document or step is asked for. If your firm has made no choice for that factor, none of those rules asks for anything.
Rules for your business type
Each business type has its own rules, and some rules are shared by all of them. A real estate agency, a conveyancer, an accounting practice, a law firm and a jeweller each see only the rules that apply to them, with the words they use: a vendor and a buyer, a client, a customer.
A law firm that does conveyancing follows the Conveyancing rules for its conveyancing matters and the Legal rules for everything else.
Running the rules again
Rules run when something happens, so a case that was opened before a rule changed has not met the new rule yet. On the case’s Risk & approval tab, Refire all rules makes eAML go through its rules again for that case. It adds what is now missing and withdraws what is no longer true. It does not start a check that is charged to the firm.
What the rules do not do
The rules find, ask and flag. They do not decide. A match on a sanctions list is something for a person to look at, not a finding of guilt; a high risk rating is a reason to look more closely, not a refusal. Deciding what a finding means, whether to go ahead, and whether to report to AUSTRAC is for you and your compliance officer. This site describes what eAML does so that you know what it has done and what it has left for you.
Nothing here is legal advice.