2 min read
The AML business risk assessment: how it is built and how it is tested
An inspector does not ask whether you have a risk assessment. They ask how you built it and what you changed because of it. A document that changes no procedure is paper, not an assessment.
The business risk assessment is the foundation everything else in an AML framework rests on. Your policies, your due diligence procedures, your level of monitoring and your training programme are all supposed to derive from it. So a weak assessment does not show up only in the assessment — it leaves everything built above it without support.
Why it comes before the policies, not after
A risk-based approach means directing effort where risk is greatest. Whoever writes their policies first and then prepares an assessment to match has inverted the order: the assessment has become a justification for what was done rather than the basis for what will be done. This is easy to spot on inspection, because the policies then reflect a generic template rather than the business's actual risks.
The risk factors examined
- Customers: their nature, nationalities, ownership structures, and whether politically exposed persons are among them
- Products and services: what you sell and how far it lends itself to obscuring the source of funds
- Delivery channels: face to face, remote, or through intermediaries you never see
- Geography: the countries your customers come from or your funds move to
- Transaction profile: size, frequency, and how much of it is cash
From assessment to action
An assessment that ends at a "high/medium/low" label with nothing following from it is incomplete. Each level needs a defined, written consequence: the depth of checking required, who approves the relationship, how often it is reviewed, and what triggers escalation. Inspection does not measure the label; it measures the difference between two labels.
| Risk level | What follows in practice |
|---|---|
| Low | Standard due diligence, review at wider intervals |
| Medium | Additional verification of source of funds, closer review |
| High | Enhanced due diligence, senior approval, ongoing monitoring |
When is it refreshed?
The assessment is a living document, not a formation record. It is reviewed periodically, and immediately on any material change: entering a new market, launching a product or service, a shift in the customer base, or a regulatory update touching your sector. The date of last review is among the first things looked at.
Mistakes that strip it of value
- A template copied from another business with the name changed — obvious immediately, because it does not describe your activity
- An assessment with no written methodology explaining how factors were weighted
- Every customer rated "low" with nothing to explain it
- A document never approved by senior management, with no record they saw it
- No trace linking the assessment to an actual change in procedure
