Firm-Wide AML Risk Assessment
A firm-wide AML risk assessment should support decisions, not simply produce a score. The methodology should reflect the firm's business, evidence and jurisdiction.
Assess exposure across the business
A risk assessment identifies where money laundering exposure may arise and how it informs priorities. It can consider activities, products, customers, geographies, channels, transaction characteristics and relevant systems. Unlike a controls review, it asks what exposures the business faces and what decisions should follow.
A methodology may distinguish inherent exposure before controls from residual risk after relevant controls are considered. Terms, rating criteria, evidence and judgement rules should be explicit. Data limitations, assumptions, proxy measures and uncertainty should remain visible rather than disappear inside a score.
Connect the assessment to decisions
The purpose is to make risk information useful. Depending on the question, discussion could examine how risk appetite is expressed, who accepts or escalates exceptions, and whether the assessment informs due diligence, monitoring, controls, governance or resources. Decision-makers and supporting evidence should be clear from the outset.
For firms to which relevant UK provisions apply, FCA Handbook SYSC 6.3 addresses identifying, assessing, monitoring and managing money laundering risk, proportionately to the nature, scale and complexity of activities, and regular assessment of control adequacy. Its guidance identifies customer, product and activity profiles, channels, transaction complexity and volume, processes, systems and operating environment as relevant factors. Rule application depends on the firm. FATF Recommendations are international standards implemented by countries through measures adapted to their circumstances, so local requirements must be established.
Define scope, evidence and limits
Useful inputs include entities and activities in scope, locations, business and customer data, existing methodology, control information, known gaps, the intended audience and the decision to support. An initial discussion can then set the assessment period, evidence available, treatment of missing data, boundaries and expected form of any findings.
Results depend on information quality, coverage and agreed assumptions. An assessment does not certify compliance, ensure every risk is identified or replace management judgement. A controls review instead examines the design or operation of selected controls; the two can be linked where agreed.
Common questions
What is the difference between inherent and residual AML risk?
They describe exposure before controls and remaining exposure after relevant controls are considered. Define the terms and explain evidence, assumptions and judgement behind each rating; labels alone are not a reliable result.
Does this mean every organisation needs the same firm-wide assessment?
No. Scope and method depend on the organisation, its risk profile, data and applicable rules. An engagement would first establish the entity, decisions and evidence in scope.
Is an AML risk assessment the same as an AML controls review?
They answer different questions: risk assessment maps exposure and supports priorities; controls review examines selected control design or operation. They may be connected where agreed.