AML Risk Assessment

An AML risk assessment is the written analysis a bank, money transmitter, crypto exchange or other regulated business carries out to understand how criminals could use it to launder money or finance terrorism. It looks at who the firm serves, what it sells, how customers reach it and where money flows, rates the risk in each area, and records how well existing controls bring that risk down. The result is the starting point for the whole AML program.

The assessment is the practical form of the risk-based approach set by the FATF (Financial Action Task Force): spend the most effort where the risk is highest. It is narrower than a compliance risk assessment, which covers every law a firm must follow, and it is reviewed by examiners and by the AML audit.

Think of a home insurer sizing up a house before setting a premium. The inspector notes the risky features (an old roof, a river nearby, a wood stove) and then the protections (smoke alarms, a new boiler, a sprinkler). The premium reflects what is left once the protections are counted.

An AML risk assessment does the same for a financial business. It lists the features that attract dirty money, such as cash-heavy customers or transfers to high-risk countries, then gives credit for the checks the firm already runs. What remains tells management where to add staff, tighten rules or say no to certain business.

FATF Recommendation 1 asks countries and financial institutions to identify, assess and understand their money laundering and terrorist financing risks; since a 2020 revision it also covers proliferation financing risk. Countries publish national risk assessments that firms are expected to read; the US Treasury released its latest National Money Laundering Risk Assessment in February 2024.

• United States. The Bank Secrecy Act (BSA) program rules do not spell out a written risk assessment for every institution, but the FFIEC BSA/AML Examination Manual treats one as the basis of a sound program, and examiners ask for it first. In April 2026 FinCEN proposed a rule that would make a risk assessment process an explicit program requirement, replacing a 2024 proposal; as of November 2026 no final rule had been issued.
• United Kingdom. Regulation 18 of the Money Laundering Regulations 2017 requires a written, up-to-date business-wide risk assessment that must be given to the supervisor on request.
• European Union. The anti-money laundering directives require obliged entities to assess risk; the directly applicable Anti-Money Laundering Regulation (EU) 2024/1624 takes over from 10 July 2027.

Most frameworks group risk into four or five areas:

• Customers. The mix of retail, business and institutional clients, cash-intensive trades, politically exposed persons (PEPs), nested financial institutions and opaque ownership structures where the ultimate beneficial owner (UBO) is hard to confirm.
• Products and services. Cash deposits, international wire transfers, prepaid cards, trade finance, private banking and virtual-asset services each carry different risk.
• Delivery channels. Remote onboarding, agents, fintech partners and introducers can weaken identity checks.
• Geography. Where customers live and where funds go, including countries on the FATF greylist or subject to sanctions.
• Transactions. Volumes, values, speed and patterns, drawn from real data rather than guesses.

Firms first rate inherent risk, the exposure before any controls. Many use a simple likelihood-and-impact score for each risk area:

• $L$ is the likelihood that the area is used for laundering, rated 1 (rare) to 5 (almost certain).
• $I$ is the impact if it is, rated 1 (minor) to 5 (severe), covering legal, financial and reputational harm.

The controls for each area, such as customer due diligence (CDD), transaction monitoring and sanctions screening, are then rated for design and effectiveness. What remains is residual risk. For example, a remittance firm rates outbound transfers to a high-risk corridor at likelihood 4 and impact 5, an inherent score of 20 out of 25. Its controls are rated "moderately effective", so management records the residual risk as high and decides to add enhanced due diligence (EDD) for senders above a set amount. The scoring is a practitioner convention, not a legal formula; regulators care most that the reasoning is clear and backed by data.

A good assessment drives decisions across the program. It sets which customers get simplified, standard or enhanced checks, how monitoring scenarios and thresholds are tuned, how many analysts the team needs, what the AML compliance officer reports to the board, and which areas compliance testing and audit should sample. It is usually refreshed every year and whenever something material changes: a new product, a new country, an acquisition, or a new national risk assessment. The assessment, its data and its approval must themselves be kept under recordkeeping requirements, and its picture of risk should be consistent with what the firm files through regulatory reporting, such as suspicious activity report volumes. It forms one part of the firm's broader compliance management system.

Examiners and auditors repeatedly find the same problems:

• Generic templates. A copied document that does not describe the firm's own customers and products gives no real guidance.
• No data. Ratings based on opinion rather than counts of customers, transaction values or alerts are hard to defend.
• No link to controls. High-risk areas are named but monitoring rules and due diligence levels stay the same.
• Stale content. New products, partners or corridors launched since the last update are missing.

Weak assessments often appear among the findings in enforcement actions, because every later control depends on knowing where the risk lies.

• US Department of the Treasury: 2024 National Money Laundering Risk Assessment
• The Money Laundering Regulations 2017, regulation 18 (legislation.gov.uk)