Business-Wide Risk Assessment

A business-wide risk assessment (BWRA), also called an enterprise-wide or firm-wide risk assessment, is the documented process by which a bank, payment firm or other regulated business identifies and evaluates the money laundering, terrorist financing and, increasingly, sanctions and proliferation financing risks it faces as a whole. It looks across all customers, products and services, countries, delivery channels and transaction types, weighs the strength of existing controls and concludes on the firm's overall residual risk.

The BWRA is the foundation of the risk-based approach required by international standards. It differs from a customer-level risk rating, which scores individual relationships through a customer risk rating model, although the two inform each other. It is a specific form of AML risk assessment and sits at the centre of a firm's AML program.

Before deciding where to put locks, alarms and cameras, a shop owner walks around the building and asks: where are the valuables, which doors are used most, which windows face a dark alley? Only then can the owner decide where the security budget will do the most good.

A business-wide risk assessment is that walk-around for financial crime. A firm looks at what it sells, who its customers are, where they come from and how they reach it, and asks where criminals would most likely try to misuse it. It then checks how good its existing defences are, and spends more effort where the gaps are largest.

• International standards. FATF Recommendation 1 requires countries to make financial institutions and other obliged businesses identify, assess and take effective action to mitigate their risks.
• European Union. The Fourth Anti-Money Laundering Directive requires obliged entities to carry out documented risk assessments, kept up to date and made available to supervisors, taking account of national and EU-level assessments; the obligation carries into the EU's single anti-money laundering regulation.
• United Kingdom. Regulation 18 of the Money Laundering Regulations 2017 requires a written risk assessment, and a 2022 amendment added a separate assessment of proliferation financing risk.
• United States. Supervisory guidance has long expected banks to base their Bank Secrecy Act programs on a risk assessment, and FinCEN proposed in 2024 to make a risk assessment process an explicit program requirement.

1. Identify risk factors. List inherent risks by category: customer types, products and services, geography, delivery channels and transactions, drawing on national risk assessments, typologies and the firm's own data.
2. Measure inherent risk. Use quantitative data, such as numbers of high-risk customers or cross-border volumes, and qualitative judgement to rate each factor, often on a scale such as low, medium and high, with geographic risk assessment feeding the country component.
3. Assess controls. Evaluate the design and effectiveness of controls such as onboarding checks, transaction monitoring, sanctions screening, training and governance, using testing and audit findings.
4. Determine residual risk. Combine inherent risk and control strength, usually in a matrix, to reach a residual rating for each area and for the firm overall.
5. Act and approve. Set actions to close gaps, compare the results with the firm's risk appetite statement and obtain senior management or board approval.

A good BWRA drives decisions across the compliance function. It shapes which customers require enhanced due diligence, how monitoring scenarios are calibrated, where staff and budget go, which new products need extra controls and whether to enter or exit markets. Supervisors usually ask for the BWRA early in an inspection, because it shows whether a firm understands its own business. The money laundering reporting officer or equivalent typically owns it and reports on it to the board. Most firms refresh it at least annually and also when they launch significant products, enter new markets, make acquisitions or face new typologies.

Supervisors frequently criticise assessments that are generic, copied from templates or written to justify existing controls rather than to challenge them. Other weaknesses include relying on judgement without data, failing to link the assessment to actual control changes, ignoring risks from fintech partners, agents or correspondent relationships, and treating the document as an annual box-ticking exercise. Scoring methods can also give a false sense of precision when the underlying data is poor, so firms are expected to explain their reasoning and update conclusions when new evidence emerges.