Compliance Risk Assessment

A compliance risk assessment is a periodic, documented review in which a regulated firm lists the laws, regulations and rules it is subject to, judges how likely and how damaging a breach of each would be, and rates how well its controls prevent one. It covers every area of regulatory compliance: consumer protection, payments rules, data protection, licensing conditions, sanctions, anti-money laundering, tax reporting and conduct.

It is the foundation of a compliance management system and tells the compliance function where to focus monitoring, compliance testing and training. The narrower AML risk assessment is often one input to it. Banks, payment firms, broker-dealers and insurers all perform one, and supervisors usually ask to see it early in an examination.

Picture a landlord preparing for a building inspection. There are dozens of rules: fire exits, gas safety, electrical wiring, smoke alarms, deposits. The landlord does not check every rule with the same care; they start with the ones that could hurt someone or bring the biggest fine, and with the parts of the building most likely to fail.

A compliance risk assessment is that list for a financial firm. It names every rule, asks where the firm is most likely to slip and how bad a slip would be, and checks whether there is a reliable safeguard in place. The answer decides where the compliance team spends its time.

1. Build an obligations inventory. List every relevant rule, from Regulation E error-resolution deadlines to GDPR consent rules and the conditions attached to a money transmitter license. Many firms buy regulatory-change feeds from RegTech vendors to keep the list current.
2. Map obligations to the business. Link each rule to the products, processes and teams that must follow it.
3. Rate inherent risk. Score the likelihood and impact of a breach, considering volumes, complexity, past exam findings, complaints and recent rule changes.
4. Assess controls. Review the compliance policies and procedures, system checks, training and oversight that address each rule.
5. Record residual risk and actions. Where residual risk is above appetite, assign an owner and a deadline to fix it.

Most firms organize this under the "three lines" model published by the Institute of Internal Auditors in 2020. Business units (first line) own the risks and run the controls; the compliance function (second line), led by the chief compliance officer (CCO), sets the method, challenges the ratings and consolidates the results; internal audit (third line) checks independently that the process works. The board or its risk committee approves the result as part of its governance duties.

Supervisors expect this structure. The Basel Committee's 2005 paper on the compliance function in banks says compliance risk should be identified and assessed by an independent compliance function. In the US, the FFIEC consumer compliance rating system adopted in 2016 rates banks partly on how well management identifies and manages compliance risk, and the UK Financial Conduct Authority (FCA) requires many types of firm to maintain an adequate compliance function under its SYSC rules.

The assessment produces a risk register, a heat map for the board and a set of plans that follow from it:

• The monitoring and testing plan. High-residual-risk rules are tested more often and with larger samples.
• The audit plan. Internal audit uses the ratings when deciding what to review, including the scope of the AML audit.
• Reporting and records. Duties to file regulatory reports and to meet recordkeeping requirements are rated like any other rule, since late or missing filings are common exam findings.
• New product approvals. A launch adds obligations, so the assessment is updated before go-live.
• Third-party oversight. Rules performed by partners and vendors feed into third-party risk reviews; at fintechs working through a sponsor bank, the bank usually reviews the fintech's assessment too.
• Training priorities. Staff in high-risk processes receive targeted training.

Scores are judgments, and teams tend to rate their own controls kindly. The inventory can fall behind fast-changing rules, especially in crypto and payments, and rare but severe failures are hard to score. A firm can also over-focus on rules with an easy-to-measure control and miss broader conduct risks, such as unfair product design, that lead to reputational risk and enforcement action even when individual rules were followed. Treating the assessment as a living document, updated after complaints, incidents and exam findings, reduces these weaknesses.

• Basel Committee on Banking Supervision: Compliance and the compliance function in banks (2005)
• The Institute of Internal Auditors: The IIA's Three Lines Model (2020)