A key component of an AML risk assessment is to facilitate the effectiveness of an institution’s AML framework, by identifying inherent risks across the main areas of risk, assessing the institution’s internal preventative and detective controls, and highlighting any gaps in controls which need to be addressed.

The Federal Financial Institutions Examination Council describes AML risk assessment as “the identification of specific risk categories (e.g., products, services, customers, and geographic locations) … and an analysis of the information identified to better assess the risks within these specific risk categories” (source: FFIEC BSA/AML Manual).

The FATF explains that risk assessment enables a financial institution to “understand how, and to what extent, it is vulnerable to money laundering/terrorist financing”, and helps it to “determine the level of AML/CFT resources necessary to mitigate that risk” (source: FATF Guidance for a Risk-Based Approach, The Banking Sector).

Organizations may complete risk assessment manually, or by using AML risk assessment software tools and systems. Using technology, such as ACAMS Risk Assessment, can help financial institutions to ensure their risk assessment processes and methodologies are objective, and that they respond to the guidance and requirements of global authoritative bodies and financial institution supervisors.

Effective AML risk assessments are an important factor in a financial institution’s ability to meet its regulatory obligations.

An AML risk assessment helps identify the institution’s inherent risk and assesses the effectiveness of its preventative and detective controls.

FATF recommends considering the following factors when assessing inherent money laundering risk:

• The nature, scale, diversity, and complexity of the business
• Target markets
• The number of customers already identified as high risk
• The jurisdictions the bank is exposed to (through its own activities of those of customers)
• Distribution channels
• Internal audit and regulatory findings
• The volume and size of transactions

(Source: FATF Guidance for a Risk-Based Approach, The Banking Sector)

The AML controls and factors that should be assessed include (but are not limited to):

• Management oversight and accountability
• Policies and procedures
• KYC, CDD, and EDD controls
• Detection and SAR filing
• Monitoring, systems, and operations
• Employee training
• Independent testing and oversight

The risk-based approach (RBA) requires financial institutions to proactively identity and seek out risks associated with illicit activities, in order to find ways to control and mitigate those risks. The RBA is promoted by international organizations including the Wolfsburg Group and the Financial Action Task Force (FATF).

According to FATF, risk assessment should “form the basis of a bank’s RBA”. A robust risk assessment helps financial institutions to promptly and accurately identify money laundering risks and vulnerabilities, and apply appropriate controls to mitigate those risks, or identify unacceptable risks to avoid.