A key component of an AML risk assessment is to facilitate the effectiveness of an institution’s AML framework, by identifying inherent risks across the main areas of risk, assessing the institution’s internal preventative and detective controls, and highlighting any gaps in controls which need to be addressed.

The Federal Financial Institutions Examination Council describes AML risk assessment as “the identification of specific risk categories (e.g., products, services, customers, and geographic locations) … and an analysis of the information identified to better assess the risks within these specific risk categories” (source: FFIEC BSA/AML Manual).

The FATF explains that risk assessment enables a financial institution to “understand how, and to what extent, it is vulnerable to money laundering/terrorist financing”, and helps it to “determine the level of AML/CFT resources necessary to mitigate that risk” (source: FATF Guidance for a Risk-Based Approach, The Banking Sector).

Organizations may complete risk assessment manually, or by using AML risk assessment software tools and systems. Using technology, such as ACAMS Risk Assessment, can help financial institutions to ensure their risk assessment processes and methodologies are objective, and that they respond to the guidance and requirements of global authoritative bodies and financial institution supervisors.

Effective AML risk assessments are an important factor in a financial institution’s ability to meet its regulatory obligations.

A suspicious activity risk assessment identifies risks relating to wide range of suspicious activity, including fraud, structuring, terrorist financing, money laundering, tax evasion, and other forms of financial crime. An effective suspicious activity risk assessment will not only identify risks, but also the effectiveness of applicable preventative and detective controls which financial institutions worldwide need to address. Suspicious activity risk assessments may be completed manually, or with the help of tools such as ACAMS Risk Assessment.

An effective sanctions risk assessment (SRA) measures the inherent sanctions risks a financial institution is exposed to and the effectiveness of its risk controls. Each area of sanctions risk should be allocated an inherent risk rating and control effectiveness should also be rated.

The frequency that an SRA needs to be completed and its level of comprehensiveness depends on the risk profile of the institution, and how that risk profile is changing overtime, as well as considering internal resource availability.

ACAMS Risk Assessment automates the sanctions risk assessment process, and draws on best practices to help financial institutions worldwide build a sounds sanctions compliance program.

An AML risk assessment helps identify the institution’s inherent risk and assesses the effectiveness of its preventative and detective controls.

FATF recommends considering the following factors when assessing inherent money laundering risk:

• The nature, scale, diversity, and complexity of the business
• Target markets
• The number of customers already identified as high risk
• The jurisdictions the bank is exposed to (through its own activities of those of customers)
• Distribution channels
• Internal audit and regulatory findings
• The volume and size of transactions

(Source: FATF Guidance for a Risk-Based Approach, The Banking Sector)

The AML controls and factors that should be assessed include (but are not limited to):

• Management oversight and accountability
• Policies and procedures
• KYC, CDD, and EDD controls
• Detection and SAR filing
• Monitoring, systems, and operations
• Employee training
• Independent testing and oversight

The risk-based approach (RBA) requires financial institutions to proactively identity and seek out risks associated with illicit activities, in order to find ways to control and mitigate those risks. The RBA is promoted by international organizations including the Wolfsberg Group and the Financial Action Task Force (FATF).

According to FATF, risk assessment should “form the basis of a bank’s RBA”. A robust risk assessment helps financial institutions to promptly and accurately identify money laundering risks and vulnerabilities, and apply appropriate controls to mitigate those risks, or identify unacceptable risks to avoid.