ACAMS Risk Assessment^TM

A key component of an AML risk assessment is to facilitate the effectiveness of an institution’s AML framework by identifying inherent risks across the main areas of risk, assessing the institution’s internal preventative and detective controls, and highlighting any gaps in controls that need to be addressed. This process ultimately helps financial institutions arrive at a residual risk identification that addresses their own risk appetite, ensuring that the AML risk assessment is risk-based.

The Federal Financial Institutions Examination Council describes an AML risk assessment example as “the identification of specific risk categories (e.g., products, services, customers, and geographic locations) … and an analysis of the information identified to better assess the risks within these specific risk categories” (source: FFIEC BSA/AML Manual).

The FATF explains that risk assessment enables a financial institution to “understand how, and to what extent, it is vulnerable to money laundering/terrorist financing”, and helps it to “determine the level of AML/CFT resources necessary to mitigate that risk” (source: FATF Guidance for a Risk-Based Approach, The Banking Sector).

Organizations may complete risk assessments manually, or by using AML risk assessment software tools and systems. Using technology, such as ACAMS Risk Assessment™, can help financial institutions to ensure their AML risk management and risk assessment processes and methodologies are objective, and that they respond to the guidance of global authoritative sources and financial institution supervisors.

Effective AML risk assessments are an important factor in a financial institution’s ability to meet its regulatory obligations.

ACAMS Risk Assessment™ assists financial institutions of all sizes in meeting their AML risk assessment requirements. From community banks and credit unions to global financial institutions, investment and security firms, and MSBs – including those offering virtual asset products and services. Furthermore, our software solution ensures comprehensive coverage and peace of mind through a platform that is flexible and scalable, including but not limited to the ability for institutions to customize to their own proprietary controls and change scoring to support risk-based decision making.

Assessing the effectiveness of an institution’s suspicious activity risk control framework goes beyond the identification and suspicious activity reporting of a wide range of financial crimes , such as fraud, structuring, terrorist financing, money laundering, tax evasion, and many others. Included in building a strong framework is a suspicious activity risk assessment that identifies these risks, and measures the effectiveness of applicable preventative and detective controls which financial institutions worldwide need to address. Suspicious activity risk assessments may be completed manually or can be automated with the help of tools like ACAMS Risk Assessment™.

Assessing the effectiveness of an institution’s sanctions program includes the measurement of the sanctions risks it is exposed to and the evaluation of its risk controls.

The frequency that a sanctions program risk assessment needs to be completed and its level of comprehensiveness depends on the risk profile of the institution, and how that risk profile changes over time.

ACAMS Risk Assessment™ automates the sanctions risk assessment process and draws on best practices to help financial institutions worldwide build a sound sanctions compliance program.

An AML risk assessment helps identify an institution’s inherent risk and assesses the effectiveness of its preventative and detective controls to arrive at a residual risk that is unique to each institution.

FATF recommends considering the following factors when assessing inherent money laundering risk:

• The nature, scale, diversity, and complexity of the business
• Target markets
• The number of customers already identified as high-risk
• The jurisdictions the bank is exposed to (through its own activities and those of its customers)
• Distribution channels
• Internal audit and regulatory findings
• The volume and size of transactions

(Source: FATF Guidance for a Risk-Based Approach, The Banking Sector)

The AML controls and factors that should be assessed include (but are not limited to):

• Management oversight and accountability
• Policies and procedures
• KYC, CDD, and EDD controls
• Detection and SAR filing
• Monitoring, systems, and operations
• Employee training
• Independent testing and oversight

The risk-based approach (RBA) requires financial institutions to proactively identify and seek out risks associated with illicit activities in order to find ways to control and mitigate those risks. The RBA is promoted by international organizations, including the Wolfsberg Group and the Financial Action Task Force (FATF).

According to the FATF, risk assessment should “form the basis of a bank’s RBA”. A robust risk assessment helps financial institutions to promptly and accurately identify money laundering risks and vulnerabilities and apply appropriate controls to mitigate those risks or identify unacceptable risks to avoid.