The business-wide risk assessment is the firm's own view of where it is exposed to money laundering and terrorist financing, and how well its controls hold. The agent gathers exposure data across customers, products, channels and countries, scores inherent risk with your methodology, assembles control evidence and drafts the assessment. The MLRO owns the conclusions, and the board approves.
What is the business-wide risk assessment, and who owns it?
FATF Recommendations put a risk-based approach at the centre of AML: a firm must identify and assess its money laundering and terrorist financing risks and apply controls in proportion. The business-wide risk assessment, sometimes called the enterprise-wide risk assessment, is where that happens. It considers customer types, products and services, delivery channels, geographies and transactions, assesses inherent risk, assesses the controls that mitigate it, and reaches a residual risk view that drives the AML programme for the year ahead.
The MLRO owns the assessment; the board or a board committee approves it; business heads supply data and challenge it. It is often built by hand in spreadsheets from data pulled from many systems. An agent can make the data complete and consistent. It is a specific kind of compliance risk assessment, with the same boundary: the agent prepares, people judge.
What are the steps?
- Person, MLRO: approves the methodology. Risk factors, scoring scales, weights, control assessment criteria and the residual risk matrix.
- Agent, depth 1: gathers exposure data. Customer numbers and balances by type and risk rating, product volumes, channel mix, country exposure, transaction flows, correspondent relationships.
- Agent, depth 1: gathers external inputs. National risk assessments, FATF publications and supervisory guidance relevant to your markets, marked as external.
- Agent, depth 1: scores inherent risk for each risk area by applying the methodology to the data. The calculation is shown.
- Agent, depth 1: gathers control evidence. Monitoring results, audit findings, QA results, backlog data, alert outcomes and breaches, mapped to the controls for each risk area. Customer risk rating outcomes from customer risk rating reviews feed in here.
- Agent, depth 2: drafts control effectiveness ratings against the criteria, with the evidence for each.
- Agent, depth 1: calculates residual risk from the matrix.
- Agent, depth 2: drafts the assessment document. Changes from the prior year, emerging risks, the residual risk profile and proposed actions.
- Person, business heads: challenge the data and ratings for their areas.
- Person, MLRO: decides final ratings and actions.
- Person, board: approves the assessment.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Methodology | Nothing | None | MLRO approves |
| Exposure data | Gathers across systems | 1 | Supplying missing data |
| External inputs | Gathers, marks as external | 1 | Judging relevance |
| Inherent risk | Scores with calculation shown | 1 | None |
| Control evidence | Maps evidence to controls | 1 | None |
| Control ratings | Drafts against criteria | 2 | MLRO decides |
| Residual risk | Applies the matrix | 1 | None |
| Document | Drafts assessment | 2 | MLRO owns |
| Challenge and approval | Nothing | None | Business heads, MLRO, board |
Which controls apply, and what evidence does each leave?
Methodology fixed before data. Scoring rules are approved before scores are calculated, so results do not shape the method. Evidence: dated methodology approval.
Data lineage. Every figure traces to its source and extract date. Evidence: a data annex an auditor or supervisor can test.
Control ratings evidenced. A control rated effective has evidence that it works, not just that it exists. Evidence: links from each rating to monitoring and audit results.
Challenge recorded. Business heads' challenges and the MLRO's responses. Evidence: a challenge log showing the assessment was tested.
Board approval. Evidence: minutes.
What should you measure?
- Data completeness: risk areas with full exposure data.
- Ratings changed after challenge, and why.
- Actions from the assessment completed during the year.
- Time to produce the assessment.
- Supervisory feedback on the assessment, where given.
- Risk areas where the rating moved without a matching change in exposure data or controls, which suggests judgement drifting away from evidence.
Where does it usually go wrong?
Copying the previous assessment. Ratings carried forward without fresh data. The agent should flag any rating unchanged despite material changes in the underlying data.
Controls rated on design. A well-designed transaction monitoring system with a large backlog is not an effective control. Evidence of operation matters, and the agent should show it beside every rating so business heads can challenge it.
Generic external risks. Lists of typologies from external sources, not linked to the firm's actual products and customers. Each external risk should be tied to exposure data.
Agents left out. Where AI agents perform parts of AML controls, their certification, bounds and performance are part of control effectiveness. Rating the agents themselves is a separate exercise, set out in the AI agent risk assessment template.
One assessment for many markets. Groups operating in several countries need entity-level assessments that reflect local risks and rules. Our brief on compliance in business banking in France shows how one market's expectations differ.
Assessment disconnected from the programme. The assessment says a risk area is high, and the monitoring plan, training and resourcing do not change. The agent should map each high residual risk to the actions and controls that respond to it, and flag any with none, so the board sees whether the programme follows the assessment.
The overall stance on compliance agents is in AI compliance agents.
Questions people ask
Can the agent decide the residual risk rating?
It calculates it from the matrix and the inputs. Where the MLRO judges the calculated rating does not reflect reality, they override it with reasons. The final rating is theirs.
How often should the assessment be refreshed?
At least on the cycle your rules or policy require, and when something material changes, such as a new product, market or significant finding. The agent can monitor the data and flag when a refresh may be needed.
Should the assessment cover terrorist financing and sanctions separately?
Many firms assess terrorist financing alongside money laundering but with distinct factors, and assess sanctions exposure separately. Follow your methodology and your supervisor's expectations.