How to Write an AML Business Risk Assessment That Stands Up to Review
Rajesh Kumar
An AML business risk assessment is a written, firm-wide judgement of how your business could be used for money laundering or terrorist financing, and how well your controls reduce that risk. Build it in six steps: gather facts, identify risk factors across customers, products, geographies and channels, rate inherent risk, test your controls to reach residual risk, agree actions, then document, approve and keep it current.
Key takeaways
- The assessment is about your whole business, not individual customers. It is the foundation that every other control should trace back to.
- Start from your own data on customers, products, countries and channels. Generic templates produce generic, unconvincing results.
- Rate risk before controls, then rate controls honestly. The gap that remains is the residual risk you must manage or accept.
- Every material finding needs an action, an owner and a date, or the document is just a report.
- Review it when your business changes, not just once a year.
What a business risk assessment is, and what it is not
The business risk assessment, often shortened to BRA, is your firm's own analysis of where it is exposed to money laundering and terrorist financing and how well it is protected. It looks at the business as a whole: the customers you serve, the products and services you offer, the places you operate or deal with, the channels through which you deliver and the transactions that follow.
It is not the same as the risk rating you give an individual customer at onboarding. That is a customer risk assessment, and it comes after. The business assessment is the layer above, and it should shape how the customer-level rating works. If your assessment says that customers from a particular sector or region are your highest exposure, your onboarding procedure should treat them differently, and a reviewer should be able to see the link.
Why reviewers start here
Supervisors and independent reviewers commonly begin with the business risk assessment because it tells them whether the rest of the programme makes sense. If you cannot explain your risks, you cannot justify your controls. Policies that are heavy where risk is low and light where it is high suggest that the programme was copied rather than designed.
A risk-based approach is a simple idea with a demanding consequence. You are expected to put more effort where the risk is higher and less where it is lower, and to be able to show your reasoning. The assessment is where that reasoning lives. Detailed requirements vary by sector and supervisor, so read the guidance that applies to your licence and use this article as a method, not as a rulebook.
Step 1: Gather the facts about your business
Write down what you actually do before you judge any risk. Pull together the data that describes your business as it stands today, rather than as it was when you were licensed.
- Your business lines, products and services, including any new ones planned.
- Your customer base: how many, what types (individuals, companies, trusts, foundations), how many are non-resident, how many are politically exposed persons and how many arrive through introducers.
- The countries your customers, their owners and their counterparties are connected to.
- How you meet customers: face to face, remotely, through agents or through other regulated firms.
- How money moves: cash, bank transfer, cards, virtual assets, third-party payments, and the typical value and frequency.
- Who does what inside the firm, which functions are outsourced and which tools you rely on.
If a number is unknown, say so and note how you will find it. An honest gap in the data is better than a confident guess, and it often turns out to be your first action.
Step 2: Identify the risk factors
Group your analysis under the standard headings so it is easy to follow and easy to challenge: customers, products and services, geographies, delivery channels and, where relevant, transactions. The table gives examples of what tends to push risk up or down. Treat it as a prompt, not a checklist, and add factors specific to your sector.
| Factor | Tends to raise risk | Tends to lower risk |
|---|---|---|
| Customers | Complex ownership, cash-intensive activity, politically exposed persons, customers who are hard to verify, introduced business with limited access to the customer | Long-standing, well-understood customers, transparent ownership, regulated or listed entities, simple purpose of relationship |
| Products and services | Fast or anonymous value transfer, high-value portable goods, products that can obscure ownership, new or untested offerings | Simple, low-value, traceable products with clear economic purpose |
| Geographies | Links to jurisdictions with weak controls, high corruption, sanctions exposure or active conflict, and unexplained cross-border flows | Links to jurisdictions with strong, well-supervised regimes and clear transparency |
| Delivery channels | Non-face-to-face onboarding without strong verification, reliance on agents or intermediaries, third-party payments | Direct relationships, verified in person or through robust digital checks |
| Transactions | Large cash, rapid in-and-out movement, payments that do not fit the customer's profile, round-sum or structured payments | Predictable activity consistent with the customer's known business |
Step 3: Rate the inherent risk
Inherent risk is the level of exposure before you take your controls into account. For each risk you identified, judge two things: how likely it is that the business could be used in that way, and how serious the consequences would be if it were. A simple three-level scale of low, medium and high is enough for most small and medium firms. More levels create the appearance of precision without improving the decision.
Define each level in a sentence so that two different people would rate the same risk the same way. Write down the reason for every rating, however short. A page where every line says medium is a warning sign for a reviewer, because most businesses have a few risks that are clearly higher than the rest. If everything is medium, you probably have not decided anything.
Step 4: Test your controls and reach residual risk
For each material risk, list the controls that address it: onboarding checks, screening, monitoring, training, approval levels, restrictions on certain customers or products, record-keeping and reporting. Then judge whether each control exists, whether it is applied in practice and whether it works. Sampling a handful of customer files or alerts will tell you more than reading your own procedure.
Residual risk is what remains once you account for the controls. A high inherent risk with strong, tested controls may be acceptable at a moderate residual level. A medium inherent risk with weak or untested controls can be more worrying than it looks. Be candid in this step. Rating your controls generously defeats the purpose and is easily exposed when someone else looks at your files.
Step 5: Agree the actions and your risk appetite
The assessment must lead somewhere. For each risk whose residual level you are not comfortable with, record an action, an owner and a date. Typical outcomes include tightening onboarding for a customer segment, adding a monitoring rule, restricting a product, improving training or deciding to stop serving a type of customer altogether.
Add a short statement of risk appetite: the kinds of business you will accept, accept with enhanced measures, or decline. This turns an analysis into a decision tool, and it gives your sales team a clear line to work within.
Step 6: Document, approve and keep it alive
Write the assessment so that a competent stranger could follow it: the date, the scope, the data used, the reasoning behind each rating and the action plan. Have senior management or the board approve it, and record that approval. Keep a version history so you can show how your view changed and why.
Then treat it as a working document. Review it at least once a year and whenever something significant changes. Typical triggers include a new product or delivery channel, entry into a new market, a change in customer mix, a merger or acquisition, a major incident or a change in the rules or supervisory guidance. A business risk assessment that was accurate on the day of your licence application and has not been touched since is out of date.
An illustration: a small corporate services provider
The following example is hypothetical and not drawn from any real client. It shows how the steps fit together.
A small firm sets up and administers companies for overseas owners. Gathering facts shows that most customers are non-resident, about a fifth have layered ownership and many arrive through introducers. The firm rates customers as high inherent risk, delivery channels as high because of introducers it has never met the owners of, and products as medium. Testing controls, the firm finds that identity checks on direct customers are strong, but beneficial ownership evidence for introduced customers is thin and screening of owners behind corporate shareholders is inconsistent. Residual risk for introduced customers stays high. The actions are to require direct verification of ultimate owners, to re-screen the introduced customer base and to set a rule that unverified owners mean no onboarding. Each action has an owner and a date, and management signs the document.
Common mistakes
- Copying a template. A generic assessment with your name on it will not reflect your risks, and a reviewer will see that quickly.
- Ignoring your own data. Ratings with no numbers behind them are opinions.
- Rating everything medium. It avoids hard decisions and tells a reviewer nothing.
- Not linking to controls. If the assessment never changes a procedure, it is not working.
- Leaving it on the shelf. An assessment that is never updated stops describing the business.
- Giving it to one person. The people who run customer onboarding, sales and operations should contribute, or the document will miss real risks.
Where Adventant fits
Adventant prepares and updates business and customer risk assessments matched to your licence, products and customers, and links them to your AML policies and procedures so the controls follow the risks. If you have an assessment already, an independent review can test whether it holds up. Use the form below to start a conversation. This article is general information, not legal advice.
Frequently asked questions
What is the difference between a business risk assessment and a customer risk assessment?
The business risk assessment looks at the whole firm: its customers, products, geographies and channels in aggregate. A customer risk assessment rates one customer at onboarding and during the relationship. The business assessment should inform how customer ratings are designed.
How often should a business risk assessment be updated?
Review it at least annually and whenever something significant changes, such as a new product, a new market, a change in customer mix, an acquisition, or a change in rules or supervisory guidance.
Who should approve the assessment?
Senior management or the board should approve it, and the approval should be recorded. The Compliance Officer or MLRO usually leads the work, but accountability sits with the firm's leadership.
Is a template enough?
A template can give you a structure, but it cannot supply your data or your reasoning. An assessment is convincing only when its ratings are tied to facts about your own customers, products, countries and channels.
What do reviewers usually criticise?
Common criticisms are ratings with no stated reasons, an assessment that does not change any control, controls rated more generously than the evidence supports, and a document that has not been updated as the business changed.