AML risk assessment for a company or fintech

Products, money flows, customer types, territories, onboarding channels and partners are inventoried. Generic factors are supplemented by specific risks, such as remote onboarding, speed, digital assets, money-mule accounts or opaque legal structures.

Weightings and thresholds must be explained and approved. Missing data, exceptions and expert judgement are documented to make the assessment reproducible.

• data sources and the period analysed;
• the scale, weightings and thresholds;
• risk scenarios and associated controls;
• the person responsible for validation;
• update triggers.

Inherent risk describes exposure before controls. The design and actual operation of checks, monitoring, limits, alerts and reviews are assessed separately. Only then is residual risk estimated.

A control existing on paper does not automatically receive a high effectiveness rating. Evidence may include samples, error rates, outstanding alerts, tests, incidents and remediation of findings.

The initial profile combines the customer, beneficial owner, purpose, activity, geography and product. Events such as a change of control, transactional behaviour, sanctions, adverse media or expired documents may change the risk level.

Automated rules must be validated and supervised. Overly broad thresholds produce unnecessary alerts; overly narrow ones miss cases. Manual decisions and overrides require reasons and oversight.

The outcome determines which customers or products are accepted, when senior approval is needed, which enhanced measures apply and which risks are not tolerated. Exceptions have a duration, owner and conditions.

The remediation plan must contain measures, a responsible person, deadline and evidence of completion. The assessment is repeated periodically and upon significant changes in product, market, system, legislation or incident profile.