AML Business-Wide Risk Assessment Template (ML/TF/PF)

AML Business-Wide Risk Assessment: [Institution name] [Assessment year]

The documented enterprise-wide (business-wide) assessment of the money laundering (ML), terrorist financing (TF) and proliferation financing (PF) risks an institution faces, including the risk of non-implementation or evasion of targeted financial sanctions: methodology, inputs, inherent risk by customer, product, channel and geography, control effectiveness, residual risk against appetite, and the action plan. Based on public law as of 2026-10: the risk assessment duty under national law transposing Directive (EU) 2015/849 (Art. 8), Regulation (EU) 2024/1624 (AMLR) Art. 10 from 2027-07-10, the US Bank Secrecy Act programme rule (31 CFR 1020.210) with the FinCEN programme proposal of 2026-04-07 (a proposal, not law), and UK MLR 2017 regulation 18. FATF Recommendation 1 is cited by number and title only. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, regulatory or financial advice. Obtain the law or standard for the normative text and check local law.

Document control

Approvals

Revision history

Contents

• 1. Purpose, scope and legal basis
• 2. Methodology
• 3. Inputs and information sources
• 4. Business profile
• 5. Customer risk
• 6. Products, services and transactions
• 7. Delivery channels
• 8. Geography
• 9. Terrorist financing, proliferation financing and sanctions evasion
• 10. Control effectiveness
• 11. Residual risk and appetite
• 12. Action plan
• 13. Approval, update triggers and record keeping
• 14. Glossary and references
• Standard and licence note

1. Purpose, scope and legal basis

1.1 Purpose

This assessment identifies and evaluates the ML, TF and PF risks to which [Institution name] is exposed, and the risk that targeted financial sanctions are not implemented or are evaded through its services. It sets the residual risk for each risk area, compares it with the appetite set by the management body, and decides which controls, resources and monitoring changes are needed. It is the basis for the customer risk rating methodology, the transaction monitoring coverage plan, the sanctions screening scope, the training plan and the independent testing plan.

1.2 Scope

1.3 Legal basis (as of 2026-10, check local law)

2. Methodology

The assessment follows four steps for each risk area: (1) score inherent risk from likelihood and impact before controls; (2) rate the effectiveness of the controls that mitigate the area; (3) compute residual risk; (4) compare residual risk with appetite and decide on actions. Assessors may adjust a computed score by one band with written justification, approved by the MLRO and recorded in the adjustment log in section 11.

2.1 Inherent risk

Likelihood (L) measures how probable it is that the area is used for ML, TF, PF or sanctions evasion, based on volumes, customer mix, typologies and past cases. Impact (I) measures the consequence: size of possible flows, legal and regulatory consequences, and harm to the financial system.

2.2 Control effectiveness

Each control domain relevant to an area is rated for design and operating effectiveness using testing evidence (quality assurance, independent testing, audit findings, supervisory findings). The weakest material domain sets the area's control rating unless the assessor documents why stronger compensating controls apply.

2.3 Residual risk and bands

Data quality matters as much as the scales. For each likelihood score, record the data extract, its owner and the date it was produced, and note any known gaps (for example customers with missing nationality or industry codes). Where data are missing, assume the higher of the plausible scores rather than the lower, and log the gap as an action. Two assessors from the second line score each area independently; differences of more than one point are discussed and the reason for the final score is recorded. This makes the result repeatable and gives the supervisor evidence that judgement was applied consistently.

The overall residual risk is the simple average of the area residual scores, mapped to the same bands. Any area in the High or Very high band is reported to the management body individually, whatever the overall result.

3. Inputs and information sources

The assessment draws on external sources (what the authorities and standard setters say about risk) and internal sources (what the institution's own data and cases show). Where the two disagree, the assessor explains why, because a gap often reveals a control weakness or a blind spot in monitoring.

4. Business profile

The profile below summarises the size and shape of the business at the cut-off date. All figures are fictional and illustrative.

Check the totals: 400,000 + 11,200 + 300 + 500 = 412,000 customers (400,000 retail and 12,000 corporate). High-risk share: 10,000 / 412,000 = 2.4%. Higher-risk jurisdiction share of payments: 1,150 / 38,000 = 3.0%.

5. Customer risk

Customer risk depends on the share of customers whose profile makes abuse more likely or more damaging: legal entities with complex or opaque ownership, non-resident customers, PEPs and their family members and close associates, cash-intensive businesses, and sectors named in the national risk assessment. At Fernhollow Bank the retail base is large and mostly low risk, but a small segment of non-resident customers and complex corporate structures generates a disproportionate share of alerts and SARs.

6. Products, services and transactions

Products differ in how easily they can move value quickly, across borders, through third parties or with limited transparency. Trade finance and correspondent services expose the bank to trade-based money laundering, mis-description of goods and nested relationships. Merchant acquiring in the payments subsidiary exposes it to transaction laundering, where an onboarded merchant processes payments for undisclosed businesses. Leasing is lower risk because assets are identified, payments are scheduled and funds come from the customer's own account, although early repayment in cash or from third parties remains a red flag.

New products assessed during the period are recorded here with the date of the product approval risk assessment, as required before launch under AMLR Art. 10 from 2027-07-10 and under current national law.

7. Delivery channels

Delivery channels affect how reliably the institution knows who it is dealing with. Remote onboarding through the mobile app now accounts for most new retail customers. Identity is verified with electronic identification or document and liveness checks, which reduces impersonation risk, but the channel is targeted by money mule recruitment and by synthetic identities. Business introduced through intermediaries is small and subject to contractual oversight.

8. Geography

Geographic risk comes from the countries where customers reside, where beneficial owners are based, and where payments are sent to or received from. Fernhollow Bank's own operations are in two EU Member States with comparable AML/CFT frameworks. The exposure arises mainly from cross-border flows of SME customers trading with suppliers in jurisdictions with strategic deficiencies, and from the US branch, which clears US-dollar payments for respondent banks in several regions.

9. Terrorist financing, proliferation financing and sanctions evasion

Terrorist financing often involves small amounts from legitimate sources, moved through non-profit organisations, money transfer services or personal accounts. Proliferation financing and sanctions evasion typically use front companies, trade in dual-use goods, transshipment through third countries and complex ownership to hide a designated person's control. These risks are assessed as separate areas so that their controls (screening, trade document review, ownership and control analysis) are rated on their own evidence. The restrictive measures exposure assessment expected under EBA/GL/2024/14 is summarised here and documented in detail in the Sanctions Exposure Assessment (compliance/sanctions-exposure-assessment).

10. Control effectiveness

Control ratings rest on evidence gathered during the period: quality assurance results, the independent test, internal audit findings and supervisory findings. A control domain with an open high-rated finding cannot be rated better than Needs improvement.

Each area takes the rating of its weakest material control domain, as section 2.2 requires. No compensating-control exception is used in this assessment, so no area is rated better than its weakest domain: RA-01 and RA-04 rely on the payment and customer monitoring scenarios (CTL-03a, Adequate), while the trade finance document gap (CTL-03b, Needs improvement) is carried by RA-02 only. Splitting a domain in this way is acceptable only when the evidence (here, audit finding IA-2026-07) shows that the weakness is confined to one part of it; record that reasoning in the working papers.

11. Residual risk and appetite

Check the computation: residual scores sum to 8.4 + 10.2 + 6.3 + 8.4 + 10.2 + 2.8 + 5.6 + 6.8 + 6.0 = 64.7; divided by 9 areas gives 7.19, which falls in the Medium band. RA-02 and RA-05 are High (10.2 each) and are reported individually to the management body with the actions in section 12.

Read the result in two ways. The overall Medium rating tells the management body that the programme as a whole is proportionate to the business. The two High areas tell it where that conclusion does not hold: trade finance and correspondent payments in the parent, and merchant acquiring in the payments subsidiary. Both share the same cause, a monitoring control that was designed for plain payment flows and does not look at the commercial substance behind a document or a merchant. The action plan therefore targets the control gap rather than the customers, and the MLRO does not propose restricting either activity while the actions are on track. If either action slips by more than one quarter, the MLRO will propose interim limits, such as a cap on new trade finance customers in higher-risk corridors.

The chart places each area by its inherent likelihood and impact scores; colour and position do not replace the residual table, which is the authoritative result.

12. Action plan

Actions are tracked monthly by the MLRO and reported quarterly to the management body together with the AML/CFT Programme Policy (compliance/aml-cft-programme-policy) indicators. Changes to customer scoring that follow from this assessment are made in the Customer Risk Rating Methodology (compliance/customer-risk-rating-methodology); changes to monitoring follow the Transaction Monitoring Scenario Specification (compliance/transaction-monitoring-scenario-spec).

13. Approval, update triggers and record keeping

The management body approves the assessment annually. The MLRO updates the relevant area, and seeks approval of the change, within [60] days of any of the following triggers:

• A new product, service, delivery channel, technology or customer segment, or entry into a new country.
• Publication of a new supranational or national risk assessment, or a change to the Commission list of high-risk third countries or FATF statements that affects a material flow.
• A significant supervisory or internal audit finding, or a material incident such as a large sanctions breach or a major SAR case.
• A merger, acquisition or material outsourcing.
• New sanctions regimes or designations that materially change exposure.

When the assessment is presented for approval, the MLRO summarises in one page what changed since the previous version, which scores moved and why, which actions closed, and which new actions are proposed. The management body records its challenge and any changes it requests in the minutes. A board that approves the assessment without questions is a warning sign for supervisors, so the minutes should show the discussion.

All versions, working papers, data extracts and approvals are kept for at least five years after the version is superseded, and are made available to supervisors on request. The assessment, its data and its working papers are confidential and shared on a need-to-know basis.

14. Glossary and references

References (obtain the current official versions):

• FATF Recommendations, R.1 Assessing risks and applying a risk-based approach, R.6 and R.7 targeted financial sanctions (number and title only).
• Directive (EU) 2015/849, Art. 8, as amended, and national transposition; EUR-Lex.
• Regulation (EU) 2024/1624 (AMLR), Arts 9, 10 and 90, Annexes I to III; applies from 2027-07-10; EUR-Lex.
• EBA Guidelines on ML/TF risk factors (EBA/GL/2021/02, as amended); EBA/GL/2024/14 on restrictive measures (applies 2025-12-30).
• 31 CFR 1020.210; FFIEC BSA/AML Examination Manual; FinCEN AML/CFT National Priorities (2021-06-30); FinCEN NPRM 2026-04-07 (proposal).
• UK MLR 2017 (SI 2017/692) reg. 18.
• Related templates: Risk Methodology (compliance/risk-methodology), Risk Register (compliance/risk-register), Risk Appetite Statement (finance/risk-appetite-statement), Fraud Risk Assessment (compliance/fraud-risk-assessment), Board Pack (business/board-pack).

Standard and licence note

Based on public law: EU legislation from EUR-Lex (Directive (EU) 2015/849 and Regulation (EU) 2024/1624), reused with acknowledgement and summarised in original wording; US federal regulations and FinCEN and FFIEC publications (US government works, public domain); and the UK Money Laundering Regulations 2017 (Crown copyright, Open Government Licence v3.0 where stated). EBA guidelines are cited by number with acknowledgement. FATF and AMLA publications are cited by number and title only; no text is reproduced or paraphrased. The scoring scales, formulas and bands are original and illustrative, not regulatory requirements. The FinCEN 2026 rule is a proposal. Fernhollow Bank and all figures are fictional. This template is original text written for this collection. Check the current official version of each law and guideline before use. Template licence: MIT.