Why every regulated firm needs a risk assessment

A firm-wide risk assessment is the foundation of every AML compliance programme. The FATF Recommendations require all regulated businesses to identify, assess, and understand the money laundering and terrorist financing risks to which they are exposed. Without a documented risk assessment, it is impossible to demonstrate that your controls are proportionate and effective.

For non-financial institutions, this is not optional. The UK Money Laundering Regulations 2017 explicitly require firms to carry out a risk assessment and keep it up to date. Professional supervisory bodies routinely cite inadequate risk assessments as a primary finding during inspections.

Step 1: identify your risk factors

Start with the features of your business that would make it useful to someone laundering money. Most fall into four groups.

Customer risk

Consider the types of customers you serve. Are they individuals or entities? Domestic or international? Do they include PEPs or customers from FATF grey-listed jurisdictions? Law firms acting for overseas clients in property transactions face different customer risks than accountants providing domestic tax advice.

Geographic risk

Jurisdictions with weak AML frameworks, high levels of corruption, or active sanctions regimes represent elevated risk. The FATF grey and black lists and Transparency International's Corruption Perceptions Index are key reference sources.

Product and service risk

Some services are inherently higher risk. Company formation services carry higher risk than routine bookkeeping. Property transactions involving overseas buyers present different risks than domestic lettings.

Delivery channel risk

Non-face-to-face business relationships, introduced business, and complex intermediary chains all increase risk. Consider whether you verify customer identity in person or remotely.

Step 2: score and prioritise risks

Use a structured methodology to score each risk factor by likelihood and impact. A simple matrix approach works well for most non-financial institutions:

  • High risk: Requires enhanced due diligence, more frequent monitoring, and senior management oversight
  • Medium risk: Standard CDD with appropriate ongoing monitoring
  • Low risk: Simplified measures may be appropriate, but must be documented and justified

Step 3: map controls to risks

For each identified risk, document the controls you have in place. This includes customer screening against sanctions lists, identity verification procedures, ongoing monitoring frequency, and staff training programmes. Automated screening platforms like FirmScreen provide a key control for sanctions risk mitigation.

Step 4: document and review

Your risk assessment must be documented, approved by senior management, and reviewed regularly - at minimum annually, and whenever there are material changes to your business model, customer base, or the regulatory environment. Use our AML Compliance Checklist to ensure you have covered all required elements.