What the Regulations Require

Regulation 18 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 requires a firm to take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. In doing so, it must take into account information made available by its supervisor and risk factors relating to:

• its customers;
• the countries or geographic areas in which it operates;
• its products or services;
• its transactions; and
• its delivery channels.

The steps must be proportionate to the size and nature of the business. The assessment must be recorded in writing, kept up to date, and provided to the supervisor on request. Regulation 19 then requires the firm to establish and maintain policies, controls and procedures to mitigate and manage effectively the risks identified, again proportionate to the business and approved by senior management.

For FCA-regulated firms, the FCA’s rules in SYSC 6.3 add the expectation of regular assessment of the adequacy of the firm’s systems and controls, and the FCA’s Financial Crime Guide sets out what good practice looks like. Industry guidance from the Joint Money Laundering Steering Group covers the risk-based approach in detail, with sector-specific chapters. Our overview of the Money Laundering Regulations 2017 puts regulation 18 in the context of the wider framework.

Business-Wide vs Customer Risk Assessment

Two kinds of risk assessment are often confused. The business-wide assessment looks at the firm as a whole. The customer risk assessment looks at each individual customer and decides what level of due diligence and monitoring they need. The two are connected: the business-wide assessment sets the framework, including the risk factors and weightings, that the customer risk assessment applies.

Our guide to customer due diligence and enhanced due diligence covers the customer level.

Sources the Assessment Should Draw On

A credible assessment is grounded in evidence, not just the assessor’s view. The main sources are:

The last two are where many assessments fall short. A document built only on published sources describes a generic firm, not this one.

A Practical Methodology

There is no prescribed method, but most good assessments follow the same broad structure:

• Map the business. List the firm’s customer types, products and services, geographies, transaction types and delivery channels, with volumes and values where possible.
• Assess inherent risk. For each area, assess how attractive and vulnerable it is to money laundering and terrorist financing before controls, using the external and internal sources above.
• Assess controls. Identify the controls that mitigate each risk, such as due diligence, screening, monitoring and training, and assess how well they are designed and how effectively they operate in practice.
• Determine residual risk. Combine inherent risk and control effectiveness into a residual rating for each area and for the firm overall.
• Set actions. Where residual risk is above the firm’s appetite, record the actions needed, with owners and deadlines.
• Link to the customer methodology. Make sure the customer risk assessment uses the same risk factors and reflects the conclusions.
• Approve and communicate. Present the assessment to senior management or the board for approval, and share relevant conclusions with the business.

Scoring matrices are common and useful, but they are not a substitute for judgement. Supervisors want to see the reasoning behind each rating, not just the numbers.

How the Assessment Drives Controls

The business-wide assessment only has value if it changes what the firm does. Each conclusion should flow through to the control framework:

Our guides to transaction monitoring and sanctions screening explain how those controls should reflect the risk assessment. Resourcing is part of the same chain: our guide to sizing the financial crime team at a payments or e-money firm shows how risk and volume drive headcount.

When to Refresh It

The Regulations require the assessment to be kept up to date. In practice, most firms review it at least annually, and also when something material changes. Typical triggers include:

• launching a new product, service or delivery channel;
• entering a new market or taking on a new customer segment;
• a significant change in volumes or transaction patterns;
• an acquisition or major change in business model;
• a new National Risk Assessment, sanctions development or significant supervisory publication; and
• audit findings, enforcement action in the sector, or a material financial crime incident at the firm.

A risk assessment that is reviewed only on its anniversary, while the business has changed around it, is one of the most common findings supervisors make.

Who Owns It

The MLRO, approved as SMF17 at firms within the SMCR, normally owns the business-wide risk assessment. It is the central document in their oversight of the firm’s anti-money laundering systems and controls, and it underpins the annual MLRO report to the board. In larger firms, a deputy MLRO or financial crime team may prepare much of the analysis, and first-line business areas contribute their own data and views. But the MLRO should own the conclusions and be able to defend them to a supervisor.

Senior management, usually the board, must approve the policies and controls that follow from the assessment, and in practice should approve or at least review the assessment itself. Boards should challenge it: does it reflect the business as they understand it, and are the actions being delivered?

Ownership of the assessment is one reason the MLRO appointment matters so much. An MLRO who can build an evidence-based, firm-specific assessment is far more valuable than one who updates a template. Our page on MLRO recruitment (SMF17) covers what to look for, and for smaller firms where one person holds both functions, our page on combined compliance officer and MLRO recruitment applies.

Common Weaknesses Supervisors Find

What Good Looks Like

A strong business-wide risk assessment is specific, evidence-based and alive. It describes this firm, uses its data, explains its reasoning, links clearly to controls and resources, and changes when the business does. It is short enough for the board to read and engage with, with the detailed analysis in appendices. And it is owned by an MLRO who uses it to run the function, not filed away until the next review.

Firms without the internal capacity to produce one often bring in an interim MLRO or a fractional MLRO with experience in their sector. As the function grows, a deputy MLRO often takes on much of the analytical work.

Frequently Asked Questions

Is the business-wide risk assessment a legal requirement?

Yes. Regulation 18 of the Money Laundering Regulations 2017 requires firms in scope to identify and assess their money laundering and terrorist financing risks, record the assessment in writing and keep it up to date.

How often should it be updated?

The Regulations require it to be kept up to date. Most firms review it at least annually and whenever there is a material change in the business or the risk environment.

Can a consultant write it for us?

Consultants can help, but the firm must own the conclusions, and the MLRO should be able to explain and defend them. A document the firm doesn’t understand is a weakness, not a control.

Does the board have to approve it?

The Regulations require senior management approval of the policies, controls and procedures that follow from it. Most firms also present the assessment itself to the board for review and approval.

Does it cover sanctions and fraud?

The legal requirement covers money laundering and terrorist financing, but many firms include sanctions and fraud risk in the same assessment, or in linked assessments, because the controls overlap.