A risk assessment is the foundation of an AML compliance program. Every policy, control, and monitoring rule should trace back to risks identified in that assessment. When the assessment itself has gaps, everything built on top of it inherits the same blind spots. Here are five gaps we see often.
1. Treating the Risk Assessment as a One-Time Exercise
A risk assessment reflects a snapshot in time. New products, new geographies, growth in customer volume, or changes in delivery channels (like adding online account opening) all change the institution's risk profile. A risk assessment that hasn't been updated in several years is unlikely to reflect current exposure.
2. Underweighting Delivery Channel and Geographic Risk
It's common to see thorough analysis of customer-type risk, but thinner analysis of how customers are onboarded (in person versus remote) and where transactions or customers are geographically concentrated, including exposure to higher-risk jurisdictions.
3. Disconnecting the Assessment From Actual Controls
A risk assessment should drive the design of controls, such as transaction monitoring thresholds and customer due diligence requirements. When the two are developed separately, institutions often end up with controls that don't actually address the risks the assessment identified.
4. Relying Only on Inherent Risk, Not Residual Risk
Inherent risk describes exposure before controls are applied; residual risk describes what's left after controls are in place. A thorough risk assessment evaluates both, and the strength of existing controls, rather than treating the two as the same thing.
5. Missing Input From the Business Lines
Risk assessments built solely by compliance staff, without input from product, sales, or operations teams who understand how customers actually use the institution's products, often miss risk exposures that surface only in day-to-day operations.
Getting It Right
A strong risk assessment is revisited on a regular cycle, incorporates input from across the business, and produces a clear, defensible narrative connecting identified risks to the specific controls designed to address them.