Business-Wide Risk Assessment: How Often to Review It and What Triggers an Update

The business-wide risk assessment (BWRA) is the single most important document in an AML program. It is the evidence that your firm understands how it could be used for money laundering or terrorist financing — and it is the justification for every control you operate. When supervisors inspect a firm, it is usually one of the first documents they ask for.

This guide covers what a business-wide risk assessment should contain, how to carry one out, and — the question compliance teams ask most often — how often it needs to be reviewed and what should trigger an update in between.

What the business-wide risk assessment is for

FATF Recommendation 1 requires firms to identify, assess and understand their money laundering and terrorist financing risks, and national laws turn this into a concrete obligation. In the EU and UK, for example, firms must carry out a written risk assessment, keep it up to date and make it available to their supervisor on request.

The BWRA is different from customer risk assessments. A customer risk assessment rates an individual relationship. The BWRA looks at the firm as a whole: which parts of the business are most exposed, and whether the controls in place are adequate. The two are linked — your BWRA should shape the methodology you use to rate customers.

The risk factors to assess

The FATF framework, mirrored in most national guidance, groups risk into a handful of categories. Your BWRA should cover each one.

Customers. Who you serve: individuals or companies, residents or non-residents, complex ownership structures, cash-intensive businesses, politically exposed persons, and sectors known to be higher risk.
Geography. Where your customers are based, where their money comes from and goes to, and where you operate. Sources include the FATF lists of high-risk jurisdictions and jurisdictions under increased monitoring, national and supranational risk assessments, and credible information on corruption and sanctions.
Products and services. What features make a product attractive to criminals: anonymity, speed, cross-border reach, the ability to move value to third parties, high transaction limits.
Transactions. Volumes, values, cash, complexity and unusual patterns.
Delivery channels. How customers reach you: face to face, remote onboarding, introducers and intermediaries, agents.

Depending on your sector you may add others — for example, new technologies, or the risks of particular distribution partners.

How to carry out the assessment

1. Gather your inputs

A good BWRA draws on both external and internal information.

External: the national risk assessment for each country you operate in, supranational assessments (such as the European Commission's), FATF publications, guidance from your supervisor, and typologies published by financial intelligence units.
Internal: customer base data by risk factor, product and transaction volumes, suspicious activity reports filed, monitoring alerts, audit findings, and incidents.

2. Assess inherent risk

For each risk factor, assess the level of risk before taking your controls into account. Use a consistent scale — for example low, medium, high — and define what each level means so different people reach the same conclusion.

3. Assess your controls

Map the controls that mitigate each risk and evaluate how well they work. Be honest: a control that exists on paper but has known gaps shouldn't be scored as strong. Audit findings and testing results are the best evidence here.

4. Determine residual risk

Residual risk is what remains after controls. Where residual risk is above your firm's risk appetite, you need an action plan: strengthen controls, change the product, restrict the customer segment, or formally accept the risk at the appropriate level of seniority.

5. Document and approve

Write up the methodology, the data, your conclusions and the action plan. Senior management should review and approve it — that approval is evidence of oversight and is something supervisors will look for.

6. Make it drive your program

The BWRA should feed directly into your policies, your customer risk rating methodology, your monitoring scenarios and your training. If a supervisor can't trace a line from a risk you identified to the controls that address it, the assessment isn't doing its job.

How often should the risk assessment be reviewed?

Most regimes require the assessment to be kept up to date but don't set a fixed interval. In practice, supervisors widely expect:

A full review at least annually, documented and approved by senior management. Higher-risk or fast-growing firms may review more often.
An ad-hoc review whenever something material changes — without waiting for the annual cycle.

The annual review isn't a box-ticking exercise. Refresh the data, re-test the conclusions, record what changed and why, and update the action plan. A risk assessment that is "reviewed" every year with no changes for several years in a row is a red flag for supervisors, especially if the business has grown.

For a side-by-side look at how often the risk assessment, policies and training are typically reviewed, Regmindr has a useful guide: how often should you review your AML risk assessment, policies and training?

Triggers for an out-of-cycle update

Build a list of trigger events into your policy, so the decision to update isn't left to chance. Common triggers include:

Launching a new product, service or delivery channel, or significantly changing an existing one. Many regimes require you to assess the risk before launch.
Entering a new market or onboarding a significant new customer segment.
New or updated national or supranational risk assessments.
Changes to FATF lists affecting countries you have exposure to.
New sanctions regimes relevant to your customers or markets.
Significant audit findings, supervisory findings or incidents — for example, a case where your controls failed to detect suspicious activity.
Regulatory change, such as the EU's new Anti-Money Laundering Regulation, which applies from 10 July 2027.
Mergers, acquisitions or major restructuring.

Each trigger review should be documented, even if the conclusion is that no change is needed.

Common weaknesses supervisors find

Generic content. An assessment that could describe any firm in the sector, with no data specific to yours.
No link to controls. Risks are identified, but policies and monitoring don't reflect them.
Inherent and residual risk confused. Rating risks low because controls exist, without assessing the underlying exposure.
Out of date. Last reviewed years ago, or not updated after a major business change.
No senior management engagement. No evidence that the board or senior management reviewed, challenged and approved it.

Key takeaways

The BWRA assesses your firm's exposure across customers, geography, products, transactions and delivery channels.
Assess inherent risk, then controls, then residual risk — and act where residual risk exceeds appetite.
Review it at least annually, and whenever a defined trigger event occurs.
It must drive your policies, customer risk ratings and monitoring. That link is what supervisors test.

The BWRA is the starting point of a risk-based AML program. Regpin helps compliance teams build, maintain and evidence their risk assessments alongside the rest of the program — book a demo to see it in action.

This article is general information, not legal advice. AML obligations vary by jurisdiction, sector and firm, so confirm the specific requirements that apply to you with your supervisor's guidance or a qualified adviser.