ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An AMLR business-wide risk assessment is the documented analysis in which an obliged entity identifies and assesses the money laundering and terrorist financing risks it is exposed to, given its customers, products, services, delivery channels and geographies. Article 10 of Regulation (EU) 2024/1624 sets the requirement, and the Regulation applies from 10 July 2027.
The idea is familiar from the current directives, but the AMLR makes it more detailed and directly applicable. It also links the assessment to the risk variables and factors in Annexes I to III, and to supranational and national risk assessments.
This guide explains what the assessment must cover, how to structure it and how to keep it current. It is general information, not legal advice, and supervisory guidance is still developing, so confirm the current position with your competent authority.
Article 10 requires obliged entities to take appropriate measures, proportionate to their nature and size, to identify and assess the risks of money laundering and terrorist financing to which they are exposed. The assessment has to take account of the risk variables in Annex I and the risk factors in Annexes II and III.
It must also consider the supranational risk assessment of the European Commission, national risk assessments, relevant international standards and guidance from competent authorities, and the composition of the entity’s own customer base. Before launching a new product, service, channel or technology, or entering a new customer segment or geography, the entity must assess the associated risks.
The text is available on EUR-Lex at Regulation (EU) 2024/1624 on EUR-Lex. For the wider regulation, see our explanation of the AMLR and 2027 application and AMLR vs AMLD.
As described in commentary on the Article, the compliance officer prepares the assessment and the management function of the management body approves it, with the supervisory function informed where there is one. Having a named owner and a documented approval is part of demonstrating control.
The role of the compliance officer is discussed in AML compliance officer under the AMLR. The officer should have enough authority and resources to gather information across business lines, which is often the hardest part of the job.
Keep the approval record with the assessment: date, version, who approved it and any conditions. Supervisors can ask for the document, so it must be easy to produce.
| Element | What Article 10 expects | Practical evidence |
|---|---|---|
| Scope | Risks proportionate to nature, size and complexity | Scope statement |
| Inputs | Annex I variables, Annex II and III factors, EU and national assessments, supervisor guidance | Source list |
| Analysis | Customers, products, services, channels, geographies | Risk matrix |
| Approval | Prepared by the compliance officer, approved by management | Approval record |
| Maintenance | Kept up to date, reviewed regularly, available to supervisors | Review log |
Decide what the assessment covers. A group with several entities may assess at entity and group level. A firm with several business lines should assess each line as well as the whole. State the period covered and the data cut-off date.
Set out the method in a short document: the risk categories, the scales for inherent risk and control effectiveness, the way residual risk is derived and the thresholds for action. Keep the scoring simple and explain it in words.
Record how the method reflects proportionality. A small firm with few clients may use a simpler approach than a large bank, but both must document the reasoning.
Work through the main categories. Customers: types, legal forms, complex ownership structures, politically exposed persons and high-risk sectors. Products and services: those that allow anonymity, fast movement of funds or cross-border flows. Delivery channels: non-face-to-face, use of intermediaries, digital onboarding. Geographies: customers, transactions and counterparties in higher-risk countries.
Use data. Count customers by risk class, transactions by region, cash volumes, use of intermediaries and alerts generated. Compare to the Annex II and III factors. Note the assumptions and the data sources.
Two areas get special attention: politically exposed persons, covered in AMLR politically exposed persons, and cash, discussed in AMLR cash payment limit. Both may change your risk picture.
For each risk, describe the controls in place: customer due diligence, monitoring, screening, training, reporting and governance. Rate their design and their operation. The difference between standard and enhanced measures is explained in CDD vs EDD. Ownership checks matter, as shown in beneficial owner 25 percent.
Test the controls where possible. Sample files, review alert handling, check the timeliness of reports and confirm that screening lists are updated. Reports of suspicious transactions have deadlines, see suspicious transaction report deadline.
Derive residual risk, then decide on actions: improve controls, limit certain products or customers or accept the risk with approval. Record each action with an owner and date.
The assessment must be documented, kept up to date and regularly reviewed. Set a review cycle, such as annually, and define triggers: a new product, a new market, a significant change in customer mix, a major incident, a change in law or new supervisory guidance. The European Anti-Money Laundering Authority, AMLA, has consulted on draft guidelines on business-wide risk assessment, so check whether final guidance has been published.
Keep a version history and a change log. Supervisors may ask not only for the current version but also for the reasoning behind changes.
Link the assessment to your policies, procedures and controls. The AMLR expects internal policies to reflect the risks identified, so a change in risk should lead to a change in controls.
Consider a mid-sized payment firm that plans to add a service for business customers in a new country. The compliance officer compiles customer data, expected flows and counterparties. The assessment rates the country and the new channel as higher risk. Existing controls cover basic screening and transaction monitoring, but not enhanced ownership checks for complex structures.
The assessment concludes that residual risk is medium-high until the firm adds an enhanced onboarding procedure and expands monitoring scenarios. Management approves the launch with conditions and dates for completing the controls. The example is invented, but it shows how an AMLR business-wide risk assessment supports a decision before a product goes live.
Record the outcome and revisit after six months to verify the controls work.
Supervisors can request the assessment, and weak or missing assessments are a common finding in AML inspections. The new authority, AMLA, will have direct supervisory powers over selected entities and coordinating powers over national supervisors, as explained in AMLA direct supervision.
Preparing early is sensible. Cost depends on size, data quality and the maturity of existing controls, as discussed in AML compliance cost.
Treat the assessment as a management tool, not a filing exercise. The best ones lead to visible changes in onboarding, monitoring and training.
The first mistake is copying the national risk assessment and calling it your own. The assessment must reflect your customers, products and channels, even if it draws on national and EU material. The second is relying on judgment with no data: if nobody counted high-risk customers or cross-border flows, the ratings are opinion. The third is forgetting that new products and markets need assessment before launch, not after.
A fourth mistake is leaving controls out. An inherent risk rating with no view of how well controls work cannot drive decisions. A fifth is weak governance: no approval record, no version history, and no link to policies. The last is treating the AMLR business-wide risk assessment as static. Update it when events change the risk, and record why.
Work backwards from 10 July 2027. In the next few months, build the data sources and agree the method. By the end of this year, complete a first full assessment and identify control gaps. During the first half of 2027, implement the changes, train staff and update policies, then refresh the assessment so it reflects the controls actually in place at the application date. Watch for final AMLA guidelines and national supervisory statements, and adjust the AMLR business-wide risk assessment when they arrive.
Creating the method, scales, registers and reports from scratch is slow. A prepared set of templates gives you a structure that follows the regulation’s own chapters.
The EU AMLR Toolkit provides 99 editable templates for obliged entities under Regulation (EU) 2024/1624, in 17 sections that follow the Regulation’s chapter structure. Use the business-wide risk assessment materials as the starting point and adapt them to your business lines and data.
Whichever route you choose, agree your method with compliance, risk and the business before you start, so the AMLR business-wide risk assessment reflects how the firm really operates.
It is the documented assessment of money laundering and terrorist financing risks that an obliged entity must carry out under Article 10 of Regulation (EU) 2024/1624.
The Regulation applies from 10 July 2027, so preparation should begin well before then.
The management function of the management body approves the assessment, which the compliance officer prepares.
It must be kept up to date and regularly reviewed, and updated when events significantly affect the risks.
Obliged entities of all sizes must assess risk, but the depth is proportionate to their nature, size and complexity.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026