Building an obliged entity’s risk assessment

Describe exposure before controls

List services, client types, one-off transactions and relationships, volumes, payments, channels and geography. For office and ready-made company services, distinguish address provision, formation, share sales, representation and ongoing administration. Each involves different persons, evidence and misuse possibilities. A generic low-risk administration label requires substantive reasons.

Consider national and supranational assessments, Annex 2 of the AML Act, relevant chamber materials and other Section 21a evidence. Select findings relevant to your services. Published guidance does not justify copying impossible scenarios while ignoring known weaknesses in your operation.

Assign controls and residual risk

For each scenario record likelihood or significance, evidence, controls and remaining risk. An opaque ownership chain needs actual structural identification and verification, not only added points. Risk labels should trigger action, responsibility and escalation. A calculation without factor explanations is difficult to evidence.

Keep statutory triggers separate: PEPs and relevant high-risk countries have mandatory enhanced branches. Low service cost or turnover cannot offset a sanctions prohibition. Controls are effective according to actual implementation. Inability to verify owners or escalate concerns is not a functioning control just because a template says it exists.

Approval and updates

Link assessment to policies and training. For the written branch retain approved versions and update under Section 21a(3), particularly before products or technologies affecting risk management. Remote identification or new client countries may change the process. Record triggers, factors, decisions and evidence that staff use the revised procedure.

Test risk against the actual process

Walk through one typical client’s path from first contact to performance. Identify where identity, structure, purpose and funds are actually verified and where declarations are merely collected. Describe weaknesses specifically: who could exploit them, missing evidence and why it matters. Do not invent improbable scenarios unrelated to the service, but do not label an unavailable source as an operational control.

For ineffective controls, assign remediation, responsibility and verification. This may involve evidence, worker access or cover rather than new software. Assessment must reflect actual operation after changes. Preserve the old version and explain a changed residual-risk conclusion. A numeric score assists decisions; without links to facts and implemented measures, it does not itself provide sufficient reasoning.