AML Risk Assessment: What the FFIEC Manual Says
Examiners start with the risk assessment because it shapes everything else in a BSA/AML program. What the FFIEC manual says it must contain, and what it leaves to the bank.
| Published |
|---|
An AML risk assessment is a document. It says where a bank's money laundering and terrorist financing risks sit. The FFIEC manual says examiners must understand a bank's money laundering and terrorist financing risks to evaluate its BSA/AML compliance program. The assessment is how they get there, and how the bank shows its own thinking. It sits at the base of the AML program, not on top of it. Controls are sized to the risks the assessment finds. A weak one weakens every part of BSA anti money laundering work. For readers new to the field, it helps to start with what is AML anti money laundering before reading further. This page covers the assessment itself: what it is, how the two-step process works, and what the rules leave open. It answers the question of whether a required template exists, and the answer is no. It also covers how the assessment feeds monitoring. Money services businesses are covered too, under FinCEN's own guidance.
What an AML risk assessment is, and why examiners start there
The FFIEC manual says a bank's BSA/AML risk assessment should give a full analysis of its money laundering and terrorist financing risks. That word, full, is doing real work. A list of risk areas is not an analysis.
Examiners start there for a simple reason. The FFIEC manual says the bank structures its BSA/AML compliance program to address its risk profile and to comply with BSA regulatory requirements. If the exam team cannot see the risk profile, it cannot judge whether the program fits. The assessment is the map the rest of the exam follows.
One caution from the manual belongs here. The FFIEC manual says an examiner-developed BSA/AML risk assessment generally is not as comprehensive as one developed by the bank. The bank knows its own business.
No single indicator decides the risk
The analysis looks at more than one indicator. The FFIEC manual says a single indicator does not by itself determine whether risk is lower or higher. The assessment is where those judgments get made and written down.
The two-step process
The manual describes the work in two steps. First, the bank identifies its risk categories. Second, it analyzes them. The FFIEC manual says the second step of the risk assessment is analyzing the information gathered when identifying specific risk categories.
Step one is a gathering exercise. It gathers information and identifies the specific risk categories it faces.
Step two is the harder half. For each category, the bank asks how exposed it is, and why. This is where the assessment earns its name. A category listed with no analysis fails the manual's test of a full analysis.
Building a matrix or template: what the rules require
The FFIEC manual says there are no required risk categories and their number and detail vary with a bank's size, complexity, and structure. It also says no method or format is expected for the BSA/AML risk assessment.
A small bank and a large one need not have the same number of categories. The number of categories is a business choice. It is not a failure.
What the manual does expect is that the categories match the bank. Copying another bank's template leaves gaps. The risks are not the same.
Weighting risk factors and documenting the reasoning
Once categories exist, the bank weighs the risk factors. The FFIEC manual says the bank may determine that some risk factors should be weighted more heavily than others. It depends on the business.
The weighting is a judgment, and the manual asks that the judgment be visible. The FFIEC manual says sound practice would be to document the factors considered in the risk assessment, including any weighting.
Who receives the completed risk assessment
An assessment that sits in one person's drive does no good. The FFIEC manual says the BSA/AML risk assessment should be given to all business lines, the board of directors, management, and appropriate staff.
That list is broad on purpose. Business lines need it because they see the customers. Staff need it because the manual says writing it down tells bank personnel about illicit finance risks. The FFIEC manual says writing the BSA/AML risk assessment down is a sound practice to communicate illicit finance risks to bank personnel. A spoken summary at a meeting is not the same thing.
How often to update it, and what triggers an update
There is no fixed schedule. The FFIEC manual says there is no requirement to update the BSA/AML risk assessment on a continuous or specified periodic basis.
But the manual does say what updates should capture. The FFIEC manual says risk assessments are generally updated to include changes in the bank's products, services, customers, and geographic locations. A new product, a new customer type, or a new region should send someone back to the document. The absence of a deadline does not mean the assessment can age quietly.
From assessment to program: monitoring and controls
The assessment is not an end in itself. It drives the controls built on top of it. The FFIEC manual says the bank's monitoring system to identify, research, and report suspicious activity should be risk-based. It also says the sophistication of monitoring systems should be dictated by the bank's risk profile.
Read those two lines together. A bank whose assessment finds little risk does not need the heaviest AML transaction monitoring tools. A bank with a higher risk profile does. Buying a system first and writing the assessment to justify it is the wrong order. The assessment comes first, and the monitoring is sized to match.
Do MSBs need one too
The FFIEC manual speaks to banks, but money services businesses are not left out. FinCEN's guidance says MSBs should assess their exposure to money laundering, terrorism finance, and financial crime risk based on customers, geographies, and products offered. It also says a well-developed risk assessment helps MSBs find and study their own risk profile.
The same logic applies. Each MSB's profile turns on its own customers, geographies, and products. The assessment should say so.