Business-Wide Risk Assessment under AMLR: Methodology, Data and Governance

A business-wide risk assessment (BWRA) should explain where an organisation is exposed to money laundering, terrorist financing and targeted financial sanctions risks. It should also demonstrate how significant those risks are, whether existing controls mitigate them effectively and what risk remains after mitigation.

Under Article 10 of Regulation (EU) 2024/1624 (AMLR), obliged entities must identify and assess the ML/TF risks to which they are exposed, as well as risks related to the non-implementation and evasion of targeted financial sanctions (TFS). AMLA’s 2026 draft Guidelines provide a proposed common framework for translating this obligation into a practical business-wide risk assessment.

The four building blocks proposed by AMLA

AMLA’s draft Guidelines organise the BWRA around four minimum requirements. Together they create a traceable sequence from the business model through to the organisation’s remaining exposure after controls have been considered.

Business model → inherent risk → controls → control effectiveness → residual risk → management action. This chain is more useful than a risk assessment that simply produces a score without explaining how the result was reached.

1. Start with the business, not with the scoring model

A common weakness in risk assessments is starting with a spreadsheet of generic risk factors before clearly describing the organisation being assessed.

The starting point should instead be a sufficiently detailed understanding of:

• legal and organisational structure,
• business lines and regulated activities,
• products and services,
• customer populations and segments,
• types and volumes of transactions or activities,
• delivery and onboarding channels,
• geographical exposure,
• outsourcing and third-party dependencies,
• AML/CFT governance and resources,
• systems and data supporting AML controls,
• planned changes to the business model.

A cross-border crypto-asset business serving retail and corporate customers should not begin with the same risk architecture as a small professional services firm with a limited domestic customer base. The methodology should reflect the actual business rather than force the business into a generic template.

2. Define the risk universe

Once the operating model is understood, the organisation can identify the risks arising from its activities. Article 10 AMLR and AMLA’s draft approach place particular emphasis on customers, products and services, transactions, delivery channels and geography.

3. Assess inherent risk before controls

AMLA’s draft defines inherent risk as the ML/TF and relevant TFS exposure arising from the organisation’s activities before mitigating measures are applied.

This distinction prevents strong controls from disguising the underlying nature of the business. For example:

• cross-border crypto transfers may remain inherently higher risk even where blockchain analytics are sophisticated,
• complex corporate structures may create elevated ownership risk even where KYB controls are mature,
• high-volume international payments may create significant inherent monitoring exposure despite an established transaction-monitoring system.

Separating inherent risk from control effectiveness allows management to see where the organisation depends most heavily on the quality of its control environment.

4. Use data that reflects actual exposure

A BWRA should not rely only on workshops and expert judgement. Quantitative information can make the assessment more evidence-based, reproducible and easier to challenge.

Depending on the business model, relevant data may include:

• customers by risk category and type,
• customer and beneficial-owner geography,
• PEP and higher-risk customer populations,
• product usage and transaction volumes,
• cross-border flows and higher-risk jurisdictions,
• onboarding channels,
• alerts, investigations and internal escalations,
• suspicious transaction or activity reports,
• screening alerts and matches,
• overdue KYC or CDD reviews,
• audit, Quality Assurance and control-testing results,
• remediation backlogs, incidents and supervisory findings.

5. Build a scoring methodology that can be explained

A sophisticated formula does not automatically create a better risk assessment. The methodology needs to produce a result that can be understood, challenged and reproduced.

The methodology should clearly define:

• risk factors and measurement criteria,
• scoring scales and risk categories,
• weightings,
• aggregation rules,
• treatment of missing or incomplete data,
• use of qualitative judgement,
• override mechanisms,
• documentation and governance of methodology changes.

AMLA’s draft expects risk-based weighting and documented rationale. A useful challenge is therefore:

6. Assess control quality, not merely control existence

After inherent risk has been assessed, the organisation needs to determine the quality of controls used to mitigate that exposure. This requires looking beyond whether a procedure exists.

Evidence of control quality may include:

• compliance monitoring,
• Quality Assurance results,
• internal and external audit findings,
• control testing,
• KYC/KYB defect rates,
• transaction-monitoring QA,
• screening effectiveness testing,
• remediation status,
• management information,
• supervisory findings.

A policy stating that a control exists is not evidence that the control is effective. This is why BWRA, AML audit and Quality Assurance should form part of the same control environment rather than operate as disconnected exercises.

7. Determine and challenge residual risk

Residual risk is the exposure remaining after mitigating policies, procedures, systems and controls have been considered.

Inherent risk + control effectiveness → residual risk

The result should still be challenged rather than accepted automatically. Warning signs include:

• very high inherent risk becoming low residual risk solely because controls receive high scores,
• significant audit findings having no impact on control effectiveness,
• large remediation backlogs not affecting residual risk,
• rapid growth or major business changes not changing the assessment,
• known system limitations not being reflected in the result.

8. Connect BWRA with customer risk assessment

The business-wide risk assessment and individual customer risk assessment are distinct, but AMLA’s draft makes clear that they should inform one another.

Customer-level results can provide important information about the organisation’s overall exposure. At the same time, conclusions from the BWRA should influence the way the institution assesses customers exposed to particular products, services, jurisdictions, characteristics and delivery channels.

If the BWRA identifies a material risk that is barely recognised in customer-risk methodology, the frameworks are inconsistent. The same applies where a material population of higher-risk customers has no meaningful impact on the organisation’s overall assessment.

9. Translate BWRA into actual AML controls

A business-wide risk assessment should not end when the document is approved. The conclusions should influence policies, procedures, controls and resource allocation.

Elevated cross-border payments risk
→ transaction-monitoring scenarios and investigation standards should reflect the exposure.

High beneficial-ownership complexity
→ KYB, ownership verification and Enhanced Due Diligence should be sufficiently robust.

Material exposure to particular jurisdictions
→ screening, customer-risk methodology, EDD and monitoring should incorporate that exposure.

Higher risk of TFS circumvention
→ relevant sanctions controls, data, escalation mechanisms and governance should be reviewed accordingly.

10. Establish clear governance and ownership

AMLA’s current draft proposes that the BWRA should be drawn up by the Compliance Officer, approved by the management body in its management function and, where applicable, communicated to the management body in its supervisory function.

The framework should also ensure that the BWRA is:

• documented,
• kept up to date,
• reviewed regularly,
• available to supervisors upon request,
• understood by employees whose roles require it,
• used to drive improvements to policies, procedures and controls.

External advisers can assist with development of the BWRA, but the obliged entity retains ownership. It should understand and be able to explain the methodology, assumptions, data, results and resulting actions.

11. Define when the BWRA must be revisited

A periodic review cycle is important, but material business changes can require the assessment to be reconsidered before the next scheduled update.

Potential triggers include:

• a new product or service,
• entry into a new jurisdiction,
• new customer segments,
• material growth in customers or transaction volumes,
• acquisition, merger or structural change,
• significant outsourcing changes,
• new technology or systems,
• material AML or sanctions incidents,
• significant audit or supervisory findings,
• new typologies or external threats.

12. Turn residual risk into an action plan

A mature BWRA should lead to management decisions. Where residual exposure remains too high or controls are insufficient, the organisation should define concrete actions.

These may include:

• policy or procedure changes,
• control redesign,
• system changes,
• transaction-monitoring recalibration,
• KYC/KYB remediation,
• additional Quality Assurance,
• targeted training,
• enhanced resources or management information,
• changes to risk appetite,
• restrictions on particular activities.

Common weaknesses in business-wide risk assessments

• copying a generic sector template without adapting it to the actual business,
• describing theoretical risk factors without measuring real exposure,
• mixing inherent and residual risk,
• using arbitrary scoring or weightings,
• giving controls credit without evidence of effectiveness,
• failing to reflect audit or QA findings,
• weak linkage with customer-risk assessment,
• weak linkage with transaction monitoring and other operational controls,
• ignoring risks related to non-implementation or evasion of TFS,
• treating management approval as a formal exercise,
• failing to translate residual risk into remediation.

A practical AMLR readiness review

Organisations do not need to wait until AMLR applies to understand whether their current BWRA will meet the direction of the new framework. A readiness review can be structured around six questions.

The objective should not be to produce the longest possible document. A strong BWRA should allow management to understand, challenge, operate and evidence the organisation’s risk-based approach.

How APOG supports business-wide risk assessment

APOG supports regulated businesses and obliged entities with:

• BWRA methodology design and independent review,
• mapping of business activities and risk factors,
• inherent-risk assessment,
• data and indicator selection,
• control-effectiveness assessment,
• residual-risk methodology,
• alignment with customer-risk assessment,
• connection between BWRA and transaction monitoring,
• governance and management reporting,
• remediation planning and closure validation.

Official sources

• Regulation (EU) 2024/1624 — AMLR
• AMLA — Consultation on draft Guidelines on business-wide risk assessment
• AMLA — Consultation Paper on draft Guidelines under Article 10(4) AMLR

This article provides a practical interpretation of AML/CFT risk-assessment requirements and does not constitute legal advice. As at 17 August 2026, AMLA’s Guidelines on business-wide risk assessment remain in draft form. The public consultation closed on 15 July 2026 and AMLA has indicated that the final Guidelines are expected in Q4 2026. The final requirements may differ from the consultation draft.