How to Write an AML Risk Assessment: A Step-by-Step Guide

An AML risk assessment is required before building your AML program — and must be updated at least annually thereafter. Writing one correctly requires understanding both what the assessment must cover and how to document it in a way that satisfies FinCEN's expectation that your program is "reasonably designed" for your specific business.

Step 1 — Describe Your Business

Before assessing risk, document your business clearly and specifically. What products and services do you offer? What is the specific mechanism by which money flows through your platform? Who are your customers — their demographic profile, geographic distribution, industry composition, and risk characteristics? What delivery channels do you use to onboard and serve customers?

This business description is the context for everything that follows. Examiners use it to evaluate whether your risk assessment accurately reflects your actual business.

Step 2 — Assess Customer Risk

Evaluate the money laundering risk presented by your customer base. Consider what percentage of customers are high-risk categories — PEPs, non-residents, customers from high-risk jurisdictions, customers in high-risk industries.

Assign a risk rating — typically low, medium, or high — to your overall customer base based on this analysis, and define the criteria that would place an individual customer in each tier.

Step 3 — Assess Product and Service Risk

Evaluate the money laundering risk of each product and service your business offers. Higher-risk product characteristics include anonymity or near-anonymity, high velocity, cross-border capabilities, and cash equivalency.

Assign a risk rating to each product and explain the rationale.

Step 4 — Assess Geographic Risk

Evaluate the geographic risk of your operations. Which countries do your customers come from? Which countries do transactions flow to? Are any of these countries on the FATF grey or black list? Are any subject to OFAC sanctions programs?

Assign a geographic risk rating and document the specific countries and risk factors you have identified.

Step 5 — Assess Delivery Channel Risk

Evaluate the risk created by how customers access your products. Digital-only onboarding, third-party intermediaries, and high-volume API access each create elevated delivery channel risk. Document the specific delivery channels you use and their associated risk characteristics.

Step 6 — Determine Inherent Risk

Combining your assessments across the four risk categories — customer, product, geography, and delivery channel — determine your overall inherent risk before controls are applied. Document this conclusion and the reasoning that supports it.

Step 7 — Map Controls to Risks

For each identified risk area, document the specific controls you have in place to mitigate that risk — KYC procedures, transaction monitoring rules, sanctions screening, EDD requirements. Explain how each control addresses the specific risk it is designed to mitigate.

Step 8 — Determine Residual Risk

After accounting for your controls, document your residual risk — the risk that remains. Most fintech businesses land at medium to medium-high residual risk, which is normal and manageable.

Step 9 — Get Senior Management Approval

Present the completed risk assessment to senior management and obtain documented approval. This approval signals that leadership has engaged with and accepted the compliance program design reflected in the assessment.

Frequently Asked Questions

How long should an AML risk assessment be?

Length varies with business complexity. A straightforward early-stage fintech with a simple product and narrow customer base may produce a thorough assessment in 10 to 20 pages. A complex multi-product platform with diverse customer types and international operations may require significantly more.

How ComplyOne Helps

ComplyOne helps fintechs conduct and document AML risk assessments that satisfy FinCEN requirements and sponsor bank expectations — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.