An enterprise-wide AML risk assessment is the institution's documented view of the money laundering and terrorism financing risks it faces, how well its controls manage them, and the residual risk that remains. This guide gives a seven-step template: scope, inherent risk, controls, residual risk, actions, board approval and refresh.
The 2018 AMLA implementing rules require covered persons to identify, assess and understand their ML/TF risks, and to run an institutional risk assessment at least once every two years. They do not prescribe a scoring method. The template is a practical structure aligned to those rules and to FATF guidance, to be scaled to your size and complexity, and BSP-supervised institutions should check BSP issuances for any additional requirement.
What is an enterprise-wide risk assessment, and what do the rules require?
It is the institution-level assessment that every other AML control should trace back to, and the rules require it to be done and refreshed.
Rule 2 of the 2018 implementing rules defines an institutional risk assessment as a comprehensive exercise to identify, assess and understand a covered person's ML/TF threats. Rule 15 requires covered persons to take appropriate steps to identify, assess and understand their ML/TF risks, and to conduct the assessment at least once every two years. It also requires the board to exercise active control and supervision over institutional risk management.
FATF's Recommendation 1 sets the international standard, and its interpretive note expects institutions to document their assessments, in order to demonstrate their basis, and to keep them up to date. FATF's risk-based approach guidance for banks dates from October 2014 and predates the 2025 revisions to Recommendation 1, so read it alongside the current text.
How is it different from customer risk rating?
An enterprise-wide assessment rates the institution, while customer risk rating rates each customer, and each should inform the other.
The institution-level view asks which products, channels, geographies and customer segments expose the bank to the most risk, and whether controls are strong enough. The customer-level view, covered in our guide to customer risk rating reviews, assigns a rating to each relationship. The aggregate of customer ratings is a core input to the institutional assessment, and the institutional assessment sets the logic that customer ratings should follow.
Step 1: How do you define scope and method?
Fix the scope, the scale, the data sources and the owners before scoring anything.
Decide which legal entities, business lines and products are in scope. Choose a rating scale, for example low, moderate and high for inherent risk and strong, acceptable, inadequate and weak for controls. The Insurance Commission's Circular Letter 2024-16 on institutional risk assessment uses scales of that kind and asks that the method be suited to the institution's risk and context. It applies to insurers, not to banks, but it is a Philippine regulator's published method and a useful reference.
Name an owner for each factor and for the document as a whole. Use both quantitative data, such as counts and volumes, and qualitative judgement from the business. A lean team can keep the method simple, provided it is written down and applied the same way each cycle.
Step 2: How do you assess inherent risk?
Rate the risk the institution carries before any controls, factor by factor, using data you can show.
The Insurance Commission's circular groups inherent risk into products and services, customers, geographic location, delivery channels and transactions, and sanctions exposure. Those headings translate well to a bank or e-money issuer. The table below pairs each with the questions to ask and the evidence to use.
| Factor | Questions to ask | Evidence to use |
|---|---|---|
| Customers | How many are high-risk, politically exposed or non-resident? How concentrated is the book? | Customer counts by risk rating, PEP counts, segment mix |
| Products and services | Which products move value quickly, anonymously or across borders? | Volumes and values by product, cash intensity, new products launched |
| Delivery channels | How much onboarding and activity is non-face-to-face or through intermediaries? | Share of remote onboarding, agent and partner volumes |
| Geography | What flows and customers connect to higher-risk jurisdictions? | Cross-border flows by corridor, customer residency |
| Transactions | What volumes, velocities and patterns appear in activity? | Alert volumes, STR counts, covered transaction report counts |
| Sanctions exposure | How likely is contact with designated persons or jurisdictions? | Screening hit rates, true-match history, payment corridors |
Score each factor and explain the score in a sentence. An inherent rating of "high" for a product is a finding about the business, not a criticism of the compliance team.
Step 3: How do you rate the controls?
Rate each control area on the evidence that it works, and cite the evidence beside every rating.
The control areas are governance and oversight, the written prevention programme, customer due diligence, transaction monitoring, name screening and targeted financial sanctions, reporting, training, and independent testing. Rate each as strong, acceptable, inadequate or weak, and record what supports the rating: test results, audit findings, alert quality reviews, closed-case samples, training completion and the status of earlier findings.
A rating that rests on "the policy exists" will not survive review. The monitoring calibration records that show rules are tested, and the independent testing results that show who verified them, are the evidence that moves a rating from "acceptable" to "strong".
Step 4: How do you determine residual risk?
Combine inherent risk with control quality, and let the weaker of the two drive the conclusion where they conflict.
Residual risk is the risk that remains after controls. The matrix below is illustrative. Adapt the cells to your own appetite, and keep the rationale for any cell that differs from the default.
| Inherent risk | Strong controls | Acceptable | Inadequate | Weak |
|---|---|---|---|---|
| Low | Low | Low | Moderate | Moderate |
| Moderate | Low | Moderate | Moderate | High |
| High | Moderate | Moderate | High | High |
Two rules keep the matrix honest. Residual risk should never be lower than the evidence for the controls supports, and a high inherent risk with weak controls should always reach the board. The Insurance Commission's circular states that the residual rating reflects whether identified risks are adequately managed, and it ties the result to the need for further preventive measures.
Step 5: How do you turn findings into an action plan?
Every moderate or high residual risk needs an owner, an action, a date and a measure of success.
Link each action to the risk it addresses. A high residual risk in a remote-onboarding channel might lead to tighter verification, new monitoring scenarios and a shorter review cycle for those customers. The Insurance Commission's circular allows simplified measures for lower risks, except where money laundering or terrorism financing is suspected. Track actions in the same register that holds audit findings, so the board sees one list of open items, and feed the changes into customer risk rating and monitoring rules.
Step 6: What does board approval involve?
The board should receive the assessment, challenge it and approve the actions, and the minutes should show that it did.
Rule 15 requires the board to exercise active control and supervision, and Rule 4 makes the board ultimately responsible for compliance. The Insurance Commission's circular asks that the assessment report, with findings, action plans and any policy amendments, go to the board for approval, with management reporting progress on the action plans. A short paper that gives the residual risk by factor, the top five actions and the changes since the last cycle is more useful to a board than a full methodology.
Step 7: When should the assessment be refreshed?
At least every two years, and sooner when something material changes.
The two-year minimum comes from Rule 15. Triggers for an earlier refresh include a new product or channel, a merger or acquisition, a sharp rise in transaction volume or in STRs, a new typology, and a change in the regulatory framework. The Insurance Commission's circular lists similar triggers. Some institutions refresh higher-risk lines annually and treat the two-year cycle as a floor. For lean institutions, our guide to AML for rural and cooperative banks covers how to scale the work.
Which mistakes make an assessment fail review?
Six mistakes recur, and each one shows up in a sample of the document.
- 01Copied from a template. Nothing in it is specific to the institution's products, channels or customers.
- 02No data. Ratings are opinions, with no counts, volumes or test results behind them.
- 03Controls rated on policy. The rating cites a document, not evidence that the control operated.
- 04Residual equals inherent. Controls are assumed to be perfect, or ignored.
- 05No link to monitoring. Rules and thresholds do not trace back to the assessed risks.
- 06Not refreshed. The scores are unchanged from the last cycle despite new products or a changed customer base.
An examiner reading the assessment should be able to see how the institution reached its view, and how that view changed the programme. That also supports preparation for the 2027 mutual evaluation, where the focus is on effectiveness. For the wider supervisory context, see our BSP Circular 950 compliance guide.
What data should feed the assessment?
The operational data an AML platform already holds is the most reliable source for the transactions, customers and controls rows.
Alert volumes by rule, STRs filed by product and channel, case outcomes, customer counts by risk rating and the age of overdue reviews all come from the monitoring, case and customer systems. Some institutions run the assessment in spreadsheets, and others use AML risk assessment software or a wider platform that holds the data. Fyscal ARCX does not produce the assessment itself, because the judgement and the board decision belong to the institution. It keeps the underlying evidence in one place, so the figures in the table above can be pulled and dated, not rebuilt each cycle. If you want to see how that evidence is organised, book a walkthrough of Fyscal ARCX and bring your last assessment to work from.