Step 3 - Running your first AML risk assessment

Last updated: April 8, 2026

Learning objectives

By the end of this module, you will:

  • Understand what a business-wide AML risk assessment covers,

  • How to document risks in a way regulators recognize,

  • When that assessment should be reviewed and updated. 

By the time you finish, you’ll have a solid risk assessment in hand that you can feel confident presenting to any regulator.

Introduction: Why the risk assessment matters

Your AML risk assessment is the foundation of your entire compliance program. It is the document regulators use to understand how you think about risk and why you chose certain controls.

This is not an academic exercise. A well-written risk assessment helps you: 

  1. Make consistent decisions, 

  2. Defend those decisions to regulators,

  3. Scale your AML program without constantly reworking it.

At this stage, regulators are not looking for sophistication. They are looking for clarity, structure, and evidence that your approach is intentional.

Section 1: What a business-wide AML risk assessment covers

A business-wide AML risk assessment takes a holistic view of how your business could be exposed to financial crime risk.

It typically considers four core areas. Customer risk focuses on who you serve and who you plan to serve. Product and service risk looks at how your offerings could be misused. Geographic risk considers where your customers and transactions are located. Delivery channel risk examines how customers interact with your business, including onboarding and transaction methods.

The goal is not to list every possible risk. The goal is to identify the most relevant risk drivers for your business model and explain why they matter. For a deeper look at how to structure these categories, this guide on business-wide risk assessments provides a standard framework used by compliance teams.

Section 2: FinTech-specific risk examples

FinTech business models often introduce specific risks that regulators expect to be addressed.

These can include: 

  • Rapid customer onboarding, 

  • Limited face-to-face interaction, 

  • Cross-border activity, 

  • Reliance on third-party providers, 

  • And fast product iteration. 

None of these are inherently problematic, but each can influence your risk profile.

When documenting fintech risks, focus on how your product works in practice. Avoid generic statements. Regulators want to see that you understand your own operating reality.

Pause and reflect. 

If you removed your company name from the risk assessment, would it still clearly describe your business?

To help you move past generic descriptions, you can review these FinTech-specific money laundering typologies that are common in digital-first business models.

Section 3: Documenting assumptions and decisions

At an early stage, your risk assessment will include assumptions. That is expected.

What matters is that assumptions are clearly stated and tied to decisions. 

For example:

  • If you assume a customer segment is lower risk, explain why. 

  • If you choose not to implement a control yet, document the reasoning and what would trigger a change.

Your risk assessment should explain not only what you believe, but how those beliefs inform and influence your controls. This is where your risk-based approach becomes visible.

Clear documentation is often more important than perfect accuracy. Regulators are more concerned with transparency than hindsight precision.

Section 4: Scoring and prioritizing risks

Some firms use numeric scoring to rank risks. Others use qualitative categories such as low, medium, and high.

There is no single correct method. But some factors can help you create a robust system from the get-go:

  • Consistency: Your scoring approach should align with your risk appetite and be applied uniformly across risk areas.

  • Avoiding over complexity: Simple frameworks are easier to explain and maintain, especially at an early stage. 

  • Refining your methodology: As your business grows and your data improves, your AML risk assessment program should evolve and adapt accordingly. A program that stops evolving is bound to fail at some point. 

For a practical look at how to build these scoring models without complex code, this webinar on mastering risk scoring provides a step-by-step demo.

Section 5: When risk assessments should be reviewed

Your risk assessment is not a one-time document. Regulators expect it to be reviewed and updated as your business changes.

Common review triggers include: 

  • Launching new products, 

  • Entering new markets, 

  • Onboarding new customer types, 

  • Experiencing significant changes in transaction volume.

You do not need to review your assessment continuously. You should be able to demonstrate that you revisit it when meaningful changes occur and that you document updates.

Learning checkpoint: What good looks like after step 3

At the end of this module, you should: 

  • Have a written business-wide AML risk assessment that reflects your current business model.

  • Be able to explain your highest risk areas, the assumptions you have made, and how those assumptions influence your AML controls. 

  • Be able to explain when and why the assessment will be reviewed.

If you can walk a regulator through your risk assessment confidently and consistently, you are meeting expectations at this stage.

Preparing for step 4

In the next module, you will build directly on your risk assessment by designing customer due diligence and screening processes that reflect the risks you have identified.

Further reading & resources: