Regulatory Area
Business-Wide Risk Assessment
A Business-Wide Risk Assessment (BWRA), sometimes referred to as an Enterprise-Wide Risk Assessment (EWRA), is the foundation of an effective AML/CFT framework. It enables a business to identify, understand and assess the financial crime risks arising from its customers, products, services, jurisdictions, delivery channels and operating model.
In this briefing
- What it is
- Key things to know
Rather than applying the same controls to every business, AML frameworks require firms to adopt a risk-based approach. The BWRA provides the rationale for that approach by identifying where the firm's exposure is greatest and determining how policies, procedures and controls should be designed to address those risks.
A BWRA is not simply a regulatory document. It should drive decision-making across customer onboarding, enhanced due diligence, transaction monitoring, sanctions controls, resource allocation, training and governance.
Key things to know
The BWRA is the foundation of the AML framework
The BWRA should drive the design of the firm's AML policies, procedures and controls. Without a robust assessment, it is difficult to demonstrate why specific controls have been selected or whether they are proportionate to the risks faced by the business.
Every business has a different risk profile
Financial crime risk depends on the firm's products, customer types, jurisdictions, delivery channels, transaction flows, technology and distribution model. Two firms operating in the same sector may therefore require very different control environments.
Risk assessments should be evidence-based
A BWRA should combine regulatory expectations with internal data, customer behaviour, transaction patterns, typologies, incidents, audit findings and emerging threats. The assessment should reflect how the business actually operates, not rely on generic sector assumptions.
The BWRA should distinguish inherent and residual risk
The assessment should identify the firm's inherent exposure before controls are applied, then evaluate the effectiveness of the controls in place to determine the remaining residual risk. This creates a clearer view of where exposure remains unacceptable or further remediation is needed.
Management sets risk appetite against residual risk
Senior management and the board should use the residual risk assessment to determine the firm's risk appetite, approve areas of exposure and decide where additional controls, restrictions or investment are required.
A BWRA is a living document
The assessment should be reviewed regularly and updated whenever there are material changes to products, jurisdictions, customer segments, technology, regulation, transaction patterns or the firm's wider business model.
For general information only. Not legal, regulatory or compliance advice.
Working With This Regulation?
Cryptliance helps firms understand what applies, what it means for the business and what to do next — across strategy, controls, product and market execution.