Better Evidence for Less: Rebuilding the AML Risk Assessment

The AML risk assessment is the foundation of your AML program. It shapes how closely you monitor, how deeply you test, how you staff, and which risks you can reasonably accept. Get that foundation wrong, and everything built on top of it is a very expensive sandcastle.

The FFIEC BSA/AML Examination Manual calls the risk assessment "not a specific legal requirement," yet examiners review it during scoping and planning. Where a bank’s assessment is missing or inadequate, examiners must build their own. The Manual sets an expectation for banks to identify and analyze risk across their products, services, customers, and geographic locations, and to update the assessment as the business changes. It does not prescribe a method or format.

So many institutions default to Excel. The spreadsheet is familiar, flexible, and seemingly inexpensive. In practice, it falls short on both counts that matter: (1) it gives a weaker picture of program health than the data allows, and (2) once you count the people needed to feed it, it’s expensive. Continuous, automated control testing can do better on both, providing a clearer view of risk, at a lower cost.

..............................

Read the rest on the Cable blog.