vaayaa Inclusive Education
Finance risk assessment

Regulatory Compliance and Anti-Money Laundering Risk Assessment: Controls, Monitoring and Reporting Risks

A worked example of how a compliance team finds, scores and controls the risks in onboarding, monitoring, screening, reporting and governance that bear on money laundering exposure and regulatory duties, with inherent and residual ratings.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to High
See the Regulatory Compliance and Anti-Money Laundering course

Executive summary

This assessment shows how a small regulated firm can find, rate and control the risks that bear on its anti-money laundering and wider compliance duties. Eight risks were chosen because they are plausible in everyday onboarding, monitoring, screening, reporting and governance work. Weak customer due diligence and late or missing suspicious activity reports carry the highest inherent scores, because they strike at the core purpose of the controls. Cyber exposure and screening failures also score high before controls. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once added controls are in place, but reporting stays High because regulatory consequences remain serious. The first actions are a dated onboarding checklist, a reporting timetable with a named backup, a tested screening feed and restricted access to case files. Every score illustrates method, not a real organization.

Focus area
Regulatory compliance and anti-money laundering
Setting
Small regulated firm offering customer accounts and payments, with a compliance function, jurisdiction unspecified
Method
Five by five likelihood and impact risk register with inherent and residual scoring

Scope

This assessment covers the compliance function of a small regulated financial firm that onboards customers, holds accounts and moves payments. It looks at customer due diligence, monitoring of activity, screening against lists, reporting of suspicious activity, staff conduct, data and cyber exposure, third-party arrangements and governance reporting. It does not give legal advice or describe any real firm. Jurisdiction, product range, size and systems are assumptions made for teaching, and specialist legal and compliance review is needed before any rule is applied in practice.

Context

The firm has a money laundering reporting officer, a small team of analysts, relationship managers who open accounts, an operations team that processes payments, and a technology team that runs the customer and monitoring systems. Some onboarding documents are scanned and some checks depend on outside data providers. A board committee receives compliance reports each quarter. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls proposed.

Objectives, assets and stakeholders

The objective is to know the customer, detect and report suspicious activity on time, meet regulatory duties, protect customer funds and data, and keep the trust of regulators, banks and the public. The assets in scope are customer records and identity documents, transaction data, monitoring and screening systems, payment channels, compliance case files and the reputation of the firm. Stakeholders include customers, the compliance team, relationship managers, operations and technology staff, the board and its risk committee, the money laundering reporting officer, correspondent banks, third-party data providers and the relevant authorities. Clear roles matter: every risk has one owner role, and the money laundering reporting officer reports to the board each quarter on open cases, backlogs and remediation progress. Tipping off a customer and sharing case details beyond need are treated as serious conduct issues throughout.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H06
4 Likely Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H03 Likelihood 3, impact 5, score 15, high: H04
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08 Likelihood 2, impact 5, score 10, high: H05
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 3, score 9, medium: H06 Likelihood 3, impact 4, score 12, high: H02
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 H08 Likelihood 2, impact 3, score 6, medium: H01 H03 H05 Likelihood 2, impact 4, score 8, medium: H04
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Weak customer due diligence and onboarding gaps 16 High 6 Medium Head of compliance
H02 Late or missing suspicious activity reporting 20 Critical 12 High Money laundering reporting officer
H03 Monitoring rules run on poor transaction and customer data 12 High 6 Medium Technology and data lead
H04 Sanctions and list screening failures 15 High 8 Medium Compliance operations lead
H05 Staff conflicts of interest and tipping off 10 High 6 Medium Compliance officer
H06 Cyber exposure and theft of customer records 20 Critical 9 Medium IT manager
H07 Outsourced screening and third-party provider failure 9 Medium 4 Low Supplier risk manager
H08 Governance reporting and remediation failure 8 Medium 4 Low Company secretary
H01

Weak customer due diligence and onboarding gaps

Legal and compliance Before 16 After 6

Accounts open before identity, source of funds or beneficial ownership is checked, or higher risk customers do not receive enhanced review, so the firm cannot show who it is serving.

Who or what is affected: Customers, the compliance team and the firm's regulators

Causes

Pressure to onboard quickly, unclear customer risk ratings and checklists completed after the account opens.

Consequences

Regulatory penalties, accounts used for laundering and restrictions on new business.

Existing controls

  • Identity documents are checked by an analyst before account opening.
  • High risk customers are flagged in the customer record for manual review.

Control gaps

Beneficial ownership checks rely on self declared forms and are not tested against source documents.

Additional controls

  • Prevent: Block account activation until a dated onboarding checklist is complete and signed off.
  • Detect: Sample onboarding files each month and record gaps by relationship manager.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Head of compliance Target: Within 30 days Early warning: Customer files opened with an incomplete due diligence checklist.
H02

Late or missing suspicious activity reporting

Legal and compliance Before 20 After 12

Unusual activity is seen by staff or flagged by alerts but is not escalated, documented or reported within the time the rules expect, so reports are missed or made late.

Who or what is affected: Compliance team, customers whose activity is reviewed and the authorities

Causes

Alert backlogs, unclear thresholds and reliance on one officer for final decisions.

Consequences

Missed reporting duties, penalties, personal exposure for staff and loss of trust.

Existing controls

  • Staff are trained to raise internal concerns through a set form.
  • Alerts above a set score are reviewed by an analyst.

Control gaps

There is no record of how long alerts wait before a decision, and backup officers are not named.

Additional controls

  • Respond: Set a reporting timetable with a named backup for every case and escalate any case past its target.
  • Detect: Review a sample of closed alerts each quarter to test whether the reasons recorded are sound.
Likelihood 4 x impact 5 before; 3 x 4 after Owner: Money laundering reporting officer Target: Within 30 days Early warning: Alerts older than the agreed review period without a recorded decision.
H03

Monitoring rules run on poor transaction and customer data

Technology and data Before 12 After 6

Monitoring runs on incomplete, duplicated or mis-coded transaction and customer data, so suspicious patterns are missed or alerts flood the team with noise that hides real cases.

Who or what is affected: Analysts, customers and the technology team

Causes

Legacy feeds, manual entry and product code changes that are not passed on to monitoring.

Consequences

Missed alerts, false alerts, wasted effort and weak evidence in investigations.

Existing controls

  • Daily feeds are checked for total record counts.
  • Analysts can mark an alert as a data error.

Control gaps

Field level quality is not measured, so gaps appear only when someone investigates a case.

Additional controls

  • Prevent: Agree data standards for customer and transaction fields and reject records that fail them.
  • Detect: Reconcile monitoring inputs to the core ledger each week and report any differences.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Technology and data lead Target: Within 60 days Early warning: A rising share of alerts closed as data errors in a single month.
H04

Sanctions and list screening failures

Legal and compliance Before 15 After 8

Customers, beneficial owners or payment counterparties are not screened against current restricted lists, or matches are cleared without proper review, so the firm may deal with a restricted party.

Who or what is affected: Customers, payment counterparties and the firm

Causes

Name variations, poor data on owners and lists that are updated late.

Consequences

Prohibited dealings, penalties, asset freezes and reputational harm.

Existing controls

  • Customers are screened at onboarding against the lists in use.
  • Potential matches are reviewed by a second analyst.

Control gaps

Existing customers are rescreened only once a year, so changes in their status go unseen.

Additional controls

  • Prevent: Screen payments and changes to beneficial owners in near real time against current lists.
  • Respond: Freeze any payment with an unresolved match and report it to the money laundering reporting officer at once.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Compliance operations lead Target: Within 45 days Early warning: Screening list updates that are late or missing a check.
H05

Staff conflicts of interest and tipping off

People Before 10 After 6

A staff member has a personal link to a customer, accepts favours, or discloses to a customer that a report is being considered, which weakens independence and may breach the rules.

Who or what is affected: Staff, customers and the firm's reputation

Causes

Long relationships with clients, informal social contact and unclear rules on confidentiality.

Consequences

Loss of independence, disciplinary action, criminal exposure and damage to professional standing.

Existing controls

  • Staff sign a code of conduct each year.
  • Gifts above a set value must be declared.

Control gaps

Declarations are collected but never compared with the list of customers each person handles.

Additional controls

  • Prevent: Require a conflicts declaration before any staff member is assigned to a customer file.
  • Respond: Provide a confidential route to raise concerns and record how each one was handled.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Compliance officer Target: Within 60 days Early warning: A declared interest linked to a customer under active review.
H06

Cyber exposure and theft of customer records

Technology and data Before 20 After 9

Phishing, weak passwords or unprotected files expose identity documents and case files, and attackers may use stolen identities to open accounts or move funds.

Who or what is affected: Customers, staff and regulators

Causes

Phishing, reused passwords and documents copied to personal devices.

Consequences

Identity theft, fraudulent accounts, penalties and loss of customer trust.

Existing controls

  • Customer systems require a password and are backed up daily.
  • Staff receive phishing awareness training each year.

Control gaps

Scanned identity documents sit in shared folders outside the main access controls.

Additional controls

  • Prevent: Enable multi-factor sign in and restrict document storage to approved systems only.
  • Recover: Test restoring customer and case records from backup and keep a written recovery plan.
Likelihood 5 x impact 4 before; 3 x 3 after Owner: IT manager Target: Within 30 days Early warning: Repeated failed sign in attempts or reported phishing against compliance mailboxes.
H07

Outsourced screening and third-party provider failure

Supplier Before 9 After 4

An outside data provider or outsourced check fails, runs late or uses weak sources, so the firm relies on checks it does not control and cannot show they were done properly.

Who or what is affected: Compliance team, customers and the firm's regulators

Causes

Limited provider choice, weak contract terms and little oversight of the sources providers use.

Consequences

Missed checks, unverified customers and penalties for relying on poor evidence.

Existing controls

  • Contracts set service levels for each data provider.
  • The compliance team samples provider results each month.

Control gaps

Provider performance is reported monthly, but sample testing is not documented.

Additional controls

  • Prevent: Include audit and evidence rights in every provider contract before renewal.
  • Respond: Keep a manual check route ready for any provider that fails or runs late.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Supplier risk manager Target: Within 90 days Early warning: Provider results returned late or with a rising error rate.
H08

Governance reporting and remediation failure

Strategic Before 8 After 4

Findings from audits and reviews are not tracked to closure, and the board receives incomplete reports, so known weaknesses stay open and decisions rest on partial information.

Who or what is affected: Board, senior management and the compliance team

Causes

Competing priorities, no clear owner for each action and reports that focus on volume over outcomes.

Consequences

Repeat findings, weaker regulator confidence and poor board oversight.

Existing controls

  • Audit findings are logged in a shared tracker.
  • The money laundering reporting officer reports to the board each quarter.

Control gaps

Closure is recorded without evidence that the fix actually worked.

Additional controls

  • Detect: Check open actions against their due dates at each monthly compliance meeting.
  • Recover: Agree a remediation plan with dated milestones for any finding overdue by more than one review cycle.
Likelihood 2 x impact 4 before; 2 x 2 after Owner: Company secretary Target: Within 60 days Early warning: Remediation actions overdue by more than one review cycle.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe, covering regulatory penalties, restrictions on business, financial loss, harm to customers and loss of trust. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score orders work and does not measure risk exactly. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and residual must never be higher than inherent. Impact is judged on likely penalties, harm to customers and the wider financial system, time to correct, and damage to reputation, and a financial crime risk is never rated down only because no event has yet been seen. Critical and High risks need senior attention and a dated plan, Medium risks need routine controls with a named owner, and Low risks are accepted and watched. Ratings are challenged in three ways: the second line reviews them, internal audit samples the evidence behind them, and any rating is reopened when a monitoring indicator reaches its escalation threshold or when a rule, product or system changes. Staff who do the work are invited to challenge ratings, and each challenge is recorded with the response.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Customer files opened with an incomplete due diligence checklist.Escalate to the head of compliance at once, and hold account activation until the file is complete.
Alerts older than the agreed review period without a recorded decision.Escalate to the money laundering reporting officer when any alert is overdue, and to the board risk committee if the backlog persists for a full quarter.
Screening list updates that are late or missing a check.Escalate to the compliance operations lead the same day, and to the head of compliance if the gap runs beyond one cycle.
Staff with access to case files who do not need it for their role.Escalate to the IT manager and the head of compliance, and remove the access within one week.
Suspicious activity reports filed later than the internal target.Escalate to the money laundering reporting officer for any late report, and to the board if three or more are late in one quarter.

Contingency arrangements

If a serious event occurs, such as a confirmed sanctions breach, a data breach or a report that cannot be filed on time, the money laundering reporting officer leads the response. Payments linked to the case are paused under the firm's procedures, records are preserved and the board is informed. The IT manager isolates affected systems and restores data from the latest tested backup. Legal and regulator contacts are made through the head of compliance as required in the relevant jurisdiction. Customers are told only what they are entitled to know, and tipping off is avoided at all times.

Prioritized action plan

  1. Introduce a dated onboarding checklist with second line sign-off, owner money laundering reporting officer, within 30 days.
  2. Set a reporting timetable with a named backup for every open case, owner money laundering reporting officer, within 30 days.
  3. Enable multi-factor sign in and restrict access to scanned identity documents, owner IT manager, within 30 days.
  4. Review high risk customers against current due diligence standards, owner head of compliance, within 60 days.
  5. Test the screening feed against current lists and record each update, owner compliance operations lead, within 45 days.

Conclusion

Sound anti-money laundering work rests on a few habits: complete due diligence before accounts open, timely review of alerts, accurate screening, a reporting timetable with a backup owner, and clear limits on staff access to case files. The highest scores sit with due diligence, reporting and cyber exposure, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified legal and compliance advice for any real obligation.

Assumptions and limitations

Assumptions

  • The firm is regulated for accounts and payments and must apply anti-money laundering controls, with the exact rules in its jurisdiction not specified.
  • Customer records, monitoring alerts and screening results are held in managed systems with individual user accounts.
  • Staff are trained in the basics of financial crime, but turnover in analyst roles is moderate.

Limitations

  • The scores are examples for learning and do not describe any real firm or regulator's view.
  • Financial crime rules differ by country and change over time, so specialist legal and compliance review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed advice.

Related frameworks to study

  • Three lines model of risk ownership
  • Risk-based approach to customer due diligence
  • Hierarchy of controls
  • Internal control framework with monitoring activities

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Regulatory Compliance and Anti-Money Laundering course Read the best practices for this course

More Finance risk assessments

Hourly Active: 45,552 Learners