Business and Customer Risk Assessment: UK AML Guide

A business-wide risk assessment is your firm's documented analysis of where it could be used for money laundering or terrorist financing, and a customer risk assessment applies that analysis to each customer relationship to set the right level of due diligence and monitoring. The legal basis is regulation 18 of the Money Laundering Regulations 2017, supported by SYSC 6.3 for FCA-authorised firms within its scope.

What does the law require?

The old guidance on this subject cited the 2007 Regulations and the FSA's SYSC chapters 3 and 6. Those have been replaced. The current requirements are:

• Regulation 18 MLR 2017: a relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. It must take into account information from its supervisor and risk factors relating to customers, countries or geographic areas, products or services, transactions and delivery channels. The steps depend on the size and nature of the business. The firm must keep an up-to-date written record of the steps taken, unless its supervisor notifies it in writing that no record is required, and must give the risk assessment and supporting information to its supervisor on request.
• Regulation 19: the firm must establish and maintain policies, controls and procedures to manage the risks identified in its risk assessment, review and update them regularly, and keep written records. That includes policies on scrutinising unusual transactions, and assessing the risk of new products, delivery mechanisms and technology.
• SYSC 6.3: FCA-authorised firms within its scope (SYSC 1 Annex 1 limits or disapplies parts of it for some firm types) must have systems and controls that enable them to identify, assess, monitor and manage money laundering risk, which are comprehensive and proportionate to the nature, scale and complexity of their activities (SYSC 6.3.1R), and regularly assess whether they remain adequate (SYSC 6.3.3R). A director or senior manager must have overall responsibility (SYSC 6.3.8R) and an MLRO must be appointed (SYSC 6.3.9R).

The FCA's Financial Crime Guide (FCG 3.2) describes the business-wide assessment as at the core of a firm's AML effort and says firms must regularly review it so that it remains current.

How to conduct a business-wide risk assessment

1. Set the scope and ownership. Name the senior owner (often the MLRO), the approver (the board or senior management), the review cycle and the triggers for an out-of-cycle update, such as a new product or market.
2. Collect objective data by business unit. Use customer data, not opinions, for each of the factors regulation 18(2) lists: customer type, geography, products and services, transactions and delivery channels. Break it down by business unit if the firm has more than one.
3. Add external risk information. Regulation 18(2) requires you to consider information from your supervisor. In practice, use FCA material such as the Financial Crime Guide and thematic work, and the government's 2025 National Risk Assessment, published by HM Treasury on 17 July 2025 as the fourth comprehensive UK assessment of money laundering and terrorist financing risk.
4. Identify inherent risks and concentrations. Look for hot spots, such as high volumes of suspicious activity reports, a high proportion of customers rated high risk, frozen accounts or legal orders, or a high proportion of PEPs in the customer base.
5. Evaluate the controls. Rate how well each control mitigates each inherent risk, based on testing, not on the existence of a policy.
6. Determine residual risk. Combine inherent risk and control strength, using the same high, medium and low thresholds as your other operational and conduct risk methodologies so the results can be compared.
7. Treat data gaps as findings. Where you cannot measure a risk because data is missing, do not score it as low. Record it as an open risk with an owner and a date, and treat it cautiously until the gap is closed.
8. Link to resources and actions. The assessment should show whether resources are being allocated appropriately and effectively, and it should drive an action plan.
9. Approve, record and review. Keep the written record that reg 18 requires, and update the assessment when the risk picture changes.

Good practice, in short, is evidence that the risk assessment informs the design of the controls, that sources of information are good, and that the process is continuous and uses both internal and external information. Our enterprise risk assessment template gives a starting structure.

How to build a customer risk assessment

A customer risk assessment sets a rating, typically low, medium or high, for each customer, representing the firm's risk appetite towards that customer. The CRA matters because it controls what happens next. The rating should drive:

• whether to start, continue, limit or exit a relationship;
• the level and frequency of customer due diligence (CDD) and reviews;
• the type of ongoing monitoring; and
• whether senior approval is required.

Use the same factors as the BWRA, applied to the individual. The table sets out indicators and where the law points to higher risk.

Regulation 33(7) adds that one risk factor does not necessarily make a situation high risk, so the rating should reflect a holistic view. Where the rating is high, regulation 33 requires enhanced due diligence and enhanced ongoing monitoring.

Corporate customer risk: what to look at

Legal-entity customers need their own analysis. The questions to answer for each corporate customer are:

• Who owns and controls it? Identify and verify beneficial owners and understand the control structure. Public sources such as Companies House and the persons of significant control register are useful, but not conclusive.
• Is the structure explained? Layers of companies, nominee arrangements, bearer shares or personal asset-holding vehicles without a clear commercial rationale are listed in reg 33(6) as higher risk indicators.
• What does it do and where? Sector, countries of operation, and customers and suppliers. Cash-intensive businesses are flagged by reg 33(6).
• Does the expected activity make sense? Record the intended nature of the relationship and the expected volumes, so that monitoring has something to test against.
• Are there PEP or sanctions links? Check owners, directors and controllers, not just the legal entity. See our guide to politically exposed persons.

Keeping customer risk under review

Managing customer risk is continuous. Regulation 28(11) requires ongoing monitoring, and regulation 27(8) requires CDD to be applied to existing customers at appropriate times on a risk-sensitive basis, and when circumstances relevant to the customer's risk change. Define the events that should prompt a re-rating and what the response should be; our guide to AML trigger events shows how.

The FCA's Financial Crime Guide highlights poor practice you can test for: a firm that cannot evidence why customers are rated high, medium or low, and relationship managers who can override customer risk scores without sufficient evidence to support their decision. Build a documented override route with approval and a record, and sample overrides in assurance.

What good evidence looks like

• A dated, approved BWRA with data sources, method, scoring and residual risk by business unit.
• A CRA methodology document that explains factors, weightings, thresholds and what each rating triggers.
• Management information showing the distribution of ratings, overrides, reviews due and overdue, and PEP and high-risk numbers.
• Records of how the BWRA changed the controls, for example new monitoring rules or additional EDD for a segment.
• Independent testing. Regulation 21 requires an independent audit function where appropriate to the firm's size and nature.

How MEMA can help

MEMA helps MLROs and compliance teams build and refresh business-wide and customer risk assessments that link directly to controls. See our financial crime service or try the financial crime assessment tool.