Step 02 / Explore the workbook

See the risks. Understand the controls.

A visual view of what is inside the Cryptoasset firms edition, before you open Excel. Choose a tab to explore the illustrative worked example.

Choose sector
Preview
Download

Cryptoasset firms

Financial crime risk assessment · illustrative example firm: Marlowcrest Digital Limited

Change firm type

32
Pre-seeded risk factors: 5
Risk categories: 24
High or very high inherent risks: 00
Categories above appetite

bwra-crypto-worked-example.xlsxIllustrative data

Illustrative control catalogue

Each control is rated for design and operating effectiveness, with the evidence behind the rating. Showing the 7 weakest of 13.

Proliferation financing assessment and controls25%High Weak
Mitigates: Countries or geographic areas, Transactions, Products or services
Design 2 / operating 1
Sanctions screening only.
Enhanced due diligence and PEP handling50%Medium Adequate
Mitigates: Customers, Countries or geographic areas, Transactions
Design 3 / operating 2
EDD workflows exist; testing found inconsistent source-of-funds evidence.
Transaction monitoring and scrutiny50%Medium Adequate
Mitigates: Transactions, Countries or geographic areas, Customers
Design 3 / operating 2
Transaction rules tuned quarterly; high alert volumes.
Independent audit and compliance monitoring50%Medium Adequate
Mitigates: Customers, Countries or geographic areas, Products or services, Transactions, Delivery channels
Design 2 / operating 2
One external review in 24 months.
New product and technology risk assessment50%Medium Adequate
Mitigates: Products or services, Delivery channels
Design 3 / operating 2
New asset listings go through risk review; documentation inconsistent.
Third-party, agent and outsourcing oversight50%Medium Adequate
Mitigates: Delivery channels, Customers
Design 3 / operating 2
Vendor oversight in place; limited testing of analytics coverage.
Customer due diligence (identification, verification, purpose)75%Low Strong
Mitigates: Customers, Products or services, Delivery channels
Design 3 / operating 3
Automated KYC with liveness; periodic file reviews.

Controls in the Cryptoasset firms worked example
Control area	Mitigates	Design / operating	Strength	Example evidence
Proliferation financing assessment and controls	Countries or geographic areas, Transactions, Products or services	2 / 1	25%High Weak	Sanctions screening only.
Enhanced due diligence and PEP handling	Customers, Countries or geographic areas, Transactions	3 / 2	50%Medium Adequate	EDD workflows exist; testing found inconsistent source-of-funds evidence.
Transaction monitoring and scrutiny	Transactions, Countries or geographic areas, Customers	3 / 2	50%Medium Adequate	Transaction rules tuned quarterly; high alert volumes.
Independent audit and compliance monitoring	Customers, Countries or geographic areas, Products or services, Transactions, Delivery channels	2 / 2	50%Medium Adequate	One external review in 24 months.
New product and technology risk assessment	Products or services, Delivery channels	3 / 2	50%Medium Adequate	New asset listings go through risk review; documentation inconsistent.
Third-party, agent and outsourcing oversight	Delivery channels, Customers	3 / 2	50%Medium Adequate	Vendor oversight in place; limited testing of analytics coverage.
Customer due diligence (identification, verification, purpose)	Customers, Products or services, Delivery channels	3 / 3	75%Low Strong	Automated KYC with liveness; periodic file reviews.

See the actual workbook · real Excel sheets, rendered from the example file

Cryptoasset firms: Inherent risk heatmap with category scores (illustrative example)

Risk heatmap · opens full size

Cryptoasset firms: Residual risk dashboard against risk appetite (illustrative example)

Residual dashboard · opens full size

Cryptoasset firms: Top ten inherent risks with rationale (illustrative example)

Top risks · opens full size

Cryptoasset firms: Controls assessment with design and effectiveness ratings (illustrative example)

Controls summary · opens full size

Built from the same data and formulas as the worked-example workbook, for an invented firm. All figures are illustrative.

About the Cryptoasset firms edition

Cryptoasset exchange providers and custodian wallet providers registered under the Money Laundering Regulations. Cryptoasset exchange providers and custodian wallet providers are relevant persons under reg 8(2)(j) and (k). The NRA 2025 assesses the risk of money laundering through cryptoassets as high, so expect close supervisory scrutiny of your assessment.