Step 02 / Explore the workbook

See the risks. Understand the controls.

A visual view of what is inside the Payments and e-money edition, before you open Excel. Choose a tab to explore the illustrative worked example.

Choose sector
Preview
Download

Payments and e-money

Financial crime risk assessment · illustrative example firm: Brindlemoor Pay Limited

Change firm type

32
Pre-seeded risk factors: 5
Risk categories: 19
High or very high inherent risks: 02
Categories above appetite

bwra-payments-worked-example.xlsxIllustrative data

Illustrative control catalogue

Each control is rated for design and operating effectiveness, with the evidence behind the rating. Showing the 7 weakest of 13.

Proliferation financing assessment and controls25%High Weak
Mitigates: Countries or geographic areas, Transactions, Products or services
Design 1 / operating 1
Policy statement only; no specific controls yet.
Enhanced due diligence and PEP handling50%Medium Adequate
Mitigates: Customers, Countries or geographic areas, Transactions
Design 3 / operating 2
EDD process exists; testing found inconsistent source-of-funds evidence.
Sanctions and watchlist screening50%Medium Adequate
Mitigates: Customers, Countries or geographic areas, Transactions
Design 3 / operating 2
Automated screening; alert backlog above internal target in two months.
Transaction monitoring and scrutiny50%Medium Adequate
Mitigates: Transactions, Countries or geographic areas, Customers
Design 3 / operating 2
Rules tuned annually; no model validation since last year.
Independent audit and compliance monitoring50%Medium Adequate
Mitigates: Customers, Countries or geographic areas, Products or services, Transactions, Delivery channels
Design 2 / operating 2
Internal audit reviewed AML once in 24 months; no external testing.
New product and technology risk assessment50%Medium Adequate
Mitigates: Products or services, Delivery channels
Design 2 / operating 2
Product approval includes a financial crime step but it is not consistently documented.
Third-party, agent and outsourcing oversight50%Medium Adequate
Mitigates: Delivery channels, Customers
Design 3 / operating 2
Vendor oversight in place; no onsite review of the screening vendor.

Controls in the Payments and e-money worked example
Control area	Mitigates	Design / operating	Strength	Example evidence
Proliferation financing assessment and controls	Countries or geographic areas, Transactions, Products or services	1 / 1	25%High Weak	Policy statement only; no specific controls yet.
Enhanced due diligence and PEP handling	Customers, Countries or geographic areas, Transactions	3 / 2	50%Medium Adequate	EDD process exists; testing found inconsistent source-of-funds evidence.
Sanctions and watchlist screening	Customers, Countries or geographic areas, Transactions	3 / 2	50%Medium Adequate	Automated screening; alert backlog above internal target in two months.
Transaction monitoring and scrutiny	Transactions, Countries or geographic areas, Customers	3 / 2	50%Medium Adequate	Rules tuned annually; no model validation since last year.
Independent audit and compliance monitoring	Customers, Countries or geographic areas, Products or services, Transactions, Delivery channels	2 / 2	50%Medium Adequate	Internal audit reviewed AML once in 24 months; no external testing.
New product and technology risk assessment	Products or services, Delivery channels	2 / 2	50%Medium Adequate	Product approval includes a financial crime step but it is not consistently documented.
Third-party, agent and outsourcing oversight	Delivery channels, Customers	3 / 2	50%Medium Adequate	Vendor oversight in place; no onsite review of the screening vendor.

See the actual workbook · real Excel sheets, rendered from the example file

Payments and e-money: Inherent risk heatmap with category scores (illustrative example)

Risk heatmap · opens full size

Payments and e-money: Residual risk dashboard against risk appetite (illustrative example)

Residual dashboard · opens full size

Payments and e-money: Top ten inherent risks with rationale (illustrative example)

Top risks · opens full size

Payments and e-money: Controls assessment with design and effectiveness ratings (illustrative example)

Controls summary · opens full size

Built from the same data and formulas as the worked-example workbook, for an invented firm. All figures are illustrative.

About the Payments and e-money edition

Authorised payment institutions, small payment institutions and e-money institutions. Payment and e-money firms are financial institutions under the Money Laundering Regulations. The NRA 2025 rates the EMI and PSP sector as high risk for money laundering and terrorist financing, so supervisors expect a detailed, evidenced assessment.