AML Business-Wide Risk Assessment in 7 Steps

If you own the AML business-wide risk assessment at an EU bank, payment institution, e-money institution or crypto-asset service provider, this guide gives you a method that meets Article 10 of the AML Regulation, follows the four minimum requirements in AMLA's draft guidelines and keeps the EBA expectations that apply today. You get the sources to draw on, a way to score inherent risk and control quality, a residual rating that survives challenge, the approval chain and the update cycle, a worked example and a table to fill in for your own firm.

What is an AML business-wide risk assessment?

It is your firm's own map of where money laundering, terrorist financing and sanctions evasion could happen in its business, how likely and how serious that is, and how well your policies and controls reduce it. The EBA's risk factor guidelines describe two levels of assessment: the business-wide one, about the nature and complexity of the business, and the individual one, about each customer relationship or occasional transaction. Each runs in two steps, identifying the risk factors and then assessing the risk (EBA/GL/2021/02, Guidelines 1.2 to 1.4). The two levels feed each other. AMLA's consultation paper puts it plainly: customer-level assessments inform the business-wide one but are no substitute for it, and the business-wide assessment is an input for the individual ones and should set the level of due diligence for particular situations, customer types, products and channels.

AMLA's draft guidelines define the three terms you will use throughout. Inherent risk is the exposure that comes from your products, services, transactions, customers, jurisdictions and delivery channels before any mitigation. Residual risk is what remains after your policies, procedures, systems and controls. Risk factors are the variables that, alone or together, raise or lower the risk of a relationship or transaction.

The duty itself is not new: Annex VI of the AMLR maps Article 8(1) of the Directive to Article 10(1). What changes in 2027 is the scope, which now includes the risk that targeted financial sanctions are not implemented or are evaded; the list of mandatory sources; the minimum content AMLA is setting; and the rule in Article 18(3)(a) that the proposal and approval of the assessment can never be outsourced.

What does Article 10 of the AMLR require?

Article 10(1) requires measures proportionate to the nature, risks, complexity and size of your business to identify and assess your risks, taking into account at least:

1. the risk variables in Annex I and the risk factors in Annexes II and III of the AMLR;
2. the findings of the Commission's Union-level risk assessment under Article 7 of Directive (EU) 2024/1640;
3. the findings of the national risk assessments and any sectoral assessments of the Member States;
4. relevant publications of international standard setters, and of the Commission or AMLA;
5. information on money laundering and terrorist financing risks provided by competent authorities;
6. information on your own customer base.

The second subparagraph adds a gate before change: before you launch a new product, service or business practice, use a new delivery channel or a new technology, or offer an existing product to a new customer segment or in a new country, you identify and assess the related risks and take measures to manage them.

Article 10(2) sets the form and the governance. The assessment is documented, kept up to date and regularly reviewed, including when an internal or external event significantly affects the risks of your activities, products, transactions, delivery channels, customers or geographies, and it is made available to supervisors on request. It is drawn up by the compliance officer, approved by the management body in its management function and communicated to the management body in its supervisory function, where one exists. Article 10(3) lets supervisors waive individual documented assessments for sectors whose risks are clear and understood, but the waiver is not available to credit institutions, financial institutions or crowdfunding providers. Article 10(4) asked AMLA for guidelines on the minimum content and on additional sources.

What are AMLA's four minimum requirements?

AMLA published its draft guidelines under Article 10(4) on 16 April 2026, held a public hearing on 28 May and closed the consultation on 15 July 2026; its consultation paper says the final guidelines will be issued in Q4 2026. The draft says the content of the assessment should include at least four elements, the last three forming a documented, three-phase methodology:

• MR1, business and operational overview (draft paragraphs 21 and 22): your legal and operational set-up, group structure, customer base, products and services in scope, delivery channels, geographical exposure, how the AML function is organised, outsourcing and any new technology. The overview also decides how elaborate the rest needs to be.
• MR2, inherent risk (paragraphs 23 and 24): how money laundering, terrorist financing and sanctions evasion could materialise in the business, including emerging risks, across customer, product, service and transaction, delivery channel and geographical factors, using at least the data points in AMLA's supervisory risk standards under Article 40(2) of the Directive.
• MR3, quality of controls (paragraphs 25 to 28): how well each policy, procedure and control mitigates the risk it is linked to, judged on design and on implementation, using indicators such as compliance testing, audits and supervisory findings.
• MR4, residual risk (paragraphs 29 to 32): the remaining risk per inherent risk and overall, recognising that inherently high-risk factors cannot be completely mitigated by controls, followed by priority actions and remediation.

Around the four requirements the draft sets principles worth building in now. Proportionality: a non-complex firm may use a more qualitative and descriptive assessment, and a firm may start from a sectoral assessment published by its supervisor while staying responsible for its own (paragraphs 6 to 8). Methodology: a documented method, weighting with a written rationale, no single factor driving the outcome and an explanation wherever your ratings depart from the Annexes or from the Union and national assessments (paragraphs 14 to 16). Structure: separate assessments for distinct business lines, aggregated into one entity-level assessment (paragraph 10). Sanctions: either extend the assessment to the risk of non-implementation and evasion of targeted financial sanctions or run a complementary one (paragraphs 12 and 13).

Until AMLA's guidelines are final and apply, credit and financial institutions work to Guidelines 1 to 3 of EBA/GL/2021/02, which the EBA and AMLA confirmed stay in force until AMLA replaces them. AMLA says it aligned the draft with those guidelines and with EBA/GL/2024/14 on restrictive measures wherever that made sense for all sectors, so a method built on both carries over.

How do you carry out the assessment, step by step?

The seven steps below follow the order of AMLA's four requirements and add the governance around them. A firm with one business line can run them in a quarter; a group with several entities needs longer, because each entity's assessment feeds the group-wide one.

Step 1: Describe the business (MR1)

Write a short, factual overview: legal entities and licences, the group structure, customer numbers by segment, products and services in scope of the AMLR, delivery channels, the countries you serve and are exposed to, how the AML function is organised, which tasks are outsourced and which new technologies you use or plan to use. Use numbers wherever you can. The overview tells a reader why the rest of the assessment is as detailed as it is, which is the proportionality argument AMLA asks you to make.

Step 2: Gather and log the sources

Start with the six sources in Article 10(1), then add what AMLA's draft lists in paragraph 19: information from public authorities such as central banks and fraud observatories, sanctions and watchlists, mutual evaluation reports, industry bodies and public-private partnerships, credible typology and investigative reports, civil society indices and commercial intelligence. Paragraph 20 adds your own data: suspicious transaction reports you filed, requests and feedback from the FIU and law enforcement, compliance and audit findings, and lessons from supervisory actions. Record which sources you used and how (paragraph 17).

Step 3: Identify the inherent risk factors (MR2)

Work through four categories, as Guideline 2 of EBA/GL/2021/02 and Annexes II and III of the AMLR do: customers and their beneficial owners; countries and geographical areas; products, services and transactions; and delivery channels. For each, write down which factors you treat as raising or lowering risk and how you capture them at onboarding and during the relationship. Add the sanctions dimension: the regimes that apply to you, your customers' and owners' links to sanctioned countries, the jurisdictions you operate in, the origin and destination of transactions, the complexity of customer structures and how far you depend on a third party's screening (EBA/GL/2024/14, paragraphs 22 to 28). Then look for emerging risks, as Guidelines 1.8 and 1.9 ask: new typologies, new products in the market and changes in your own business.

Step 4: Score the inherent risk

Rate each risk on a fixed scale; four levels (low, medium, substantial, high) match the scale AMLA uses for its own classification of firms under Article 12(3) of the AMLA Regulation. Base the rating on data: customer counts by risk factor, volumes and values by product and corridor, the share of business through agents or remote channels. Where you weight factors, write down why each weight is what it is, make sure no single factor drives the outcome, and explain any rating that departs from the Annexes or the national assessment (draft paragraphs 15 and 16). Guideline 3 of EBA/GL/2021/02 adds that weighting must never make it impossible to rate something high and must never let economic considerations shape the rating.

Step 5: Assess the quality of controls (MR3)

Link every inherent risk to the controls that treat it and explain how each control works in practice (paragraph 25). Assess design first: does an adequate control exist for the risk? Then implementation: does it actually work? Use evidence for the second question, such as compliance testing results, internal and external audit findings, supervisory findings, monitoring sample reviews and overdue counts (paragraphs 27 and 28). A control that exists on paper with no test result behind it is rated on design only, and the file should say so.

Step 6: Derive the residual risk and set priorities (MR4)

Combine the inherent rating with the control rating in a matrix you define in advance. Build in a floor: AMLA's draft says the methodology should recognise that inherently high-risk factors cannot be completely mitigated by controls (paragraph 29), so a high inherent risk should not come out low however strong the controls. Then form an overall residual view across all risks (paragraph 30), list the priority areas for action and put the remediation on a timetable (paragraph 32). The results drive your policies and the level of due diligence you apply (paragraph 5(b) and Article 20(2) AMLR).

Step 7: Approve, communicate and keep it current

The compliance officer signs the assessment as its author and presents it to the management body in its management function for approval; the minute should record the discussion, the questions asked and the decision. Communicate it to the supervisory function, which under paragraph 13(a) of EBA/GL/2022/05 should be informed of the results. Make sure staff whose work it affects understand it, which AMLA's draft ties to the training duty in Article 12 (paragraph 5(d)), and keep it ready for the supervisor. Then put the next update date in the calendar and keep an issues log until then.

What does a worked example look like?

The table below uses an invented firm to show the shape of the output: a hypothetical e-money institution with 120,000 customers in three Member States, a prepaid card programme sold through agents, online merchant acquiring and fully remote onboarding. The figures are illustrative; your own rows come from your data.

The overall residual rating for this firm would be substantial, driven by the cash-loaded card programme and the merchant refresh backlog. Two of the five rows sit on the floor, so the management body sees that strong controls on high-risk business still leave real exposure, and the priority list writes itself: the agent oversight plan and the merchant refresh backlog first.

Who drafts and approves it, and can a consultant help?

The compliance officer draws it up and the management body in its management function approves it (Article 10(2)). Under EBA/GL/2022/05, which applies today, the compliance officer also develops and maintains the risk assessment framework and reports the results to the management body, proposing measures to mitigate the risks (paragraphs 39 and 40). The management body in its supervisory function is informed of the results (paragraph 13(a)).

Outside help is allowed for the work. AMLA's draft says a firm may rely on third parties to help draw up the assessment, provided the proposal and approval stay within the firm and the firm can understand and explain the content, the method and the results (paragraph 9). That matches Article 18(3)(a) of the AMLR, which lists the proposal and approval of the assessment among the six tasks that can never be outsourced. The EBA's Guideline 1.14 adds the test supervisors apply: a generic assessment, or one taken unquestioningly from the group, is unlikely to meet the requirement.

In a group, each branch and subsidiary runs its own assessment using a common methodology, and the parent consolidates them into a group-wide assessment that takes the entities' residual scores into account (Article 16(1) AMLR; draft paragraphs 11 and 31).

How often must the business-wide risk assessment be updated?

Article 10(2) says the assessment is kept up to date and regularly reviewed, including whenever an internal or external event significantly affects the risks. It sets no fixed interval. For credit and financial institutions, Guideline 1.7 of EBA/GL/2021/02 makes it concrete: set a date in each calendar year for the next update, reflect a new or increased risk as soon as you become aware of it, and record through the year the issues that bear on the assessment, such as internal suspicious transaction reports, compliance failures and intelligence from front-office staff. AMLA's consultation paper says its future guidelines on internal policies under Article 9(4) will cover how the assessment is reviewed and kept up to date.

Events that should trigger an update before the yearly date include a new product, channel, country or customer segment; new or changed sanctions regimes (the restrictive measures exposure assessment is reviewed at least once a year and when measures change, EBA/GL/2024/14 paragraph 26); audit, testing or supervisory findings; a new national or Union risk assessment; and a marked shift in your own suspicious transaction reports.

How does the business-wide assessment feed customer risk ratings?

Article 20(2) of the AMLR requires the extent of due diligence to rest on an individual analysis of the risk that takes into account the business-wide risk assessment, the variables in Annex I and the factors in Annexes II and III. In practice, the business-wide assessment sets the starting level of due diligence for each customer type, product, channel and country, and the customer risk model scores the individual relationship from there. Guideline 4 of EBA/GL/2021/02 asks you to use the findings of the business-wide assessment for exactly that purpose and to reflect your risk appetite in it. If your customer risk model rates a customer type low that the business-wide assessment rates high, one of them is wrong, and a reviewer will find it.

What evidence should the file contain?

A supervisor reads the assessment and then tests whether it is real. The file should hold:

• the methodology, with the scale, the weighting rationale and the residual matrix;
• the business overview with the data behind it;
• the source log, showing each Article 10(1) source and how you used it;
• the inherent risk scoring per business line, product, channel and geography, including the sanctions component;
• the control assessment with the test results, audit findings and overdue counts behind each rating;
• the residual ratings, the priority actions and their owners and deadlines;
• the approval minute of the management body and the record of communication to the supervisory function;
• the version history, the issues log since the last update and the pre-launch assessments of new products.

The common reasons an assessment fails review are predictable: a group template with no local customer data, no assessment of sanctions evasion, mandatory sources not cited, and residual ratings that are low across the board because every control was assumed to work. Our guide to collecting audit evidence covers how to keep that file in order.

What the other results get wrong

We read the pages that rank for this query and checked them against Article 10, AMLA's draft and the EBA guidelines.

• Residual risk by discount. FluxForce's free template describes "a formula tab that multiplies inherent risk scores by control effectiveness discount factors to produce residual risk". A pure discount lets strong controls turn a high inherent risk into a low residual one. AMLA's draft says a methodology should recognise that inherently high-risk factors cannot be completely mitigated by control measures (paragraph 29), which is why a floor belongs in the matrix.
• The wrong approver. Azakaw's guide lists "Board or senior management oversight" as the governance step and says "senior management must approve the methodology before execution". Under Article 10(2) of the AMLR the assessment itself is approved by the management body in its management function, after the compliance officer draws it up; approval by senior management below that body does not satisfy the article.
• A closed consultation described as open. Flawless Money's analysis of AMLA's draft still says the consultation "remains open until 15 July 2026". It closed on that date, and AMLA's paper puts the final guidelines in Q4 2026.
• No law at all. The template and method pages that rank alongside them, from FluxForce, Azakaw, Financial Crime Academy and AMLYZE, cite no article of the AMLR, although Article 10(1) names six sources an assessment must take into account and Article 10(2) fixes who drafts and who approves it.

Where do you stand?

Fill this in for your current assessment. Every blank or "no" is something a supervisor will ask about.

How Venvera supports the assessment

Venvera keeps the assessment and everything around it in one place, so the methodology, the scores, the evidence, the approvals and the next update date sit in one dashboard instead of Outlook, Excel and mail chains. The AML/CFT module carries the Article 10 requirements and the EBA risk factor guidelines as requirements with owners, status and evidence guidance; its gap assessment has a section on the business-wide risk assessment that scores how specific, sourced and owned yours is; a business-wide risk assessment methodology is among its 11 policy templates; and the yearly review and approval sits on the compliance calendar as a recurring obligation with an owner and a lead time. The judgements stay with you: Venvera holds the method, the scores and the records that show how you reached them.

For the full set of AMLR duties around the assessment, read our guide to AMLR requirements; for the person who signs it, our guide to AML compliance officer requirements. If you keep enterprise risks too, our guide to creating a risk register and the risk register template use the same inherent, control and residual logic, and the overview of risk management frameworks explains where it comes from. You can start a 14-day Professional trial with no credit card, book a demo or begin with the free compliance check; plans are on the pricing page.

Frequently asked questions

Is a business-wide risk assessment mandatory under the AMLR?

Yes, for every obliged entity from 10 July 2027 (Article 10). Supervisors may waive individual documented assessments for sectors whose risks are clear and understood, but never for credit institutions, financial institutions or crowdfunding providers (Article 10(3)). Until then, Article 8 of Directive (EU) 2015/849 as transposed requires one.

What is the difference between a business-wide and a customer risk assessment?

The business-wide assessment covers the risks arising from the nature and complexity of the whole business; the customer assessment covers one relationship or occasional transaction. The first sets the starting level of due diligence for types of customers, products and channels, and the second applies it to the individual case (Article 20(2) AMLR).

Who must approve the business-wide risk assessment?

The management body in its management function, after the compliance officer has drawn it up. Where there is a management body in its supervisory function, the assessment is communicated to it (Article 10(2) AMLR).

How often should the business-wide risk assessment be updated?

Regularly and whenever an internal or external event significantly changes the risks (Article 10(2)). Credit and financial institutions also set a date each calendar year for the next update and reflect new risks as soon as they arise (EBA/GL/2021/02, Guideline 1.7).

Does the business-wide risk assessment have to cover sanctions?

Yes. Article 10(1) covers the risks of non-implementation and evasion of targeted financial sanctions. AMLA's draft lets you extend the main assessment or run a complementary one (paragraphs 12 and 13), and EBA/GL/2024/14 requires a restrictive measures exposure assessment reviewed at least once a year.

Can a consultant write our business-wide risk assessment?

A consultant can help draw it up, but the proposal and the approval must stay within your firm (Article 18(3)(a) AMLR; AMLA draft paragraph 9), and you must be able to explain its content, method and results. A generic or copied assessment is unlikely to meet the requirement (EBA Guideline 1.14).

Are AMLA's business-wide risk assessment guidelines final?

Not yet. AMLA consulted from 16 April to 15 July 2026 and says the final guidelines will be issued in Q4 2026. Until they apply, credit and financial institutions follow EBA/GL/2021/02, which stays in force until AMLA replaces it.

What sources must a business-wide risk assessment use?

At least the six in Article 10(1): Annexes I to III of the AMLR, the Commission's Union-level assessment, the national and sectoral assessments, publications of standard setters, the Commission and AMLA, information from competent authorities, and information on your own customer base.

Can a group use one risk assessment for all its entities?

No single document covers it. Each branch and subsidiary carries out its own assessment, using a common methodology, and the parent consolidates them into a group-wide assessment (Article 16(1) AMLR; AMLA draft paragraph 11).

What is the difference between inherent and residual risk?

Inherent risk is the exposure from your products, customers, countries and channels before any mitigation; residual risk is what remains once your policies, procedures, systems and controls are applied. AMLA's draft defines both and asks for a floor: inherently high risks cannot be completely mitigated.

Do new products need a risk assessment before launch?

Yes. Article 10(1) requires you to assess the risks of a new product, service, delivery channel or technology, or of a new customer segment or country, before you start, and EBA/GL/2022/05 says the launch should wait until the resources to manage the risk are in place (paragraph 40).

Primary sources

• Regulation (EU) 2024/1624 (AMLR), OJ L of 19 June 2024
• AMLA, consultation on draft Guidelines on business-wide risk assessment under Article 10(4) AMLR
• EBA/GL/2021/02, ML/TF Risk Factors Guidelines (final report)
• EBA/GL/2024/14 and EBA/GL/2024/15, restrictive measures guidelines (final report)
• EBA/GL/2022/05, Guidelines on the role of the AML/CFT compliance officer
• AMLA and EBA, press release: handover of AML/CFT mandates completed (19 January 2026)
• Regulation (EU) 2024/1620 establishing AMLA

Checked against Regulation (EU) 2024/1624, AMLA's consultation paper of 16 April 2026 and its consultation page, and the EBA guidelines, on 19 October 2026. AMLA's guidelines are a draft until AMLA publishes the final text.