What is an AML risk assessment?
An AML risk assessment (or firm-wide risk assessment) is a written analysis of how your business could be used for money laundering or terrorist financing, looking at your clients, countries, services, transactions and delivery channels. Under regulation 18 of the Money Laundering Regulations 2017 (MLRs), every regulated firm must have one, keep it up to date and show it to its supervisor on request.
It is the foundation of your AML controls: your policies, the level of due diligence you apply and your training all follow from it.
The UK rules
| Rule | What it says | Where |
|---|---|---|
| The duty | Take appropriate steps to identify and assess the money laundering and terrorist financing risks your business is subject to | Reg 18(1) |
| What to consider | Information from your supervisor, and risk factors relating to your customers, the countries or geographic areas you operate in, your products or services, your transactions and your delivery channels | Reg 18(2) |
| Proportionate | The steps must be appropriate to the size and nature of your business | Reg 18(3) |
| Written and current | Keep an up-to-date written record of the steps you have taken, unless your supervisor tells you in writing that you need not | Reg 18(4) |
| Show it | Give your supervisor the assessment, the information it was based on and your records, on request | Reg 18(6) |
| Proliferation financing | A separate duty to assess proliferation financing risk | Reg 18A |
Source: MLR regulation 18.
Firm-wide vs client risk assessment
| Firm-wide risk assessment | Client risk assessment | |
|---|---|---|
| Covers | Your whole business | One client and one piece of work |
| Legal basis | MLR reg 18 | MLR reg 28(12) (CDD must reflect the risk in the particular case) |
| Decides | Your policies, controls and training | Whether simplified, standard or enhanced due diligence applies |
| Updated | When your business, the rules or the risks change | At onboarding and when the client’s circumstances change |
For the client-level assessment, read our client risk assessment guide for small firms.
How to write one in a small firm
- Start from your supervisor’s risk view. HMRC, your professional body or the FCA publishes sector risk information. Note the risks that apply to you.
- List your risk factors under the five headings in reg 18(2): clients, countries, services, transactions and delivery channels. For example, overseas buyers, cash-intensive clients, company formation work or clients you never meet in person.
- Rate each risk (for example low, medium or high) and say why.
- Set the controls that respond to each risk, such as when you apply enhanced due diligence or what you never accept, in line with your risk appetite.
- Get it signed off by senior management, and date it.
- Review it when something changes: new services, new types of client, a change in the FATF lists, or new MLR amendments. Record each review, even if nothing changes.
Our free risk assessment and policy templates give you a structure to start from. Check key review dates in the AML deadlines calendar.
Frequently asked questions
Does a sole trader need an AML risk assessment?
Yes. The reg 21(6) exemption for sole practitioners covers the nominated officer and some internal controls, not the reg 18 risk assessment. The assessment can be short if your business is simple.
How often should I update my risk assessment?
The MLRs require it to be kept up to date. In practice, review it on a regular cycle, for example once a year, and whenever your business or the risks change. Your supervisor’s guidance may set its own expectations.
What does a supervisor look for?
That the assessment is specific to your business, covers the reg 18(2) factors, is written down and dated, and actually drives your policies and client checks.
How AML Buddy helps
AML Buddy does not write or score your risk assessment. Once your assessment says which clients need which checks, AML Buddy runs the identity, address, sanctions, PEP and adverse media part through one secure link, with a timestamped PDF report for each client. See pricing.
Go deeper: read client risk assessment for small UK firms.