In this training, Sawaryn & Partners explains how to assess a client’s AML risk step by step, integrate the assessment with KYC, and keep assessments current across the entire client base without paralyzing sales.
5 key takeaways
- AML risk assessment and KYC are one process. The information collected during client onboarding is enough to assess risk. Separating these steps duplicates work and delays the start of the relationship.
- A risk assessment must stay current; it is not a one-time task. Changes in a client’s markets, business model, or transaction volume require a new assessment. Failing to update it is a breach, not an oversight.
- Existing clients must also be assessed. If you have not assessed risk for your existing client base, plan a schedule to catch up. The regulator does not distinguish between new and existing clients.
- A standardized form lets you delegate assessments safely. A risk-assessment form with a clear escalation matrix enables operations staff to make routine decisions independently, without involving the management board.
- Risk assessment relies on specific criteria, not intuition. Defined questions and a simple checklist eliminate subjective interpretations and make decisions consistent across the organization.
Good practices and key takeaways
The training highlights three areas that determine whether an AML system works operationally or exists only on paper. Below are practical rules and recommendations for each.
Integrate AML risk assessment into client onboarding
A risk assessment requires client information: registered-office country, business activity, transaction volume, and ownership structure. You collect the same information through KYC when establishing a relationship. If your company treats these as two separate steps, the client receives two forms and your team does the work twice.
The solution is simple. Design one registration form that collects business data and also provides the information needed for a risk assessment. The client gets a smooth onboarding experience. You have a completed risk assessment before the agreement is signed.
“In practice, it can be difficult to assess a client’s risk without collecting more information about that client. Risk assessment therefore overlaps with the initial customer due diligence measures and KYC, or Know Your Customer, procedures.”
Speaker, AML Training, Sawaryn & Partners
What this means in practice:
- Determine which information is necessary for risk assessment in your industry. Add it to the standard registration form.
- Design the process so that risk assessment takes place in the background, in parallel with sales.
- Do not send the client three separate emails requesting information. One form, one step, full compliance.
Companies that use professional legal services for technology businesses can design this process once and scale it without additional overhead.
Monitor changes in existing clients’ profiles
A one-time risk assessment is not enough. A client that operated only in the Polish market two years ago may now transact with entities in high-risk jurisdictions. Its profile has changed. Your assessment should change with it.
Fast-growing companies naturally focus on new clients. The existing client base is left to run on its own. But from GIIF’s perspective, it does not matter whether a client has been with you for a week or five years. An outdated risk assessment is a breach.
“You should especially conduct a risk assessment if you have never done one for that client, or if something significant changes for the client, for example, they start transacting with foreign countries, change their business activity, or carry out more money transactions, and so on.”
Speaker, AML Training, Sawaryn & Partners
Put a simple decision rule in place for the team:
- Has the client changed target markets? Conduct a new risk assessment.
- Has the client changed its business model? Conduct a new risk assessment.
- Has the client’s turnover exceeded a defined threshold? Conduct a new risk assessment.
Set alerts for unusual changes in the scale or nature of the relationship. A clear rule eliminates uncertainty and prevents regulatory debt from accumulating.
Standardize risk assessment with forms and an escalation matrix
The management board is responsible for the AML system. But the board cannot personally verify every new client. With hundreds of business relationships a month, that is physically impossible.
The answer is a standardized risk-assessment form (for example, Form No. 6 shown in the training) and a clear escalation path. An employee does not need to know the law. They need to know how to complete the form and what to look for.
Three elements make this possible:
- Risk-assessment form. An operations employee completes it independently. The form guides them through the established criteria: registered-office country, beneficial owner, and transaction type.
- Escalation threshold. An employee closes low-risk cases. The AML officer reviews medium-risk cases. High-risk cases go to the management board. Onboarding stops automatically until an expert makes a decision.
- Regular reviews. Check once a quarter whether the system is working. You do not need to review every client file every day.
This structure lets you safely delegate 90% of decisions while maintaining control where it is truly needed. This is especially important for companies using corporate legal services that plan to scale and cannot afford organizational chaos under a compliance label.
How to put these takeaways into practice
Below is a concrete action plan. Start with the first step, whatever stage your organization is at.
Step 1: Map your current client-onboarding process.
Walk through the entire process from first contact to contract signing. Find the points where you ask for the same information twice. Identify where AML risk assessment could happen in parallel with client registration.
Step 2: Design one form that combines KYC and risk assessment.
Set risk-assessment criteria appropriate to your industry. Turn them into simple questions that every customer-service employee can assess unambiguously. Instead of “assess whether the client operates in a high-risk country,” write: “check the client’s registered-office country against List X; if it appears on the list, mark the form as elevated risk and send it for review.”
Step 3: Define an escalation matrix.
Specify who makes decisions at each risk level. Low risk: operations employee. Medium risk: AML officer. High risk: management board. Write one sentence for each role in the organization.
Step 4: Review the existing client base.
Review your clients and identify those without a current risk assessment. Group them by the scale of the relationship and potential risk. Schedule reviews over several weeks. Start with clients with the highest turnover and the longest period without an assessment.
Step 5: Train the operations team.
An AML policy nobody reads protects nobody. Remove legal jargon. Keep operational instructions. Give each role one sentence: “Your task is X. If you see Y, report it to Z.”
Step 6: Implement continuous monitoring.
Set internal alerts for changes in the client profile: new markets, a new business model, or turnover above a defined threshold. Every change means a new assessment. No exceptions.
An AML system that works operationally
An AML risk assessment is not a document for a binder. It is a decision about whether you can safely work with a particular client. You make it using specific criteria, in a standardized process, with a clear escalation path.
Companies that treat AML as an integral part of onboarding, rather than a separate formal obligation, gain two things: a smoother start to the client relationship and real protection against regulatory sanctions. This is especially important in regulated industries, fintech, e-commerce, and technology companies, where onboarding speed directly affects conversion.
Regulatory debt in AML works like technical debt. You do not see it every day, but it grows. Then it appears where you least expect it: during a GIIF inspection, due diligence before an investment round, or a potential partner’s review of an investment agreement.
You do not need a 20-person compliance department. You need three things: an integrated onboarding process, one risk-assessment form, and a clear escalation path.
If your company is an obliged entity and you are unsure whether your current AML procedures will withstand an inspection, check before someone asks. We will review your process, identify gaps, and recommend the order of actions.
Watch the training
Watch the full training:
This video is currently unavailable.
