Risk assessment is not a formality. It is a required part of an AML procedure and is necessary to choose appropriate customer due diligence measures. Failing to assess risk may expose you to an administrative fine of up to EUR 1 million or imprisonment for up to 5 years.
What is an AML risk assessment?
An AML risk assessment is the process of checking whether working with a particular customer involves the risk of money laundering or terrorist financing.
As part of the assessment, you:
- identify the entity with which you work or plan to work
- analyze the nature of its business, its structure and its connections
- assess the processes and activities arising from the planned or ongoing relationship
- assign a risk level that determines the scope of customer due diligence measures to apply
You use the risk assessment results to develop and implement appropriate AML procedures in your company.
When to conduct a risk assessment
Before starting work with a new customer
Assess the risk before starting a relationship. When a customer approaches you and you are considering a business relationship, you should already understand the risk level involved.
Why this matters:
- without a risk assessment, you cannot choose the appropriate customer due diligence measures
- risk assessment overlaps with the first steps in the Know Your Customer (KYC) procedure, which verifies a customer’s identity and credibility
- the earlier you conduct the assessment, the sooner you can make an informed decision about the relationship
For customers you already work with
If you have not previously applied AML rules but already have customers, you must assess risk for those existing customers too.
Do so especially when significant changes occur, for example:
- the customer begins transacting with foreign entities
- the customer’s ownership structure changes
- the customer’s business profile or scale changes
How to conduct a customer risk assessment, step by step
The assessment involves checking the customer against defined criteria. In practice, it works as follows:
- Collect information about the customer: identification details, business profile and ownership structure.
- Ask specific questions about funding sources, the nature of planned transactions and connections to high-risk countries.
- Complete the customer risk assessment form: this document scores the answers and assigns a risk level (low, medium or high).
- Choose customer due diligence measures appropriate to the assigned risk level.
- Document the result so that the assessment can be reconstructed in the event of an inspection.
You can find a customer risk assessment form template in the SiP AML Program, described below.
Who must conduct assessments: list of obliged entities
Customer risk assessment is mandatory if your company falls into one of these categories:
- A business accepting or making cash payments with a value equal to or greater than EUR 10,000
- A domestic payment institution, small payment institution or payment services office
- A business conducting currency exchange activity
- A virtual currency exchange business
- An accountant or a provider of tax advisory and tax compliance services, including a sole-practitioner accounting office
- An art gallery or auction house
- A real estate broker, except for brokering lease or rental agreements with rent below EUR 10,000 per month
If you are not sure whether your company is an obliged entity, check the full list in this separate article.
What penalties may apply for failing to assess risk?
Failure to assess risk is one of the violations for which specific penalties are provided:
- Administrative penalty: up to EUR 1,000,000
- Criminal penalty: a fine and/or imprisonment for 3 months to 5 years
Penalties may also apply for other failures, such as:
- not appointing a person responsible for AML duties
- not having an internal AML procedure
- not preparing a risk assessment
There is an additional risk: if your company participates, even unknowingly, in transactions used for money laundering, penalties under the Criminal Code and Fiscal Penal Code may apply. A properly conducted risk assessment reduces this exposure.
What to do first: checklist
If your company has not yet conducted a risk assessment, start with these steps:
- Check whether your company is an obliged entity.
- Appoint a person responsible for carrying out AML duties.
- Prepare or update the internal AML procedure.
- Prepare a customer risk assessment form.
- Assess risk for new and existing customers.
- Implement a KYC procedure to verify customers’ identities and credibility.
- Document every action so that the records are available in the event of an inspection.
Read more about implementing an AML procedure in a company here.
SiP AML Program: a tool for self-implementation
We created a tool that enables you to complete the duties imposed by the Act on Counteracting Money Laundering and Terrorist Financing yourself.
The SiP AML Program includes:
- Materials: document templates, instructions and checklists for carrying out AML duties
- An AML guide: explains what AML is and how to navigate the Act’s requirements
- An internal AML procedure: a ready-made set of rules to implement in your company
- Risk assessment: a tool to assess money laundering risk in your company or industry
- A KYC procedure: a template for detailed customer verification
- Checklists: to verify that all duties have been completed
- Six video recordings: supplement the documents and address common questions
Your company can join the platform today and organize its AML duties in one place.
If you need to determine whether AML rules apply to your company or have questions about implementation, contact us.
Frequently asked questions
When is a customer risk assessment mandatory under AML rules?
Conduct a risk assessment before starting work with a new customer, before deciding to enter into a business relationship. If you already have customers and have not applied AML rules so far, you must assess those customers too, particularly when the ownership structure or business profile changes, or when a customer begins transacting with foreign entities.
How do you conduct a customer risk assessment under an AML procedure, step by step?
Collect the customer’s identification details, business profile and ownership structure. Then ask about funding sources, the nature of transactions and connections to high-risk countries. Complete a risk assessment form that scores the answers and assigns a level (low, medium or high), choose customer due diligence measures appropriate to that level, and document the result so it can be reconstructed in the event of an inspection.
Which businesses must assess customer risk under AML rules?
The duty applies, among others, to businesses accepting or making cash payments of EUR 10,000 or more; domestic payment institutions; businesses conducting currency exchange; virtual currency exchange businesses; accountants and accounting offices; art galleries; auction houses; and real estate brokers. If your company falls into any of these categories, customer risk assessment is mandatory for you.
What penalties may apply for failing to assess customer risk under an AML procedure?
Failure to assess risk may result in an administrative penalty of up to EUR 1,000,000 and a criminal penalty in the form of a fine or imprisonment for 3 months to 5 years. There is additional exposure if your company participates, even unknowingly, in transactions used for money laundering, because sanctions under the Criminal Code and Fiscal Penal Code may then apply.
Where should a company start if it has not yet implemented risk assessment and AML procedures?
Check whether your company is an obliged entity. If it is, appoint a person responsible for AML duties and prepare an internal AML procedure. Then prepare a customer risk assessment form, assess new and existing customers, implement a KYC procedure and document all actions so the records are available in the event of an inspection.
