Risk Assessment and the Risk-Based Approach
Two layers of risk
Candidates must distinguish institutional risk assessment (the reporting entity's own ML/TF risk, covering customers, products/services, delivery channels, and countries/geographies) from customer risk assessment (the risk of a particular relationship). The institutional assessment drives the programme; the customer assessment drives the level of CDD applied.
The four risk factors
Assess risk across customers (PEPs, complex ownership, cash-intensive businesses), products and services (remittance, stored value, private banking), delivery channels (non-face-to-face, introducers, agents), and countries (FATF-listed jurisdictions, sanctions exposure, secrecy havens). Higher risk on any factor pushes you toward enhanced CDD; demonstrably low risk may permit simplified CDD, but simplified CDD is never automatic.
Documentation and review
The risk assessment must be written, kept up to date, and available to the supervisor. It should record methodology, not just a score. A common exam trap is treating risk assessment as a one-off exercise - the Act requires it to be reviewed and renewed periodically (and on significant change).
Worked example
A remittance business serving many customers who send funds to a jurisdiction with weak AML controls, largely via a mobile app, should rate country and channel risk high, apply EDD to those corridors, and set tighter monitoring thresholds. A local law firm's trust account with domestic, low-value, face-to-face clients may rate low - but the firm must still record why.
Rule of thumb
Risk drives response, and the response must be documented. If you cannot point to the written assessment that justified a CDD level, the answer is wrong.