On 8 October 2026 the OCC announced a cease and desist order and a $350 million civil money penalty against American Express National Bank (OCC release). One finding concerned the risk assessment itself. American Express "failed to tailor its BSA/AML risk assessment to its business activities": it focused on the risks of its "relatively narrow demand deposit account products and services" and too little on those of its "more dominant credit and charge card products". Gaps in monitoring and reporting, the release adds, resulted in a failure to timely identify, evaluate and sufficiently report about $13 billion of suspected trade based money laundering over the past decade. Assessing its own anti money laundering risk is the first duty FATF Recommendation 1 and its interpretive note set for a firm.
Why is an AML risk assessment required, and by which rules?
The FATF standard asks firms to "identify and assess their money laundering and terrorist financing risks (for customers, countries or geographic areas; and products, services, transactions or delivery channels)". The result is documented "to be able to demonstrate their basis", in proportion to "the nature and size of the business" (FATF Recommendations, INR 1, paragraph 12).
In the UK, regulation 18 of the Money Laundering Regulations 2017 sets the same five factor groups, an up to date written record unless the supervisor says one is not needed, and a copy for the supervisor on request. Regulation 18A adds proliferation financing. It has applied since 1 September 2022.
In the EU, Directive (EU) 2015/849, Article 8, applies through national law until Regulation (EU) 2024/1624 takes over on 10 July 2027. Under its Article 10 the compliance officer draws the assessment up and the management body "in its management function" approves it, and credit and financial institutions cannot be excused from it.
The EU assessment is also wider than money laundering alone. Article 10(1) adds the risks of non implementation and evasion of targeted financial sanctions, a step toward a full financial crime risk assessment.
In the US, the FFIEC's examination manual calls it "not a specific legal requirement", yet examiners assess it, and FinCEN's proposal of 10 April 2026 would write risk assessment processes into the program rule. Read this way, AML risk is the inherent risk in each factor, before any control is counted.
How do you build an AML risk assessment, and which risk indicators matter?
Table 1. The six build steps of an AML risk assessment.
| Step | Built from | Result | Signed off by |
|---|---|---|---|
| 1. Business overview | Products, customer types, channels, countries, volumes | A map of the business | Compliance officer |
| 2. Inherent risk scoring by factor | The customer base, PEPs, products, high risk countries on FATF and EU lists, channels; national and sectoral assessments | A rating for each factor before controls | Compliance officer |
| 3. Control quality | Policies, procedures, testing and audit findings, alert outcomes | A rating of each control's design and effect | Compliance, with internal audit |
| 4. Residual risk | Steps 2 and 3 | The risk that remains, by factor and overall | Compliance officer |
| 5. Appetite and approval | Residual risk against the firm's risk appetite | Actions with owners and dates; sign off | Management body (EU) or senior management (UK) |
| 6. Record and review | The signed assessment and its change log | A dated version the supervisor can ask for | Compliance officer |
AMLA's draft guidelines of 16 April 2026 set four minimum requirements in the same order: a business overview, inherent risks, the quality of controls and residual risks. They add that factors which are high risk by nature cannot be completely mitigated by control measures.
Take an illustrative payments firm. In the application of the six steps, payouts to merchants in high risk countries rate high at step 2. Enhanced onboarding and a hold on each merchant's first payout rate as moderate controls at step 3, so residual risk stays above medium at step 4. The board accepts that at step 5. It adds two dated actions. Key risk indicators, such as the share of customers rated high or alerts per thousand transactions, show between reviews, and throughout the year, whether that line is moving.
Step 6 is where an assessment is won or lost in an inspection. complead, formerly Sanction Scanner, supports regulatory compliance by recording reports, filings, decisions and approvals as the work is carried out, so they become available when a supervisor requests them; the compliance officer still writes and signs the assessment. The FFIEC treats a written record of the factors and the weight given to each as sound practice.
National, sectoral, business wide, customer: which assessment is which?
Table 2. Four risk assessments compared.
| Assessment | Who performs it | What it covers | What it produces | Rule |
|---|---|---|---|---|
| National (EU: also supranational) | The state; in the EU also the Commission | A country's money laundering threats and weak points | A national risk assessment, such as the US Treasury's 2024 edition | FATF Recommendation 1 |
| Sectoral (SRA) | A supervisor or the state | One sector, such as payments or legal services | A sector view that firms must take into account; less complex firms may start from the supervisor's version in AMLA's draft | AMLR Article 10(1)(c) |
| Business wide | The firm's compliance officer | The firm's own customers, products, countries and channels | The AML risk assessment | INR 1 paragraph 12; regulation 18; AMLR Article 10 |
| Customer | The firm's analysts | One customer in the onboarding process and after | A rating (customer risk assessment; KYC risk rating) | INR 1; regulation 28(12); AMLR Article 20(2) |
The four feed each other from top to bottom: the national and sectoral views feed the firm's assessment, and the firm's assessment sets the factors each customer rating uses. All four serve the risk based approach, the principle that controls follow risk.
What has 2026 brought for the enterprise wide assessment?
- 10 April. FinCEN proposed that a program's risk assessment processes evaluate products, services, distribution channels, customers and geographic locations, review and, as appropriate, take in FinCEN's AML/CFT priorities, and be updated promptly after any significant change. The proposal was still not final on 29 October 2026, months after comments closed on 9 June.
- 16 April to 15 July. AMLA put out for consultation its draft guidelines under Article 10(4), which the regulation asked for by 10 July 2026. The consultation is closed and the results are still to follow.
- 8 October. The OCC's order against American Express, with its finding on the risk assessment.
When does the assessment have to be redone?
An assessment is only as current as its last trigger, so the affected part is redone when one of these happens:
- A new product, service or delivery channel: the EU regulation asks for the assessment "Prior to the launch", and the FFIEC says a bank may need an update when new products and services arrive.
- A new country or customer segment, which the same article names.
- A merger or acquisition, an update point the FFIEC names too.
- A rule change or a new national or sectoral assessment, because the inputs to step 2 have moved.
- An audit or supervisory finding, since control quality at step 3 has changed.
- A shift in the customer base, the largest factor.
No fixed cycle applies. The FFIEC says there is no requirement to update "on a continuous or specified periodic basis", while FinCEN's proposal would require updates promptly after a significant change. So the version date has to keep pace with the firm's own change log, and an assessment that weighs the business the firm sells least, as the OCC found at American Express, describes a different firm.
Related terms
- Customer risk assessment. Rating one customer against the firm's factors.
- KYC risk rating. The score or band a customer ends up with.
- AML compliance officer. The person who draws up the assessment.
- Enhanced due diligence (EDD). The extra checks a high rating triggers.
- Risk based approach. The principle the assessment puts into practice.
- AML policy. The written document the assessment's results feed.
How this entry was checked. The payments firm in H2 2 is illustrative, and the definition follows paragraph 12 of the Interpretive Note. The author, Burçak Aydın (Finance Manager at complead), read the FATF Interpretive Note to Recommendation 1 (June 2026 edition), the 9 July 2024 consolidation of Directive (EU) 2015/849 (Article 8), Regulation (EU) 2024/1624 (Articles 10, 20 and 90), AMLA's draft guidelines under Article 10(4) and its consultation page, the UK Money Laundering Regulations 2017 (regulations 18 and 18A), the FFIEC manual's risk assessment section, FinCEN's proposal of 10 April 2026 and the OCC's release of 8 October 2026; a second read by Fatih Coşkun, Founder and CEO of complead, follows before publication. Last reviewed: 30 October 2026.
