Pull up your last AML risk assessment. Now think about everything your business has changed since it was approved.
New customers? A different payment method? An online onboarding process that replaced meetings at your office?
Each change may seem small on its own. Together, they could mean the assessment no longer describes how your business works.
That does not automatically mean your risk has increased. It means the assumptions behind your ratings need another look.
Use these seven checks to spot where your AML risk assessment may need updating. Keep the document beside you as you read. You will get more out of this exercise by comparing it with what actually happens in your business.
Before You Start: What Has Changed?
See what applies since your last review:
- ☐ We serve different types of customers.
- ☐ We have introduced a product or service.
- ☐ We work with customers or payments from new countries.
- ☐ We have changed how customers join.
- ☐ Our transaction volumes or payment patterns have shifted.
- ☐ We have changed systems, providers, or staff responsibilities.
- ☐ We have received new findings or identified control gaps.
Unsure about an answer? Write down who can confirm it. Sales, operations, finance, and compliance may each know about changes that never reached the assessment.
1. Your Customer Base Looks Different
Perhaps you used to work mainly with local individuals. Now, more of your customers are overseas companies with several layers of ownership.
Your business has changed, even if you still sell the same service.
Look at whether your customer checks reflect that shift. Can your team identify relevant beneficial owners? Do the files explain why customers need your service and what activity you expect?
Consider this: A property brokerage starts handling purchases for companies. Its onboarding form still asks only for an individual buyer’s details.
The first question is whether the form collects enough information for the new customer relationships.
Check your assessment: Does its description of your customers match the people and businesses you serve today?
2. You Have Added a Product or Service
A new service can introduce a different way for money to move through your business.
Customers might make larger payments, use intermediaries, or complete transactions faster than before. Existing checks may still work, but that needs testing.
Before introducing a service, map the process from the customer’s first enquiry to the final transaction. Identify where information is collected, where decisions are made, and who handles exceptions.
If the service is already running, compare that plan with actual customer files.
Ask your team: “What can customers do through this service that they could not do before?”
The answer gives you a useful starting point for your AML risk assessment review.
3. Your Geographic Exposure Has Expanded
Your office can stay in the same place while your exposure changes.
A customer may operate abroad. A company’s owners may be based in another country. Payments may now arrive from markets your earlier assessment never considered.
Review those connections rather than looking only at customer addresses.
Try this: Your Dubai office starts serving customers who receive funds from a new overseas market. Has your geographic exposure changed?
Yes. The office address is unchanged, but the business now has a payment connection worth examining.
That connection does not, by itself, determine the risk rating. You still need to understand the activity, relevant country information, and the controls available.
Check your assessment: Which countries appear in recent business activity but are missing from the document?
4. Customers Join Through a Different Channel
Moving from office appointments to remote onboarding changes how your team collects and checks information.
Working through agents or intermediaries introduces another question: who is responsible for each step?
Take one recent customer file and follow it from first contact to approval.
- Who collected the documents?
- Who checked the information?
- Who followed up on missing details?
- Who approved the relationship?
You should be able to follow the decision from the records.
If staff have to reconstruct what happened from messages and memory, investigate why. The process may need clearer responsibilities, better records, or both.
Check your assessment: Does it describe the onboarding channels you use now?
5. Transactions Have Grown or Changed
More business means more work for the people applying your anti-money laundering controls.
Imagine your customer numbers double, but the review team stays the same size. The policy may look fine. The backlog may tell a different story.
Look beyond transaction totals. Check payment sizes, frequency, methods, and cross-border activity. Then examine whether staff can still review that activity properly.
Useful questions include:
- Are customer reviews becoming overdue?
- Are alerts waiting longer for investigation?
- Does recorded expected activity match current behaviour?
Growth is not evidence of money laundering. However, it can expose a gap between the controls you planned and the controls your team can deliver.
6. Your Systems or Responsibilities Have Changed
Buying a screening tool does not tell you whether it works properly in your business.
The same applies to outsourcing customer checks or changing who approves higher-risk relationships.
Suppose a new system receives customer names but misses beneficial owner details stored in a separate field. The tool may be working as configured while the overall process has a gap.
Test the information moving between systems. Check what the provider handles, what your staff handle, and who investigates exceptions.
Staff changes deserve attention too. If an experienced reviewer leaves, confirm who takes over their work and whether that person has the information and training needed.
Check your assessment: Are control ratings supported by recent testing, or by assumptions made when the system was introduced?
7. New Findings Have Challenged Old Assumptions
An audit finding, missed alert, or repeated documentation problem can tell you something your assessment does not yet reflect.
Start by asking whether the issue is isolated.
One incomplete file might be a single mistake. Similar gaps across several files could point to a problem with the form, training, supervision, or workload.
Relevant regulatory developments and financial crime trends may also give you a reason to reconsider earlier assumptions.
For each finding, record what happened, which area it affects, and what evidence you need next.
Closing an action in a spreadsheet is not enough to show the fix worked. Check the outcome.
Pause here: What has your business learned since the last review that still has not made it into the assessment?
Seven Review Triggers at a Glance
| What changed? | What should you examine? |
| Customers | Customer mix, ownership, and relationship purpose |
| Products or services | How the service works and how funds move |
| Geographic exposure | Customer, ownership, and payment connections |
| Onboarding channels | Verification steps and responsibilities |
| Transactions | Activity patterns and review capacity |
| Systems or staffing | Data accuracy and control performance |
| Findings | Wider impact and evidence of corrective action |
Spotted a Change? Here’s What to Review
If one of these seven signs sounds familiar, start with that part of your business. Compare what your assessment says with what happens today.
Speak to the people handling the work. A new payment method may need input from finance. A change in customer types may need a closer look at onboarding files.
These three questions can guide the review:
| Ask yourself | What to look for |
| What has changed since the last assessment? | Recent customer, service, or payment activity that the document does not reflect |
| Do our existing checks still work? | Evidence from customer files, system tests, or outstanding reviews |
| What needs updating? | The assessment, the controls, or both |
You may find that the current risk rating still makes sense. You may also find a gap that needs fixing before you can rely on it. Record what you checked and why you reached that conclusion.
Start with the change that could have the greatest effect on your exposure or your ability to carry out checks.
Bring Your AML Risk Assessment Up to Date
Your AML risk assessment should describe the business you run today.
Start with one change you can confirm. Gather the evidence, examine the controls, and document what needs updating. Follow through on any gaps you find.
Need help identifying where to start? Contact Vertex Compliance to discuss an AML risk assessment review and the changes affecting your business.
Frequently Asked Questions
1. We review our assessment every year. Is that enough?
An annual review can still leave a gap if something important changes halfway through the year. Say you launch a service in March but your next review is in December. Look at the new exposure when it arises. Keep your regular review schedule and check the requirements that apply to your business.
2. Does taking on overseas customers automatically make us high risk?
No. “Overseas” is too broad to tell you much on its own. Where does the customer operate? Who owns the business? How will payments work? Look at those details before deciding on a rating. A foreign address alone does not give you the full picture.
3. Do we have to rewrite the whole assessment after one change?
You may only need to update the affected sections. First, check how far the change reaches. Remote onboarding, for example, can affect identity checks, document collection, and approvals. Start with the change, then follow its impact through the process.
4. What should we have ready before an AML risk assessment review?
Bring the current assessment and evidence of what has changed. That might include customer data, payment records, onboarding files, or audit findings. Also bring examples of where staff are struggling. An overdue review list can reveal a workload problem that the policy document misses.
5. Is a customer risk assessment the same as a business risk assessment?
They look at different things. A customer risk assessment examines one customer relationship. A business risk assessment looks across your customers, services, markets, and operations. If you start serving a different customer group, individual files may need attention—and so may the wider business assessment.
