The business-wide risk assessment: The document inspectors ask for first

Why this document exists

A designated person is required to carry out an assessment of the money laundering and terrorist financing risk in its own business, to document it, and to keep it current. It is the foundation the rest of the AML framework is supposed to rest on.

That relationship is the part firms miss. The business risk assessment is not a standalone compliance artefact. It is what your policies are meant to be a response to, and what your client risk ratings are meant to be calibrated against. A firm whose assessment says its highest exposure is cash-intensive clients, and whose onboarding treats those clients identically to everyone else, has written a document that contradicts its own practice.

An inspector who reads the assessment first is reading it as a map of what the firm claims to know about itself. Everything examined afterwards gets checked against it.

What section 30A actually says

The duty was written into the Criminal Justice Act in 2018. A designated person must carry out the assessment, document it unless the Central Bank has told the firm in writing that an individual documented assessment is not required, keep it up to date under the firm’s own policies, have it approved by senior management, and produce the records to the Central Bank on request. The Central Bank’s AML guidelines go further on governance: the board should review and approve both the methodology and the assessment itself at least once a year, and a generic assessment that has not been adapted to the firm’s business model is, in the Bank’s words, unlikely to meet the requirements of section 30A.

Two consequences follow for the compliance officer. The approval has to be minuted, because an assessment nobody signed off does not meet the section. And the methodology is itself a document the board has seen, which means it has to exist separately from the assessment it produced.

The factors the Act puts in front of you

The assessment has to weigh the risks arising from the firm’s own circumstances, and the legislation directs attention to a specific set of factors:

• Customers. The types you act for, and what the mix says about exposure
• Products and services. What you actually sell, and which parts of it launderers would find useful
• Countries and geographic areas. Where clients, funds and counterparties are, not just where you are
• Transactions. Size, frequency, pattern, and the ones that would not look odd until you looked twice
• Delivery channels. Face to face, intermediated, remote onboarding, and what each one costs you in certainty

Each factor needs a conclusion attached, not a description. "We onboard remotely" is a fact. "We onboard remotely, which weakens identity assurance, so we apply the following additional checks" is a risk assessment.

The sources you must have regard to

Section 30A also says what the assessment has to be informed by: the national risk assessment, any guidance on risk from the firm’s competent authority, and, for banks and other financial institutions, the European Banking Authority’s guidelines on risk factors, which were extended to crypto-asset service providers in 2024. The national picture changed in June 2026, when the Department of Finance published Ireland’s third national risk assessment, the first since 2019. It rates the money laundering threat as moderate, driven by drug trafficking and fraud, and the terrorist financing threat as low, and it flags retail and digital banking, crypto-assets, e-money and money remittance as the sectors of very significant risk. It comes with a thirty-point action plan ahead of Ireland’s FATF evaluation in 2028.

An assessment that predates June 2026 therefore needs a documented reconsideration against the new national findings, even if the conclusion is that nothing changes for this firm. The Central Bank’s Financial Crime Bulletin, which it began publishing in December 2025, is the other source worth reading before each review: it says what the supervisor is currently worried about, which is a reasonable guide to what it will ask.

Writing one that is about your firm

The failure mode is the downloaded template with the firm name changed. It is easy to spot: it describes a sector rather than a business, it is silent on anything the firm actually does, and every risk in it is rated medium.

Tests worth applying to your own draft:

1. Could a competitor use this document unchanged? If yes, it is not about you.
2. Does anything in it rate as high? An assessment with no high risks is either a very unusual firm or an unfinished document.
3. Does it name a product you sell, a jurisdiction you deal with, or a channel you use? By name, not by category.
4. Does anything in your policies exist because of a conclusion in here? If the two do not connect, one of them is decoration.

Length is not the measure. A focused eight pages that engage with the actual business beat forty pages of sector background every time.

A method that holds up

The method the Central Bank expects to see is the one its own supervisors use: inherent risk first, then controls, then residual risk. For each factor the assessment states how likely misuse is and how serious it would be, usually on a three- or four-point scale, and explains the rating. It then names the controls that reduce that risk and says how the firm knows they work: tested, sampled or audited, rather than assumed. What is left is the residual risk, which is what the board is being asked to accept.

The ratings rest on data, and the data belongs in an appendix: customers by risk band, the number of PEPs, the share of customers and payments touching higher-risk jurisdictions, product volumes, the channel mix, alert and report counts. Two further points from the Central Bank’s guidelines apply to many Irish firms. A group assessment written elsewhere has to be granular enough to describe the Irish entity, or it does not count. And a firm that buys in a risk-scoring model has to understand how it combines the factors and be able to show that the scores reflect the firm’s own view of its risk.

A structure that passes

1. Scope: the entities and business lines covered, the date, the owner and the version
2. Methodology: the scales, the scoring rules, and how inherent, control and residual ratings are derived
3. The business profile, with the data behind it
4. Inherent risk, factor by factor, with the reasoning
5. Controls, and the evidence that each one operates
6. Residual risk against the risk appetite the board has set
7. Gaps and actions, each with an owner and a date
8. The link to the customer risk methodology and to the policies the conclusions drive
9. The approval record and the change log

From business risk to client risk rating

The assessment earns its place by driving the client risk methodology. The link should be legible: these are the factors that matter in this business, therefore these are the factors that push a client into enhanced due diligence, therefore these are the measures applied.

Where the chain breaks, it usually breaks in one of two ways. Either the client risk model was bought in and never reconciled to the firm’s own assessment, or the assessment was written after the model and reverse-engineered to agree with it. Both are visible to somebody reading them side by side.

Section 30B: The customer risk assessment

The link is statutory. Section 30B requires the firm, when deciding how much due diligence to apply, to assess the risk of each customer or transaction having regard to its business risk assessment, to the same national and supervisory sources, and to a set of risk variables the Act lists: the purpose of the account or relationship, the level of assets or size of transactions, the regularity of transactions and the length of the relationship, among others. The Act’s schedules add the factors that suggest lower risk, which open the door to simplified due diligence, and the higher-risk factors that require enhanced measures.

In practice the test an inspector applies is a reconciliation. The business assessment says which customer types, products, countries and channels carry the risk. The customer methodology should weight exactly those things. Then the distribution of ratings should look like the business the assessment describes: a firm whose assessment identifies material exposure to higher-risk jurisdictions, and whose customer book is rated 97 per cent low, has a problem in one document or the other. The guide to customer due diligence covers what each rating has to trigger.

Keeping it current

A risk assessment is a live document with a review cycle, an owner and an approval. At minimum:

• Reviewed annually, with the review recorded even when nothing changes
• Reviewed on material change: a new product, a new market, a new delivery channel, an acquisition
• Reviewed when the external picture moves, including national risk assessments and supervisory guidance
• Approved at senior management level, with the approval dated

The version history matters as much as the current version. It shows a firm that has been paying attention, which is a different impression from one that produced a document once.

What the review record should contain

The Central Bank’s guidelines ask firms to record the changes made to the assessment as part of documenting it, so the review needs a written output even when the conclusion is that nothing material has moved. A review minute that would satisfy a reader covers:

• What changed outside the firm: the national risk assessment, Central Bank guidance and bulletins, enforcement cases, sanctions developments
• What changed inside it: products, channels, markets, the customer base, incidents, suspicious transaction trends, audit and inspection findings
• Whether the methodology changed, and why
• The ratings that moved, and the ones that were challenged and kept
• The actions arising, with owners and dates
• The board’s approval, dated, with the discussion minuted rather than noted

The failures that come up most

• No document at all, on the basis that the firm is small
• A document that exists but has never been approved by anyone
• Everything rated medium, so nothing is prioritised
• No connection between the assessment and the client risk methodology
• Last reviewed three years ago, in a business that has changed since
• Written by an adviser, never read by the people doing onboarding

The last one is the most consequential. A risk assessment that lives in a folder shapes nobody’s behaviour. The staff doing onboarding need to know what their firm considers risky, because they are the control that acts on it.

What the Central Bank says it finds

The same findings recur across the Bank’s inspection bulletins and speeches, sector after sector: firms with no assessment at all, assessments that do not reflect the inherent risks of the business, assessments that are high-level or incomplete, board approval that cannot be evidenced, group templates never adapted to the Irish entity, and no connection between the assessment and the customer risk methodology. None of these is a subtle failure. Each is visible from the document alone, which is why it is the document the inspection reads first.

The questions an inspector asks about it

A compliance officer who can answer these from memory, and point to the page, has done the work:

1. When was it last approved, by whom, and where is the minute?
2. What methodology produced the ratings, and has the board seen it?
3. Which three risks are rated highest, and what does the firm do differently because of them?
4. What data sits behind the customer and geography ratings?
5. How did the June 2026 national risk assessment change it?
6. How does it feed the customer risk model, and does the distribution of customer ratings match it?
7. Which controls were tested, and what did the tests find?
8. Who outside compliance has read it, and how do onboarding staff know what it says?

The eighth question is the one to prepare for. The guide to Central Bank inspections covers how staff interviews test it.