Risk Assessment Is a Living Model
Risk-based AML/CFT programs in banking depend on one central instrument: a risk assessment that explains how a particular bank could be misused and what the consequences would be. The question is not how to produce a more elaborate scorecard. It is how to combine evidence about the bank’s business and the surrounding threat environment so that customer controls, monitoring, staffing, and supervisory attention follow the risks that matter. A reader who understands that mechanism can tell when a risk assessment is guiding decisions and when it is merely collecting labels.
A risk assessment is often treated as a document. In a functioning AML/CFT program, it is better understood as a model: a reasoned, revisable account of the bank’s exposure. The document may record the model, but the model’s value is shown by what it changes.
What the bank is actually assessing
The starting question is not “Which risk category does this activity belong to?” It is “How could this bank be vulnerable to money laundering or terrorist financing through this activity, and what would happen if that vulnerability were exploited?” FATF’s banking-sector guidance says that assessing ML/TF risk requires countries, authorities, and banks to determine how identified threats affect them. That includes analyzing the likelihood of risks occurring and their impact on the individual bank, the banking sector, and, for a large systemic institution, potentially the national economy.
This framing gives the assessment two jobs. It identifies exposure, and it helps rank the consequences of that exposure. A label such as low, medium, or high can make priorities easier to communicate, but the label is not the analysis. Two activities may both be called “medium risk” while creating different control problems. One may involve many routine transactions but little uncertainty about the customer. Another may involve fewer transactions but opaque ownership or a cross-border channel that leaves the bank with less information. The label alone does not tell management where to spend time or what evidence to request.
FATF does not require banks to perform a precise probability calculation. The volume of illicit transactions is not known well enough for a numerical estimate to carry the same meaning in every setting. That does not make the assessment subjective in the casual sense. It means the bank should use disciplined qualitative and quantitative information where it is meaningful, explain the reasoning behind its judgments, and connect those judgments to mitigation.
The information comes from the bank’s actual shape. FATF points to the nature, scale, diversity, and complexity of the business; the markets the bank targets; the number of customers already identified as high risk; jurisdictions connected to the bank or its customers; the channels through which the bank opens accounts and delivers services; internal audit and regulatory findings; and the volume and size of transactions compared with the bank’s normal activity and customer profiles. These factors are not independent boxes. They interact.
Suppose a bank begins offering a new service remotely to customers outside its traditional geographic footprint. The service itself is only one part of the change. The bank must also consider who the target market is, how directly it can interact with customers, whether it relies on another party for customer due diligence, what information it can obtain about beneficial ownership and purpose, which jurisdictions are involved, and what transaction patterns the service could create. A risk assessment that records the new product but ignores the new channel and customer base has not modeled the bank’s new exposure.
The same reasoning applies to transaction volume. A large number of transactions is not automatically evidence of illicit finance, and a small number is not automatically benign. Volume and size have to be considered against what is normal for the bank and the customer. A sudden change in activity may matter because it no longer fits the profile that the bank used to understand the relationship. A stable pattern may deserve a different response from a novel one, even when the dollar amount is similar.
The assessment should also use information that does not originate in the immediate customer file. Business heads and relationship managers may know how a product is actually used. National risk assessments can identify threats that are not obvious from internal data. Government and intergovernmental lists, FATF mutual-evaluation and follow-up reports, typologies, and feedback from a financial intelligence unit can sharpen the bank’s view. The point is not to import every external warning automatically. It is to compare external intelligence with the bank’s own activities and ask whether the risk appears in this institution, in what form, and with what potential impact.
That comparison is easiest when the bank treats risk as a pathway rather than a pile of flags. A customer characteristic may matter because it changes the likelihood of misuse. A distribution channel may matter because it changes how much the bank can verify directly. A jurisdiction may matter because it changes the information available or the threat environment. A product may matter because it changes the speed, volume, or opacity of money movement. The risk conclusion comes from the connection among these factors. Removing one factor from the context can make the result look precise while making the underlying judgment less accurate.
The 2026 proposal illustrates how broad that information environment can be for a Board-supervised bank. It mentions information from other financial institutions, emerging-risk and typology information shared through permitted channels, payments returned or flagged because of ML/TF concerns, and internal signals such as internet-protocol addresses, device logins, and related geolocation. Feedback from law enforcement about a report or information received through a lawful request can also inform the assessment. Treasury and FinCEN national risk assessments may add a wider view of threats and vulnerabilities. These examples do not create a universal data checklist. They show why a bank’s risk model must be able to incorporate signals from both its own operations and the wider financial system.
The quality of that information matters as much as its variety. The proposal says banks should take measures to keep relevant information reasonably current, complete, and accurate. A risk assessment built from stale customer data or a monitoring system that does not capture a material type of transaction can produce a confident but misleading conclusion. Conversely, a new piece of intelligence should not be treated as self-interpreting. The bank must assess its relevance to the institution’s actual business and determine whether it changes exposure, impact, or the adequacy of existing controls.
That comparison is why a risk assessment cannot be delegated entirely to a formula. A system can organize inputs, but someone still has to decide whether an observed pattern is relevant to the bank’s products, customers, jurisdictions, and controls. The assessment also needs skilled and trusted personnel and technical capacity suited to the complexity of the bank’s operations. A highly complex bank may need more formal or analytically sophisticated processes; a smaller bank with a narrow business model may be able to use a simpler process. Neither method is automatically better. The relevant question is whether the method is capable of producing a credible understanding of that bank’s exposure.
The assessment becomes operational when senior management approves it and uses it as the basis for policies and procedures. FATF says the risk assessment should be documented, maintained, communicated to relevant personnel, and aligned with the institution’s risk appetite. That alignment matters because management is not only identifying dangers; it is deciding what level of residual risk the bank is prepared to accept after mitigation. If the controls do not match the assessment, the program contains a broken link between diagnosis and response.
This also clarifies the difference between an assessment and a risk appetite statement. The assessment describes the exposures the bank believes it faces. Risk appetite expresses which residual risks management is prepared to carry after controls are applied. The two should inform each other, but one cannot substitute for the other. A bank cannot make an exposure acceptable simply by declaring that it is willing to accept it. It has to decide whether the risk can be mitigated effectively and whether the remaining exposure is consistent with the bank’s responsibilities and legal obligations.
Communication closes another potential gap. A risk conclusion that stays with a small group of analysts cannot guide the people who approve products, open relationships, investigate activity, or maintain monitoring systems. Relevant personnel need to understand what the assessment means for their decisions, not merely know that a category has been assigned. This is especially important when the bank uses several processes. A product team may see a new service first; a relationship manager may notice a change in customer behavior; an auditor may find that a control does not work as intended. The living model depends on those observations reaching the people who can reassess the exposure.
Why currentness matters more than a single document
The Federal Reserve’s July 2026 notice of proposed rulemaking gives this living-model idea a specific U.S. regulatory form, although the document remains a proposal for banks supervised by the Board. It would require a bank to identify, assess, and document ML/TF risks through “risk assessment processes,” deliberately using the plural. A bank could rely on multiple processes applied within its AML/CFT program rather than creating one consolidated assessment document solely to satisfy the rule. The proposed approach would examine the totality of those processes.
That choice addresses a practical weakness in document-centered compliance. A bank may have a formal annual assessment, a product-approval process, customer-segmentation work, monitoring reports, audit findings, and information from other institutions. Treating only one document as the risk assessment could hide how the bank actually forms its judgment. Conversely, having many processes does not by itself demonstrate quality. The bank would still need to show that the processes collectively identify, assess, and document its material exposure and inform the controls that follow.
The proposal’s use of multiple processes also leaves room for different time horizons. A broad assessment may describe the bank’s overall exposure, while a product review may examine a specific service before launch and monitoring information may reveal a change after launch. Those processes should not become disconnected silos. Their value lies in how their findings can be combined and how a material conclusion travels into the bank’s controls. A collection of documents can be just as static as one document if no one is responsible for reconciling what they show.
The proposal identifies several dimensions that the processes would need to evaluate: products, services, distribution channels, customers, and geographic locations. It also says the bank should review the government’s AML/CFT Priorities and incorporate them as appropriate. “As appropriate” is important. The bank would not mechanically apply every national priority to every business line. It would review the priorities, consider how they could appear in its own customers, products, services, geographies, and channels, and make a risk-based determination about their relevance.
That discretion has a corresponding duty. The proposal warns that a surface-level review would not be enough. If a pattern of transactions could plausibly connect to illicit-finance activity, a bank should not dismiss it merely because the connection to a named national priority is not immediate. Public priorities inform the bank’s assessment; they do not replace it. Nor does the bank’s own assessment excuse it from considering information supplied by competent authorities and other reliable sources.
Currentness is the second half of the model. The proposed rule would require prompt updates when the bank knows or has reason to know of a change that significantly changes its ML/TF risk profile. The examples make clear that this is not limited to a crisis. A new product or service, a new geography, a substantial change in an existing customer type, new risk-mitigation technology, or growth or contraction through a merger, acquisition, or divestiture may change the exposure. External changes in the threat environment may do so as well.
“Prompt” does not mean that every minor operational adjustment requires a new enterprise-wide assessment. The proposed trigger is a significant change in the risk profile. The bank must exercise judgment about materiality, but that judgment should be tied to facts: whether the change alters who can use the service, how money moves, what information is available, which jurisdictions are involved, or how well existing controls work. A process that records the trigger, the reasoning, and the resulting control decision gives management and supervisors something they can evaluate. A process that silently leaves the old profile in place gives them no reliable way to know whether the program still fits.
The sequence is easier to understand as a cycle:
The important transition is from “change” to “assessed.” A new fact does not automatically determine the answer. It creates a reason to revisit the model. The bank then has to determine whether the fact changes likelihood, impact, or both; whether the existing controls still address the exposure; and whether attention or resources should move. In a risk-based program, the assessment is the mediator between a business change and a control change.
That mediation also protects against overreaction. If every new product or external warning automatically produced the same enhanced process, the bank would recreate the uniformity problem under a different name. A change triggers reconsideration, not a predetermined conclusion. The bank may determine that an AML/CFT Priority has limited relevance to its particular profile or that existing controls already address part of the concern. What matters is that the bank can show it made that determination through a reasonable process and kept its information current.
The proposed framework also makes scale relevant. A community bank with limited activities, a narrow geographic footprint, and a concentrated local customer base may use streamlined or qualitative risk-assessment processes. A large institution with a broad product offering, complex corporate structure, and greater exposure to higher-risk customers or locations may need more formal and analytically complex processes. This is not a privilege for small banks or a presumption against large ones. It reflects the fact that a model must be capable of representing the exposure it is meant to describe.
A living model therefore has three qualities. It is connected to the bank’s real activities, it makes a reasoned distinction between more and less consequential exposure, and it changes when material facts change. It also remains explainable to the people who use it. A customer-facing team needs to understand what a risk conclusion means for a relationship. Management needs to know whether resources match the conclusion. A supervisor needs to evaluate whether the bank’s judgment is supported by a reasonably designed process.
This is where the risk-based model hands off to the customer relationship. Enterprise-level assessment cannot remain at the level of products and geographies. It must shape what the bank asks a customer, how it understands the purpose and ownership of a relationship, and how it interprets activity over time. The next question is how that broad risk model becomes a practical profile that can guide due diligence and monitoring without turning either into a mechanical ritual.