Firm-wide AML Risk Assessment

The written practice-wide risk assessment every accountancy and bookkeeping business supervised for anti-money laundering must have under regulation 18 (and, for proliferation financing, regulation 18A) of the Money Laundering Regulations 2017 as amended (“MLRs”). It identifies where your firm is exposed, scores each risk, records the controls you rely on and the residual risk, and sets an action plan. Your supervisor will usually ask for it first at a monitoring visit.

• When you first register with a supervisor, and at least once a year after that
• When you add a new service, technology or delivery channel, or take on a block of clients
• After changes in the law, a new National Risk Assessment, a supervisor risk alert, a SAR or a compliance review finding

• Complete Part 1 with your firm’s profile and numbers – use real data from your practice software
• Score each risk in Part 4 using the method in Part 2, describe your actual exposure and controls, and delete rows that genuinely do not apply (saying why)
• Summarise in Part 5, set actions in Part 6 and have senior management approve it in Part 9
• Share the key findings with staff and keep every version for at least five years