Financial Crime Risk Assessment: A Practical Methodology

A founder has a business plan, a draft financial crime policy and a monitoring system in design. Then a regulator asks a straightforward question: how did the firm decide which risks mattered, and why are its proposed controls proportionate? A generic risk statement won't answer that. The firm needs a clear line from its actual business model to its risk ratings, controls, evidence and management decisions.

A defensible financial crime risk assessment is not a document to complete once and file away. It's a working control system that helps a firm explain its choices, spot changes and show how its controls operate. The method below builds that system through six stages: define the business perimeter, identify inherent risks, score likelihood and impact, map controls, calculate residual risk, and assign owners, evidence and review triggers.

Table of Contents

• Why a Living Methodology Matters
  • Scope the business perimeter
• Identifying Inherent Risks by Typology
• Scoring Likelihood and Impact
• Mapping Controls and Calculating Residual Risk
• From Assessment to Operating System
  • Make change traceable
• Assessing Risk Before You Have the Data
• Putting It All Together and Next Steps

Why a Living Methodology Matters

Start with the business, not a template. A firm describing itself only as “a payments business” hasn't yet explained what it does, who it serves or where its exposure comes from. A regulator-ready perimeter distinguishes activities such as payment services and e-money issuance, then identifies customer segments, delivery channels, jurisdictions, counterparties and any agents or other intermediaries.

That distinction matters because the UK's 2020 National Risk Assessment (NRA) treated financial crime exposure as sector-specific, not uniform across the economy. It rated retail banking high risk for both money laundering and terrorist financing in 2017 and 2020, while payment services and electronic money institutions were rated medium for both risks in those years. Legal services remained at high overall risk of abuse for money laundering. These are national benchmarks, not a substitute for assessing a firm's own business model (UK National Risk Assessment 2020).

The later national assessment changed the picture for payments. The UK's 2025 NRA raised the money-laundering risk classification for regulated e-money institutions and payment service providers from medium to high. For a firm in these sectors, “regulated payments” is not a sufficient risk category. Assess the specific exposure created by the services, transaction patterns, customer base, corridors, agents and monitoring capability (UK National Risk Assessment 2025).

Scope the business perimeter

Record six elements, with enough detail to distinguish the firm's own activities from exposure introduced by other parties:

• Activities and products: What services will the firm provide, including any e-money issuance or crypto-asset activity?
• Customers: Which individuals, businesses or institutions will use those services, and which customer types need separate treatment?
• Delivery channels: How will customers be acquired, verified and served?
• Jurisdictions: Where are the firm, customers, counterparties and transaction flows located?
• Counterparties and intermediaries: Which banks, agents, partners or other firms help deliver the service?
• Operating arrangements: Which processes are performed in-house, outsourced or supported by technology providers?

This is also where fraud belongs in the overall risk picture. Firms looking to distinguish fraud scenarios from related financial crime exposures can use Lighthouse Consultants' practical guide on how to assess fraud risk. The result of scoping should be a concrete perimeter that feeds directly into risk identification, not a sector label that hides meaningful differences.

Identifying Inherent Risks by Typology

The most common failure in authorisation drafts I review is a typology list lifted from a template: scenarios the firm's product could never produce sit alongside gaps where its real exposure lies. Identification comes before control credit. Work out how financial crime could arise through this specific business while assuming nothing is mitigated yet.

Take rapid movement of funds through a cross-border payments firm. Money enters an account and is transferred onward before the firm has enough context to assess the activity. Document the specifics: what payment timing, recipient changes, transaction history and links between accounts would surface the pattern, and which monitoring indicators reflect actual payment flows rather than a generic rule applied without explanation.

Opaque ownership creates a different problem. A business customer may sit behind a structure that obscures who ultimately controls it. Compare customer-provided ownership information with available business and due-diligence records, and escalate inconsistencies or unexplained changes. Sanctions-evasion scenarios deserve the same discipline: state what information is screened, how potential matches are resolved and who can approve the outcome. Decision rights belong inside the scenario description itself.

Where agents or money-services activity form part of the model, informal value transfer belongs on the list. HMRC identifies informal value-transfer systems, cross-border foreign-exchange activity and agent-principal networks as factors that can increase money-laundering and terrorist-financing exposure for money-services businesses (HMRC guidance; for supervisory context, see our overview of HMRC money-laundering supervision). Test how the firm supervises its agents and whether its services or counterparties could expose it to these arrangements.

New payments, fintech and crypto applicants cannot wait for mature transaction data before launch. Build a scenario library from the planned service, relevant external threat intelligence and deliberately conservative assumptions. For each scenario, record what data would reveal it, which indicators trigger a review, what the investigator does next and what event forces the inherent-risk rating back onto the table: a new corridor, a new customer segment, a material product change. That trigger list is what separates a living assessment from one dusted off each year. When operating evidence arrives, revise the assumptions and record what changed.

Scoring Likelihood and Impact

A risk score is only as useful as the reasoning behind it. Define likelihood and impact in plain language before assigning ratings. For example, a firm might describe likelihood as a judgement based on its customer base, service features, jurisdictions and expected transaction patterns. Impact can consider potential harm to customers, exposure to criminal proceeds, sanctions concerns, operational consequences and regulatory implications. State the criteria so another reviewer can follow the decision.

A firm can use a compact matrix, provided it applies the criteria consistently. The exact labels matter less than the logic. A cross-border e-money proposition might rate sanctions evasion as high likelihood and high impact if its planned corridors, counterparties and customer profile create substantial exposure. That's an illustrative assessment, not a claim that all cross-border e-money businesses should receive the same rating. The firm should document the specific corridor and customer facts that support its judgement.

The FCA's review of risk-assessment processes found that firms commonly failed to identify all relevant risks or tailor their assessments to their own businesses. It also observed that many treated the business-wide risk assessment as an annual exercise rather than a responsive process (FCA review of risk-assessment processes and controls). A score without a reasoned account of business exposure is hard to defend.

Practical rule: Score products, customer groups or corridors separately when their exposure differs. Averaging a high-risk activity together with lower-risk business can conceal the concentration that should drive controls.

Keep the inherent-risk register auditable. For each material risk, record the scenario, affected activity, likelihood rationale, impact rationale, score, evidence used and responsible owner. Teams that need a structured way to map those assessments can refer to AuditReady's explanation of how to use AuditReady to map compliance risks.

Mapping Controls and Calculating Residual Risk

A firm that lists controls in a policy and stops there has documented intent, not effectiveness. For each material inherent risk, record the preventive controls designed to stop the activity, the detective controls that surface it and the named individuals who operate and oversee each one. Capture how often every control runs, which systems and data it relies on, what evidence it produces and the failure rate the firm is prepared to tolerate.

Take a cross-border corridor. Preventive controls might include customer due diligence (often delivered through KYC as a service), ownership verification and hard restrictions on activity until required information is verified. Detective controls might include transaction monitoring, sanctions screening and investigation procedures. Each control should connect to the stated typology. A standard package applied to every risk tells a supervisor nothing about how this firm operates.

Then test operating effectiveness before assigning residual risk. Sample customer files, beneficial-owner checks, sanctions matches, alert decisions and suspicious-activity escalations. Did staff follow the process? Do the records support their decisions? Were exceptions closed or left open? A control that looks strong on paper often reduces risk by far less than assumed. I have watched firms discover a backlog of unresolved alerts only when a supervisor asked to see the queue.

Supervisory evidence points the same way. In 2023–24, supervisors conducted 9,013 direct actions, covering approximately 10% of supervised firms, and among firms visited or reviewed by the Gambling Commission, 50% were compliant, 25% generally compliant and 25% non-compliant (AML and CTF supervision report 2023–24). One firm in four non-compliant is worth remembering the next time a control register declares that everything is working.

A worked scenario makes the judgement tangible. Residual risk in a cross-border corridor scores low because screening and monitoring exist. Testing then exposes the alert backlog and poor-quality dispositions. The defensible response is to revisit the residual rating, assign remediation with an owner and a deadline, and record the decision. Preserving the lower score because the controls appear in a policy is exactly the annual-formality habit supervisors keep criticising.

From Assessment to Operating System

A living assessment changes what the firm does. That requires documented trigger events, clear decision rights and an impact analysis linking material changes to customers, controls, procedures, systems and accountable managers. A new product, jurisdiction, outsourcing arrangement, agent network or material control weakness should prompt a decision about whether the assessment and related operating documents need revision.

The FCA's 2025 review found that most firms had a business-wide risk assessment, but few identified all relevant risks or adapted the process sufficiently. It described good practice as feeding the assessment into risk appetite, control testing and the wider risk-based approach, with quarterly or trigger-based updates where needed. Treat those intervals as a practical governance approach, not a substitute for reassessing sooner when a meaningful change occurs.

Make change traceable

For each trigger, name who decides whether the risk assessment changes and who must implement the consequences. Then maintain a simple impact record covering the affected customer groups, monitoring rules, due-diligence steps, procedures, training, staffing and management responsibilities. Keep evidence of the decision and resulting changes so that the firm can explain why its operational arrangements still match its documented risk view.

Management information should help senior managers see whether the system is working. Track coverage of customer risk assessments, overdue reviews, enhanced due-diligence completion, alert outcomes, unresolved control exceptions and remediation progress. A dashboard should prompt decisions, not just report activity.

The FCA's corporate-finance survey found that 97% of respondents said they regularly reported financial-crime concerns to senior management, while 11% had no documented business-wide risk assessment (FCA press release on gaps in financial-crime oversight). Reporting concerns doesn't replace an assessment that identifies the firm's exposure and connects it to controls. Firms reviewing the evidence trail across that process can use Glentorion's guide to an anti-money laundering audit as a reference point for organising review work.

Assessing Risk Before You Have the Data

A new firm doesn't need mature transaction history to make a credible pre-launch assessment. It does need to be honest about uncertainty. Start from the intended business model, relevant UK threat information and plausible scenarios, then document the assumptions behind each rating and the evidence that could change it.

For a proposed payment or crypto service, map scenarios to the planned customer journey and transaction flow. Decide which activity should be restricted, referred for manual review or monitored under a defined pilot threshold. Make sure the firm has the staffing and investigation capacity to handle the cases its controls are expected to generate. A monitoring design that relies on rapid investigation but has no credible operational capacity is not proportionate merely because its rules are documented.

Set out what the firm will learn after launch. For example, track whether customer information is complete, whether alert indicators match expected activity and whether investigators can resolve cases with the available data. Agree in advance which findings trigger reassessment, a change to a threshold, additional checks or a pause in activity. This turns uncertainty into something governed and reviewable.

Established firms also struggle with the basics. In the FCA's 2025 survey of 270 responding corporate-finance firms, approximately two-thirds appeared potentially non-compliant with at least one element of their anti-financial-crime framework, and 11% had no documented business-wide risk assessment (FCA financial-crime controls survey). Waiting for a long operating history won't solve a governance problem.

Before launch, make sure the business plan, policies, systems design and management accountabilities tell a consistent story. If a regulator asks how the firm reached its assumptions, the answer should point to the evidence considered, the uncertainty recorded and the actions planned to validate the assessment.

Putting It All Together and Next Steps

A usable financial crime risk assessment connects six things: the business perimeter, inherent risks, likelihood and impact ratings, mapped controls, tested residual risk, and named owners with evidence and review triggers. It should describe the business that exists or is proposed, not an imagined generic firm.

Produce a practical set of working artefacts:

• Perimeter record: Activities, products, customers, channels, jurisdictions, counterparties and operating arrangements.
• Risk register: Typologies, business-specific rationale and inherent ratings.
• Controls map: Preventive and detective controls, owners, frequency, evidence and failure tolerance.
• Testing record: Samples reviewed, findings, exceptions and remedial actions.
• Governance record: Approval, decision rights, trigger events and management information.
• Change log: Material changes to the business, assessment and affected procedures or systems.

Avoid the familiar traps: treating a sector label as a firm-level assessment, averaging away concentrated risk, assuming a policy proves effectiveness, and waiting for historical data before making reasoned decisions. Don't treat the annual review date as the only point at which the assessment can change. Keep it connected to the firm's actual operating model and governance responsibilities. For a wider view of UK regulatory obligations, consult this guide to FCA compliance requirements.

The best first step is specific: write the perimeter before drafting more policy or configuring transaction-monitoring rules. Build a draft register against that perimeter, gather the evidence behind each judgement and identify the decisions management still needs to make. Revisit the assessment when the firm changes its products, customers, channels, jurisdictions or controls.

---

Glentorion supports financial and crypto businesses with regulatory authorisation work, including business-model assessment, application preparation, policy development and management interview readiness. If you're building or updating a financial crime risk assessment as part of your regulatory operating model, visit Glentorion to discuss a scoped engagement.