How to complete a firm-wide AML risk assessment

The Foundation of Your Compliance

To comply with the Money Laundering Regulations 2017, you must produce a written document known as a Firm-Wide Risk Assessment (FWRA). This document identifies and assesses the specific risks of money laundering and terrorist financing that your business faces. It is the mandatory starting point for your practice; you cannot effectively manage client risks without first understanding the risks inherent in your own business model.

Why is this assessment necessary?

In the UK, the "risk-based approach" is the gold standard for anti-money laundering (AML). Instead of treating every client the same, you must focus your resources where the risks are highest. Your firm-wide assessment is the evidence you provide to your supervisor (such as HMRC or a professional body) to show you have thought critically about your vulnerabilities. It dictates the level of "due diligence" you will perform on every client you take on.

The Five Essential Risk Categories

Your assessment must consider at least these five areas. When writing your document, look at each category and ask: "How could a criminal use this aspect of my business to hide dirty money?"

• Customers: Consider your client base. For example, do you deal with high-net-worth individuals, "politically exposed persons" (PEPs), or businesses that handle large amounts of cash? These are generally higher risk than a local salaried employee.
• Countries and Geographies: Do you operate in, or have clients from, countries with high levels of corruption, sanctioned nations, or known tax havens? Even operating in a different UK city can change your risk profile if that area is a known hub for specific types of crime.
• Products and Services: Some services are riskier than others. For example, providing basic bookkeeping is lower risk than helping a client set up complex offshore company structures or facilitating large property transactions.
• Transactions: Think about the nature of the payments you see. High-value one-off payments are typically riskier than small, regular monthly retainers.
• Delivery Channels: How do you interact with clients? Dealing with people exclusively online or through third parties is riskier than meeting them face-to-face with original ID documents.

How to Write Your Assessment

You don't need to be a legal expert to write this, but you must be thorough. Follow these steps to build your document:

1. Identify the Risks: Go through the five categories above and list every potential risk relevant to your specific side hustle or new firm.
2. Evaluate the Risk: For each risk identified, decide if it is "Low," "Medium," or "High." Consider the likelihood of it happening and the potential impact if it did.
3. Detail Your Mitigations: Explain what you will do to reduce these risks. For example, if you identify that remote onboarding is a "High" risk, your mitigation might be to use an electronic ID verification tool.
4. Formalise the Document: Type this up into a formal report. Include the date it was created and the date it is due for review.

Pro Tip: Your supervisory body (like the AAT, ACCA, or HMRC) often provides templates or sectoral risk assessments. Use these as a guide, but ensure your final document is tailored specifically to your business. A generic, "copy-paste" assessment is often flagged as non-compliant during inspections.

Living Document: Keeping it Current

A firm-wide risk assessment is not a "one and done" task. The regulations require you to keep it up to date. You should review your assessment at least annually, or sooner if there is a significant change in your business, such as:

• Offering a brand-new service.
• Taking on clients from a new industry or country.
• Significant changes in the law or guidance from your supervisor.

Note: This assessment informs your other AML duties, such as checking individual client IDs, but it is a distinct legal requirement that focuses on the firm as a whole.