4.3 Step 2 – Risk assessment

Competent authorities should take a holistic view of the ML/TF risk factors they have identified under Step 1 that, together, will form the basis for the individual risk assessments of subjects of assessment and the sectoral risk assessments.

When drawing up their risk assessment methodology, competent authorities should consider how sectoral and individual risk assessments interact. The sectoral risk assessment provides competent authorities with an overall view of the ML/TF risks to which subjects of assessment in a particular sector are exposed, and the relevance of individual risk factors to subjects of assessment in this sector. Through individual risk assessments, competent authorities should be able to assess the impact of sectoral risks on each subject of assessment, while at the same time using those risk assessments to update and review their sectoral risk assessments as appropriate, including by identifying new risk factors that are common to subjects of assessment in the sector.

4.3.2 Sectoral and subsectoral risk assessment

•  C1

Competent authorities should develop a good understanding of the ML/TF risks present in each sector under their supervision, which will allow them to prioritise their supervisory activities across and within sectors and to identify ML/TF risks that are relevant for a particular sector. The sectoral risk assessment should provide competent authorities with the basis for the individual risk assessment of subjects of assessment in that particular sector, by developing their understanding of the inherent risks within the sector to which subjects of assessment are exposed to inform the competent authority’s understanding of the extent of supervisory attention needed in the sector. Competent authorities should decide whether they have sufficient, reliable information on controls within the sector to carry out the assessment of residual risk. Should this information be deemed insufficient, competent authorities should consider using the relevant supervisory tools at their disposal to obtain sufficient information, as set out in Section 4.4.4.

•  O

Competent authorities should ensure that the sectoral risk assessment is sufficiently comprehensive and enables the supervisor to obtain a holistic view of all relevant risk factors, and the extent to which they affect subjects of assessment in each sector.

In order to perform the sectoral risk assessment, competent authorities should first define the sectors and subsectors, where relevant, under their supervision as described in paragraphs 38 and 39 above.

When carrying out the risk assessment of the sector as a whole or of the subsector, if relevant, competent authorities should perform an assessment of the sector-wide risk factors identified in line with Step 1 of the RBS Model. Competent authorities should base their assessment on the information gathered in line with Section 4.2.6.

As part of this process, competent authorities should consider allocating different weights to different risk factors as described in paragraphs 63 and 64 of these guidelines, to reflect the degree of impact that various ML/TF threats have on the particular sector. 4.3.3 Individual risk assessments

Competent authorities should develop a comprehensive understanding of the inherent risks and, to the extent that they have access to sufficiently reliable data on the quality of the subject of assessment’s AML/CFT controls, residual risks to which subjects of assessment are exposed. To that end, they should carry out individual risk assessments of each subject of assessment. Competent authorities should use all relevant sources to gather the necessary information for the individual risk assessments as described in paragraphs 44 to 48 above.

In order to achieve a comprehensive understanding of risks associated with individual subjects of assessment, competent authorities should establish and maintain an ongoing process and methodology for assessing and reviewing risks associated with the subjects of assessment. When developing their risk assessment processes, competent authorities should:

• a) Be guided by the outcome of the assessment of risks within the sector or subsector to which the subject of assessment belongs. In essence, with the sectoral or subsectoral risk assessment, the competent authority will have already identified the main inherent risks to which individual subjects of assessment within a given sector or subsector are exposed.
• b) Determine how they will assess the relevant inherent risk factors identified under Step 1 of the RBS Model that affect the subject of assessment.
• c) Gather the necessary information that allows them to understand the subject of assessment ’s exposure to customer, products and services, geographical and distribution channel risks. This means that competent authorities should consider whether the same information is required in respect of all subjects of assessment. Where information is gathered from the subjects of assessment, competent authorities should refer to the section on the ‘Quality Assurance’ in these guidelines for additional safeguards that should be put in place.

Where, on the basis of information set out in paragraph 45 b) in these guidelines, competent authorities have developed a sufficient and sufficiently reliable understanding of mitigating measures put in place by subjects of assessment, they should carry out the assessment of the residual risk in respect of those subjects of assessment. However, where such information is not available or reliable, or insufficiently comprehensive, competent authorities should use the inherent risk assessment in respect of those subjects of assessment instead.

When assessing the residual risk factors, competent authorities should take the steps necessary to assess the extent to which the AML/CFT systems and controls, which the subject of assessment has in place, are adequate to effectively mitigate the inherent risks to which it is exposed. As part of this, competent authorities should assess at least:

•  A1
• a) that the AML/CFT systems and controls listed in Articles 8(4) and 19a of Directive (EU) 205/849 are put in place and applied. These controls should be sufficiently comprehensive and commensurate with the ML/TF risks;
•  O
• b) that wider governance arrangements and risk-management processes, including overall risk culture, are adequate and effective.

Competent authorities should determine how to incorporate their professional judgment in their risk assessment work. Section 4.4.4. provides in that respect that the AML/CFT supervisory manual should allow competent authorities to ensure the application of the supervisory tools and professional judgment in a consistent way.

4.3.4 Assessment of the ML/TF risks at the group level

Competent authorities, who are the lead supervisor in accordance with the ESAs Joint Guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849¹⁵ , should develop a holistic view of ML/TF risks to which subjects of assessment which are part of a group are exposed. This means that these competent authorities should develop a risk profile of the subject of assessment under their supervision, taking into account all relevant domestic and foreign risk factors. They should pay particular attention to the risks associated with a subject of assessment ’s cross-border operations and the business activities of parts of their group in other jurisdictions, which may have a bearing on the overall risk profile of the subject of assessment. In particular, the risk assessment should reflect at least the risks arising from the subject of assessment ’s exposure to countries:

• a) that have been identified by the European Commission’s as having strategic deficiencies in their AML/CFT regime, in line with Article 9(2) of Directive (EU) 2015/849;
• b) where the law prohibits the implementation of group-wide policies and procedures and in particular if there are situations in which the Commission Delegated Regulation (EU) 2019/758 should be applied;
• c) which, in accordance with credible and reliable sources¹⁶ , are exposed to high levels of corruption or other predicate offences to ML;
• d) countries or territories where terrorist organisations are known to be operating or that have been subject to economic financial sanctions, embargoes or measures that are related to terrorism, financing of terrorism or proliferation issued by, for example, the United Nations or the European Union; and
• e) where, according to information from more than one credible and reliable source, serious concerns have been raised about the effectiveness and quality of the jurisdiction’s AML/CFT controls, including information about the quality and effectiveness of regulatory enforcement and oversight. In this case, credible and reliable sources may include mutual evaluation reports by the Financial Action Task Force (FATF) or FATF- style Regional Bodies (FSRBs), the FATF’s list of high -risk and non-cooperative jurisdictions, International Monetary Fund (IMF) assessments and Financial Sector Assessment Programme (FSAP) reports.

¹⁵ (JC 2019 81).

¹⁶ According to EBA Guidelines under Article 17 and 18(4) of Directive (EU) 2015/849, the credibility of allegations can be determined on the basis of the quality and independence of the source of the data and the persistence of reporting of these allegations, among other considerations.

To inform the risk assessment of subjects of assessment which are part of a group, competent authorities, which are the lead supervisor, should cooperate and exchange relevant information with other competent authorities that are responsible for the AML/CFT supervision of parts of the group. For cross-border groups, if there is an AML/CFT college, the lead supervisor should make use of the information exchanged in the college to gather the necessary information for the risk assessment. Necessary information includes, in respect of branches or subsidiaries of subjects of assessment’s , at least information related to:

• a) the ML/TF risk profile of branches or subsidiaries as assessed by relevant competent authorities in those jurisdictions;
• b) the ML/TF risk profile of the sector that has branches or subsidiaries as assessed by the relevant authorities in those jurisdictions,
• c) findings from competent au thorities’ assessment s of the quality of controls in place within branches or subsidiaries of subjects of assessment;
• d) serious breaches or material weaknesses in branches or subsidiaries identified by relevant competent authorities in their jurisdictions;
• e) any supervisory measures and sanctions imposed on branches or subsidiaries by relevant competent authorities in their jurisdictions.

When assessing whether subjects of assessment have implemented group-wide policies and procedures in their branches and subsidiaries effectively, competent authorities, which are the lead supervisor, should refer to the risk assessment in respect of these subjects of assessment described in paragraphs 57 and 58 of these guidelines and, in particular, the assessment of geographical risks to which branches and subsidiaries of subjects of assessment are exposed.

4.3.5 Weighting risk factors

Competent authorities should weight the risk factors for sectors and subjects of assessment identified under Step 1 of the RBS Model, depending on their relative importance. In this regard, there are a number of considerations that competent authorities should take the following into account:

• a) When weighting inherent risk factors, competent authorities should make an informed judgement about the relevance of different factors in relation to a sector, subsector or individual subject of assessment. In respect of individual subjects of assessment, competent authorities should take into account their sectoral or subsectoral risk assessment.
• b) The weight given to individual risk factors can vary between sectors, subsectors or subjects of assessment, but competent authorities should use similar factors for similar sectors, subsectors or subjects of assessment.
• c) Weighting of risks does not lead to a situation where it is impossible for a sector, subsector or subject of assessment to be classified as a significant or very significant risk or where all sectors, subsectors or subjects of assessment fall within the same risk category.
• d) Weighting is not unduly influenced by just one risk factor and that due consideration is given to factors that are identified by Directive (EU) 2015/849 or national legislation as always presenting a significant or high ML/TF risk. When weighting risk factors, competent authorities should ensure that one risk factor does not sway the balance of the overall weighting to a disproportionate and unreasonable assessment.

Where competent authorities use automated IT systems to allocate overall risk scores to subjects of assessment, and in particular in situations where they have not developed these in house but purchased them from an external provider or otherwise relied on external input, they should understand how the system works and how it combines or weighs risk factors to achieve an overall risk score. Competent authorities should always be satisfied that the scores allocated reflect their understanding of ML/TF risk associated with the subject of assessment.

4.3.6 Risk profiles and categories

The assessment of the inherent risk level and the effect on the inherent risk level by risk mitigants should result in the assignment of a risk score, where relevant, to the sector, subsector and subject of assessment to facilitate comparison between subjects of assessment and to inform the action they take in Step 3.

Competent authorities should ensure that the assessment of mitigants within the subject of assessment, sector or subsector is based on reliable information, such as the information set out in point b) of paragraph 45 above. In the absence of such information, competent authorities should consider whether the inclusion of mitigating factors is justified, and whether, as a result of the allocation of scores to mitigating factors, the final ML/TF risk score of the subject of assessment is not distorted.

Where competent authorities have only limited or unverified information available to them about mitigants within the subject of assessment or sector and subsector, they should categorise these subjects of assessment, sectors and subsectors on the basis of their inherent risk profile and assign the residual risk score when relevant information becomes available.

Competent authorities should use their professional judgement to validate the results of the overall risk assessment of the subject of assessment or sector/subsector and correct it if necessary.

Competent authorities should decide on the most appropriate way to categorise the risk profiles of subjects of assessment, sectors and subsectors. To achieve convergence and facilitate cooperation and information exchange between different competent authorities, competent authorities should consider classifying subjects of assessment, sectors and subsectors as ‘very significant’, ‘significant’, ‘moderately significant’ and ‘less significant’ in line with the EBA’s ML/TF risk assessment processes.

Competent authorities should ensure that their risk assessment processes enable them to distinguish between inherent and residual risks. When categorising the inherent risk associated with subjects of assessment, sectors or subsectors, competent authorities should consider the following risk categories:

• a) less significant risk, where the subject of assessment, sector or subsector is very unlikely to be abused extensively for ML/TF purposes;
• b) moderately significant risk, where the subject of assessment, sector or subsector is unlikely to be abused extensively for ML/TF purposes;
• c) significant risk, where the subject of assessment, sector or subsector is likely to be abused extensively for ML/TF purposes; or
• d) very significant risk, where the subject of assessment, sector or subsector is very likely to be abused extensively for ML/TF purposes.

When categorising the residual risk associated with subjects of assessment, sectors or subsectors, competent authorities should consider the impact that mitigating measures may have on the inherent risk associated with subjects of assessment, sectors and subsectors. The four risk categories should be applied by competent authorities to categorise residual risk as follows:

• a) less significant risk, where the inherent risk is less significant and the risk profile remains unaffected by mitigation, or where the inherent risk is moderately significant or significant, but is effectively mitigated through AML/CFT systems and controls;
• b) moderately significant risk, where the inherent risk is moderately significant and the risk profile remains unaffected by mitigation, or where the inherent risk is significant or very significant, but is effectively mitigated through AML/CFT systems and controls;
• c) significant risk, where the inherent risk exposure is significant and the risk profile remains unaffected by mitigation, or where the inherent risk is very significant but is effectively mitigated through AML/CFT systems and controls; or
• d) very significant risk, where the inherent risk is very significant and, regardless of the mitigation, the risk profile remains unaffected by mitigation, or where the inherent risk is very significant and is not effectively mitigated due to systemic AML/CFT systems and control weaknesses in the subject of assessment or in the majority of subjects of assessment in the sector.

Where competent authorities decide not to apply the risk classification set out in paragraphs 69, 70 and 71 above, they should be able to convert their risk categories in line with those recommended in these guidelines. Competent authorities should adopt a conservative approach when converting the risk categories as described in the annex to these guidelines.

Competent authorities should note that the categorisation of subjects of assessment for ML/TF risk purposes may be different from categories applied to the same subjects of assessment for wider conduct risk or prudential risk purposes.

Where a competent authority uses an automated IT system to determine the risk profile or score of an individual subject of assessment, competent authorities should make allowances for situations where they may need to amend the results of the automated scoring on the basis of their professional judgment in addition to the review process set out in Step 4 of the RBS Model. Competent authorities may decide to apply their professional judgment if there is information that suggests that the overall risk rating is not a true reflection of reality, including information from financial intelligence units, media reports, other supervisors or on-site and off-site supervision. The rationale for such changes to the risk profile or score should be clearly documented by the competent authority.