Skip to content
New source-controlled implementation repository

Use the Phases 3-4 professional repository for authority, trigger, workflow, evidence, consequence and current-source controls.

Home › Knowledge Hubs › PMLA, AML & KYC Hub › Enterprise AML risk assessment and audit

Enterprise AML risk assessment and audit

A mature programme links enterprise risk assessment, policy, controls, data, training, testing and remediation. It should reflect customers, products, geog

Finin2min summary

A mature programme links enterprise risk assessment, policy, controls, data, training, testing and remediation. It should reflect customers, products, geography, channels and typologies.

Source review date: 4 July 2026. Read with the official text and the facts of the transaction.

Legal anchors

  • PML Rules
  • FIU and regulator sector guidelines

How to analyse it

  1. Score inherent risk.
  2. Evaluate control design and effectiveness.
  3. Set residual-risk appetite.
  4. Track issues to verified closure.

Practical illustration

A fintech launches cross-border merchant payouts without revising its AML risk assessment. Product approval should include typology, data and reporting controls.

What can go wrong?

  • Risk assessment as generic narrative
  • No product change trigger
  • Audit checks documents but not data

Evidence pack

  • Enterprise risk assessment
  • Control library
  • Audit report
  • Remediation tracker

Decision workflow

  1. Freeze the facts and effective date.
  2. Identify the controlling Act, rule, notification, circular and jurisdictional overlay.
  3. Prepare a calculation or exposure note.
  4. Collect the evidence pack before filing, payment, signing or response.
  5. Record reviewer conclusion and assumptions.

Quick Q&A

Is the result automatic?

No. Score inherent risk.

What is the most important control?

Track issues to verified closure.

What should be escalated?

Risk assessment as generic narrative, especially where money, deadlines, enforcement, personal liability or irreversible transaction steps are involved.

Official source trail

Secondary commentary may help interpretation, but it is not the source of law.

Related repository pages