13–18: Risk management and ML/TF risk assessment
Paragraph-level professional implementation page for KYC and Customer Due Diligence.
Finin2min Summary — in 2 Minutes
13–18 — Risk management and ML/TF risk assessment. Risk category must be reasoned, reviewable and linked to monitoring intensity.
Official source and legal ownership
Paragraph-wise Finin2min interpretation
Legal trigger
Risk category must be reasoned, reviewable and linked to monitoring intensity.
Control owner
Business identifies the event; Compliance confirms law; Operations/Technology executes; Independent review tests evidence.
Evidence
Official source snapshot, policy/SOP, system rule, customer/transaction record, maker-checker log, exception approval and regulatory acknowledgement.
Failure consequence
Customer harm, reporting defect, prudential misstatement, supervisory observation, monetary penalty, restriction or remediation.
Practical example
Implementation and evidence controls
- Freeze the applicable entity class, product, transaction date and official instrument version.
- Map every control to its legal owner, enabling provision, responsible function, evidence and escalation route.
- Retain Board/committee approval, policy version, system configuration, maker-checker evidence, exception approval and regulatory filing acknowledgement.
- Re-test the control after an amendment, product change, outsourcing change, merger, customer-risk reclassification or supervisory observation.
Practical Q&A
What is the first test for Risk management and ML/TF risk assessment?
Confirm entity, product, event date, official paragraph and any stated exception.
Can a portal or system acceptance cure a legal defect?
No. Technical processing does not override the substantive Direction.
What should be retained for review?
The official source version, legal mapping, calculation or decision record, approvals, communications and filing evidence.