Why is creating a financial crime risk assessment so painful?

I often hear that a financial crime risk assessment is a very theoretical exercise that is just needed to satisfy regulators. That thinking often means that a company's risk assessment actually becomes that: an exercise.

‍

But, I will claim that creating a good financial crime risk assessment will not only give you a better insight into your business and processes, but it will also make it much easier for you to know how to make your Know Your Customer (KYC) process more efficient and targeted. 

‍

I have helped several companies create their first financial crime risk assessment, and it has always been a rewarding process. They have given me a swift and good understanding of the risks and processes in companies and industries that I did not know much about prior to working with them.

‍

1️⃣ Don’t think that a first risk assessment should be a big project. 

You can do a lot within a short time. 

2️⃣ Don’t make it a compliance task. 

You should involve many more relevant employees and teammates - including senior members. They have a lot of valuable information; you just need to facilitate a brainstorming session to get it out of their heads. 

3️⃣ Don’t make it complex.

Start by organizing your information and data into the FATF risk categories. You can always adjust if it makes sense.

4️⃣ Don’t try to get new data.

You already have a lot of valuable data you can use (e.g., from accounting, sales, etc.). So, start with existing data. 

5️⃣ Don’t make it too difficult.

Use internal experts or maybe hire an external (like me). You could ask for help with facilitation, writing or analyzing data.

‍

You should see the process of a risk assessment as an ongoing, continuous process. Next time you update it, you will know even more and probably also have better data you can use in the risk assessment. It will be better and better over time, and that is how it should be. 

‍

When you have created your first risk assessment, it will be much easier to design your KYC process, risk scoring model and ongoing monitoring. I will claim that this will be the starting point for better risk mitigation, stronger processes and more efficient controls - including your KYC process.