An AML risk assessment is a formal, documented evaluation of the money laundering and terrorist financing risks that a regulated entity faces across its business — including the risks presented by its customer base, products and services, delivery channels, and geographic exposure.

Regulators require entities to conduct a business-wide risk assessment before designing their AML controls, and to update it whenever material changes occur. The risk assessment is the foundation of a risk-based compliance programme: without it, there is no principled basis for the controls applied.