Money laundering: business size and model drive the risk assessment

Under the Anti-Money Laundering Act, all obliged entities must conduct a general money laundering risk assessment. What it covers depends on the nature, size and complexity of the business. A large organisation with multiple business lines needs a broader analysis than a smaller company with a simpler structure and fewer services.

There is no one-size-fits-all in this context. A money laundering risk assessment that does not reflect the company’s actual operations is ineffective and may have consequences during supervision. Risks must be assessed against how the business model operates in practice and the firm’s AML risk appetite as implemented through an AML risk based approach.

Money laundering risk profile: small vs large firms

Smaller firms typically have fewer customers and simpler business models, which often makes anti-money laundering and counter-terrorist financing work less complex. That does not remove the obligation to perform a money laundering risk assessment. On the contrary, every firm is expected to complete one, with size and structure influencing both the risks and how they should be managed to remain audit-ready.

Money laundering risk assessment: examples of differing profiles

• Small firms: Often low volume, but high risk if control functions are missing.
• Large firms: Greater transaction volume and more services increase complexity.
• Firms with many branches: Risk of fragmented control and unclear roles.
• Firms with a digital business model: Need for specific, often automated, customer due diligence measures.
• Internationally active firms: Greater exposure to high-risk jurisdictions.

Whatever the size, each firm must demonstrate that its money laundering risk assessment is tailored to its own operations. This is not about completing a template; it is about understanding your AML risk profile and showing how you manage it in practice.

At Morling Consulting, our AML lawyers help companies develop risk assessments that reflect the business and the risks to which it is exposed. We also support the translation of the assessment into effective internal procedures.