Guidance on Assessing Business Risks Related to Money Laundering, Terrorist Financing, and Proliferation Financing

The Financial Institution shall analyze quantitative and qualitative data and information when assessing Inherent Risk factors within the Business Risk Assessment framework. Due consideration shall be given to the following main Risk categories: a. Structural Risks: Risks arising from the Financial Institution's ownership structure, governance framework, the complexity of its operations, and the resulting impact on its susceptibility to Risks. b. Customer Risk: The level of Risk arising from the Financial Institution's customer base, taking into account factors such as customer type, sector/activity, statutory nature, transaction patterns, and exposure to high-Risk persons or entities. c. Product, Service, and Operational Risks: Risks associated with the nature of the offered products and services, as well as the complexity, size, and nature of operations, and the opportunities they may present for illicit financial activities. d. Service Delivery Channel Risks: Risks arising from the methods and channels used to deliver products and services, including the extent of use of digital channels, remote interactions, or the involvement of third parties. e. Geographical Risks: Risks associated with the countries and geographical regions in which the Financial Institution operates, conducts business, or has business relationships, particularly in areas with weak anti-money laundering, combating terrorist financing, and combating proliferation financing policies and measures, or which are exposed to high Risks in relation to financial crime. f. Risks of New and Existing Technologies: Risks associated with the adoption and use of emerging and existing technologies, including modern financial technology models, which may introduce new vulnerabilities or facilitate illicit financial flows. These Risks must be assessed before launching any new or developing products, services, business practices, or technologies. g. Emerging Risks: These include both Emerging Risks and existing Risks that have become more severe. Key measures for managing Emerging Risks may include regularly reviewing internal data to identify trends and threats of emerging financial crime, and continuously monitoring relevant external sources. Ongoing assessments should incorporate Emerging Risks within the offered products and services. h. Operational Risks: Risks of the potential impact of products, services, and customer categories before those products or services are launched. 3.2.2 The Financial Institution shall take into account that the Risks listed in paragraph (3.2.1) may overlap and that the combination of these factors may lead to an increase in the level of Risk when they occur together. 3.2.3 The Financial Institution may assign different weights to Risk factors according to their relative importance, and the relevance of each Risk factor to the context of the business relationship or transaction shall be taken into account. The weight assigned to each factor is likely to vary depending on the product, customer (or customer category), and each Financial Institution. In all cases, the Financial Institution shall choose a methodology, determine a Risk rating scale, and determine the criteria for Risk Assessment and weighting. 3.2.4 When weighting Risks, the Financial Institution shall ensure the following: a. The weighting is not unjustifiably influenced by a single factor. b. Economic or profitability considerations do not influence the Risk classification. c. The weighting does not make it impossible to classify any business relationship as high Risk. d. Classify cases identified under anti-money laundering, combating terrorist financing, and combating proliferation financing instructions as always high Risk. e. Governance of the rationale for any decision to override a Risk rating generated automatically by automated systems, if such a decision is necessary, and that decisions and their rationale are documented.