Section 1: ML/TF Risk Assessment

The financial institution shall take the appropriate steps to identify, assess, understand, and document in writing its ML/TF risks, provided that the nature and scope of the risk assessment are commensurate with the nature and size of the financial institution's business. Such risk assessment shall be updated regularly (once every two years at a minimum) and shall be documented and approved by the senior management. When carrying out the risk assessment process, the financial institution can focus on the following factors: a) Risk factors associated with the financial institution’s business, with an emphasis on: - Products and services. - Transactions. - Channels used for delivering services and products. - Countries or geographical areas within Saudi Arabia where the business of the financial institution or its subsidiaries, in which the financial institution owns the majority of shares, is conducted. b) Risk factors associated with customers, beneficial owners, or the financial institution’s beneficiary, with an emphasis on: - Products or services used by customers, beneficial owners, or beneficiaries. - The type of transactions executed by a customer. - The volume of deposits and transactions made by a customer. - Countries/geographical areas in which customers, beneficial owners, or beneficiaries conduct their businesses, or the source or destination of transactions. - Characteristics of a customer, beneficial owner, or beneficiary (e.g. Profession, age and type of legal entity). c) Other risk factors, including: - ML/TF risks as issued by the Anti-Money Laundering Permanent Committee (AMLPC) and the Permanent Committee for Countering Terrorism (PCCT). - Results of the risk assessment issued by SAMA, competent authorities and other supervisory authorities, when available. - Purpose of the account or business relationship. - The frequency of transactions or duration of the business relationship. - Attractiveness of products and services provided to money launderers including, but not limited to, private banking services and products offered to high net-wealth individuals as well as quick transfers to high-risk geographical areas. - Regulatory risks associated with regulations and decisions issued by government entities. - Business risks associated with the organizational and operational structure of the financial institution. - ML/TF risks that may arise from the development of new products, business practices, or means of providing services, products or transactions, or those arising from the use of new technologies or technologies under development with new or existing products. - Any additional risks arising from other countries with which customers are associated, including intermediaries and service providers. - Any other variables that may increase or reduce the risk of ML/TF in a particular situation. - Results of ML/TF risk assessments issued by international bodies and organizations such as the FATF, the Basel Committee, the World Bank, the International Monetary Fund, the United Nations, and Transparency International. 1.2 Before developing and implementing controls, policies and procedures to mitigate ML/TF risks, the financial institution shall determine its risk appetite with respect to the results of ML/TF risk assessment, taking into account regulatory, reputational, legal, financial, and operational risks. 1.3 The financial institution shall develop and implement controls, policies and procedures to mitigate ML/TF risks based on the risk assessment results referred to in Paragraph (1.1) . The financial institution shall ensure that such procedures are effective, appropriate and sufficient to mitigate the risks associated with the assessment results. Furthermore, the financial institution shall take into account that its activities will be exposed to risks regardless of the appropriateness and sufficiency of the measures taken. Therefore, it shall strengthen and update these measures whenever the need arises.