Section 1: ML/TF Risk Assessment

The financial institution shall classify all its customers according to the risk assessment results and take the necessary preventive measures to mitigate ML/TF risks. The financial institution can classify the level and degree of risks as (high, medium, or low) or using other categories as it determines based on the risk assessment results. This classification shall be consistent with the size and nature of the financial institution's business. 1.5 The financial institution shall review and update the customer risk profile regularly and based on the level of ML/TF risks. 1.6 The risk assessment shall be broad-based and at a level of sophistication commensurate with the business complexity of financial institutions with a complex organizational structure. For a financial institution with a less complex organizational structure, a simpler approach to conduct the risk assessment may be appropriate. 1.7 The financial institution shall assess risks before launching new products, services or business practices and before using new technologies or technologies under development, and it shall take appropriate measures to manage and reduce the identified risks as stated in Paragraph (1.3) under the ML/TF Risk Assessment Section. 1.8 The financial institution shall set up an appropriate mechanism for providing and submitting the information and reports on which the ML/TF risk assessment is based to SAMA upon request. 1.9 In the event that a customer is classified as high-risk, the financial institution shall obtain the senior management’s approval on the classification, provided that the information on which such classification is based is acceptable and reasoned. 1.10 Periodic reports shall be submitted to the board of directors regarding risk assessment at the level of the financial institution. The reports shall include the following: a) Results of the ML/TF monitoring activities carried out by the financial institution. b) The level of exposure to ML/TF risks based on major activities or customer categories. c) General indicators and patterns of suspicious transactions as well as general trends and indicators of requests received from the SAFIU and the competent authorities. d) Details of significant incidents, occurring internally or externally, and how they are handled in addition to their impact or potential effect on the financial institution. e) Domestic and international developments in the AML/CTF laws, regulations, instructions and requirements as well as their impact on the financial institution. f) The level of effectiveness of preventive measures in mitigating the effects of risks.