AML law looks at risk on two levels that are often confused. Rating an individual relationship answers how risky this client is. The institution-wide risk assessment answers which risks the whole business faces and how it organises itself against them. The second is the precondition for the first: without it, the client rating criteria lack a rationale.
What belongs in it
FINMA’s Anti-Money Laundering Ordinance requires supervised institutions to prepare a risk analysis that considers at least the clients’ seat or domicile, the client segment and the products and services offered. SRO regulations contain comparable requirements. In practice it also covers distribution channels such as non-face-to-face clients, the origin of assets, proximity to cash and the role of intermediaries.
From analysis to controls
A risk assessment is only as good as its consequences. It drives the criteria for higher risk, the frequency of periodic reviews, the thresholds of transaction monitoring and the scope of training. Anyone entering a new client segment or offering a new product must update the assessment beforehand, not at the next audit.
Common weaknesses
Auditors keep finding the same issues: a template that does not fit the business; an assessment not updated for years; risk criteria stated in the assessment but not asked at onboarding; and no figures on the actual client base, such as how many clients come from which countries. A credible assessment starts with one’s own book, not a generic list of risks.
Ownership and cadence
The assessment is approved by the highest governing body and updated periodically. Together with the risk-based approach it is the document from which an audit can tell whether the institution understands its risks. For advisers newly covered since 1 October 2026 it is among the first documents an SRO will ask for.