How to use

Follow these steps

1. 1

   List your risk categories

   Client type (individual / company / trust / overseas), geography (UK / EEA / high-risk jurisdiction), service provided (incorporation / accounts / TCSP), and delivery channel (face-to-face / remote).

2. 2

   Score each category

   Use a 3-point scale (low / medium / high) to score the inherent risk in each category. Document the rationale in 1-2 sentences per category — that''s what your supervisor wants to see.

3. 3

   Apply controls

   For each high-risk category, document the controls you apply (enhanced due diligence, MLRO review, source of funds checks). For low-risk, simplified due diligence may be appropriate.

4. 4

   Document the residual risk

   Inherent risk minus controls = residual risk. The residual risk drives ongoing monitoring frequency.

5. 5

   Review at least annually

   Risk assessment is not a once-and-done exercise — review at least annually, and trigger an out-of-cycle review when something material changes (regulatory update, sanctions list change, supervisor visit feedback).