How to use

Follow these steps

1. 1

   List every client

   One row per client. Even dormant or one-off clients in scope of MLR 2017 must be on the register until the relationship formally ends.

2. 2

   Record the inherent risk score

   Score by category — client type, geography, services, delivery channel — and combine into a single inherent risk rating (low / medium / high).

3. 3

   Document the rationale (1-2 sentences)

   Why this score? Supervisors care about the thinking more than the number. ''High inherent — overseas trust structure with UK property holdings, source of funds unclear'' is a usable line.

4. 4

   Record the controls applied

   SDD / standard CDD / EDD. For EDD: what additional steps were taken (source of funds, source of wealth, senior approval)?

5. 5

   Record the residual risk

   Inherent risk minus controls. The residual risk drives ongoing monitoring frequency — high residual = quarterly review, low = at least annually.

6. 6

   Set the next review date

   Calendar the review. Risk assessments that don''t get reviewed become stale within 12 months and supervisors will flag them.