AML risk assessment: a practical methodology for regulated professions

In brief

The overall money-laundering risk assessment (Article 16 of the Act of 18 September 2017) is the first document requested by SPF Economie, the NBB or the FSMA during any AML inspection. It must analyse 4 dimensions (client risk, product risk, geographic risk, channel risk), be written in 5 documented steps, signed by management, updated annually and consistent with the KYC and CTIF procedures of the structure. A generic or incomplete document leads directly to a structural deficiency finding.

Why the risk assessment is the document n°1 demanded during inspection

When SPF Economie, the NBB or the FSMA inspects a regulated entity, the first document requested is not the client register or the KYC files: it is the overall money-laundering risk assessment, required by Article 16 of the Act of 18 September 2017.

This document is not an administrative form: it is the motherboard of the entire AML framework. It describes how the profession identifies, measures and mitigates the money-laundering and terrorist-financing risks specific to its activity. Without this document, or with a generic one copied from the internet, the inspection concludes to a structural deficiency — and the fine follows. Its content must be consistent with the obligations of the Act of 18 September 2017 and directly feed the KYC files maintained by each obliged entity.

The 4 dimensions to analyse

Any serious assessment relies on crossing four risk factors, common to the European Banking Authority (EBA) guidelines and the Belgian framework:

1. Client risk

Who are your clients? Categorise them:

• Individuals vs companies

• Belgian vs foreign

• Simple vs complex structures (holdings, trusts, shell companies)

• Politically exposed persons (PEPs)

• Clients whose real economic activity is hard to verify

• Clients onboarded remotely with no face-to-face

A fiduciary serving mostly local SMEs with transparent shareholding has low client risk. A notary's office regularly dealing with foreign companies with non-resident UBOs → high risk.

2. Product (or service) risk

What services do you provide? Some are inherently risky:

• Company incorporation and domiciliation (capacity to create opaque structures)

• Real-estate operations (historic money-laundering channel)

• Third-party fund management (lawyers' trust accounts, notaries' funds)

• International tax advice, structure optimisation

• Cash transactions above thresholds

Other services have structurally low risk: simple bookkeeping for micro-businesses, HR consulting, pure statutory audit.

3. Geographic risk

Do your clients or their counterparties operate in:

• The high-risk third countries identified by the European Commission (published, updated list)

• Preferential tax jurisdictions (former tax havens, OECD lists)

• Areas under international sanctions (Russia, Iran, North Korea, Belarus...)

• Countries with weak AML frameworks (FATF reports)

A client domiciled in Brussels with Belgian-French activity: low geographic risk. A Belgian company whose 80 % of inbound flows come from Dubai or the Seychelles: high risk.

4. Channel risk

How was the relationship established and how does it run?

• Face-to-face on your premises (low risk)

• Introduced by a known peer or correspondent (moderate risk)

• 100 % remote via online platform (heightened risk if no strong identification)

• Through an intermediary (business introducer) — who is this intermediary?

The methodology in 5 steps

Step 1 — Map the activity

Describe your activity factually:

• Which services exactly (exhaustive list, with revenue share)

• How many active clients and their typology (local SMEs / individuals / international companies)

• Which geographic zones (where your clients are, where their counterparties are)

• Which onboarding channels

This mapping is the factual basis of everything that follows. It is updated annually.

Step 2 — Identify inherent risks

For each combination client × product × geography × channel, list the money-laundering risks before any mitigating measure. Examples:

• Incorporation of a company for a non-resident client from an opaque jurisdiction → shell-company risk

• Cash real-estate operation with multiple transfers from different accounts → structuring (smurfing) risk

• Tax mandate for a client receiving crypto-asset revenue → doubtful source of funds

Step 3 — Assess the inherent risk level

Use a 3- or 5-level grid: low / standard / high (or 1-5). Document the criteria placing each combination at each level. Don't put everything at "low": a regulated entity claiming no high-risk zone will be viewed sceptically.

Step 4 — Describe mitigating measures

For each risk level, which controls do you implement?

• Low risk: standard KYC, annual monitoring, normal archiving

• Standard risk: full KYC with UBO and register verification, semi-annual monitoring

• High risk: enhanced KYC, source-of-funds verification, senior management approval before onboarding, quarterly monitoring, expedited CTIF reporting

Be concrete: "enhanced monitoring" is not enough. Specify: "quarterly review of the file by the AMLCO, comparison of flows with the client's VAT returns, written validation".

Step 5 — Compute the residual risk and conclude

After mitigating measures, is the residual risk acceptable? If yes, the framework is consistent. If no, two options: strengthen measures, or refuse the type of activity.

Conclude on the overall risk level of your profession and list the priority focus points for the next 12 months.

Format and frequency

The risk assessment must be:

• Written — no oral analysis, no "it's in the AMLCO's head"

• Dated and signed by management

• Updated at least annually, or immediately after a significant change (new service, new target clientele, new regulation)

• Consistent with the written procedures for KYC, monitoring, CTIF reporting

• Kept for the duration of operations + 10 years

In practice, a 10- to 30-page document, structured by the 4 dimensions above, is sufficient for most mid-sized practices.

Frequent mistakes seen during inspection

Generic non-adapted document — standard sentences disconnected from the firm's real activity

Uniformly low risk level — lack of judgement, hence of operational reality

Vague mitigating measures ("we verify", "we remain alert") — not auditable

No link with the written procedures — the assessment mentions "quarterly monitoring" but no procedure organises it

No annual update — last revision dated 2020, geographic risk has evolved

No written analysis of refused files or issued CTIF reports, which are nevertheless calibration signals

The AMLCO's role

The Anti-Money Laundering Compliance Officer (AMLCO) is the main drafter and guardian of the risk assessment. The appointment is mandatory for all regulated structures, formally named by decision of the board of directors or equivalent body.

For small structures, the AMLCO can be a manager themselves. For larger ones, it is a dedicated role. In all cases: direct access to management, functional independence, documented initial and ongoing training.

How Company Belgium structures your risk assessment

The risk assessment required by Article 16 becomes a controlled deliverable with Company Belgium:

• Automatic mapping of your client base: breakdown by size (BCE), legal form, NACE codes, geography of head offices and establishments

• Profession-specific assessment templates (accountant, notary, lawyer, real-estate agent, company service provider)

• Preconfigured risk matrix over the 4 dimensions client × product × geography × channel

• High-risk country alerts: automatic cross-check with the official lists (EU, Belgian Treasury, international sanctions)

• Review tracking: annual deadline reminders, timestamped versions, full traceability of AMLCO decisions

• Signed PDF export ready to present during inspection

Your AMLCO produces a compliant, defensible document in hours, not weeks.

Bottom line

The risk assessment is the exercise that makes the difference between an entity substantively compliant and one that ticks boxes. It is also the unique document showing the inspector that the profession has understood its exposure and deployed proportionate measures. Be factual, be specific, be up-to-date — and this piece becomes an asset, not a risk.