Welcome to National & Sectoral Risk Assessments and the Risk-Based Approach
Welcome to this core study module for Domain B: Global AFC Frameworks, Governance, and Regulations! If you have ever wondered how governments decide which financial crime threats are most dangerous, or how financial institutions know where to deploy their compliance staff and monitoring systems, this chapter holds the answers.
In this chapter, we will explore:
• What a National Risk Assessment (NRA) is and why jurisdictions conduct them.
• What a Sectoral Risk Assessment (SRA) covers and how it zooms in on specific industries.
• The foundation of modern anti-financial crime (AFC): the Risk-Based Approach (RBA).
• How national and sectoral findings directly affect an organization's internal controls and compliance priorities.
Note on section context: This chapter focuses specifically on national and sectoral assessments and their influence on the risk-based approach. Related topics—such as the specific roles of regulators, FIUs, and international bodies—are covered in dedicated sister chapters within this domain.
---Understanding the Risk-Based Approach (RBA)
What is the Risk-Based Approach?
At its heart, the Risk-Based Approach (RBA) is the principle that an organization or government should allocate its resources, efforts, and mitigation measures in direct proportion to the level of risk identified. In short: controls must be commensurate with risk.
Before the widespread adoption of the RBA, compliance programs often operated under a rigid, "tick-the-box" or rules-based model. Every customer, regardless of background, underwent the exact same onboarding checks and monitoring. Today, global standards recognize that resources are finite and financial crime threats are unevenly distributed.
The Everyday Analogy: Think of emergency room triage. When a patient arrives at the hospital with a minor scrape, they receive basic treatment and may wait a little longer. When someone arrives with acute chest pain, they are immediately rushed into intensive care with specialized doctors. The RBA works the exact same way in anti-financial crime: high-risk situations receive intensive scrutiny, while lower-risk situations are managed with standard or simplified procedures.
Core Principles of the RBA
1. Identify and Assess: Understand the specific financial crime threats, vulnerabilities, and consequences that exist within a jurisdiction, sector, or institution.
2. Mitigate and Control: Apply higher levels of customer due diligence, enhanced monitoring, and stricter controls where risks are high; apply standard or simplified controls where risks are low.
3. Review and Adapt: Continually update risk models as criminal typologies, technologies, and regulatory findings evolve.
Key Takeaway: The RBA does not mean eliminating all risk (zero tolerance). Instead, it means recognizing where the highest risks lie and dedicating the strongest controls and resources to those specific areas.
---National Risk Assessments (NRAs)
What is an NRA?
A National Risk Assessment (NRA) is an exhaustive, government-led exercise in which a country analyzes its entire financial, commercial, and legal landscape to determine its primary financial crime risks. The goal is to provide a comprehensive, systemic view of how illicit funds enter, move through, and leave the jurisdiction.
Key Components of an NRA
When a jurisdiction builds an NRA, it typically evaluates three primary components:
• Threats: External or internal criminal activity generating illicit funds. This includes predicate crimes such as drug trafficking, fraud, tax evasion, organized crime, corruption, or terrorism.
• Vulnerabilities: Weaknesses within the country's legal systems, regulatory oversight, borders, financial infrastructure, or corporate registry transparency that criminals can exploit.
• Consequences: The broader economic, social, financial, and reputational impact that money laundering, terrorist financing, and other financial crimes inflict upon the country.
Who Uses the NRA?
• Public Sector Authorities: Regulators, law enforcement agencies, and Financial Intelligence Units (FIUs) use the NRA to direct investigative resources, enact new legislation, and adjust supervisory priorities.
• Private Sector Institutions: Banks, money services businesses (MSBs), payment service providers (PSPs), and designated non-financial businesses and professions (gatekeepers) use the NRA as a primary external input for their own risk models.
Memory Aid — "T-V-C": To remember how an NRA assesses risk, think of the acronym TVC: Threats (the criminals and their acts), Vulnerabilities (the open doors or system weaknesses), and Consequences (the real-world damage).
---Sectoral Risk Assessments (SRAs)
Focusing the Lens: The Purpose of an SRA
While an NRA looks at the entire country from a high altitude, a Sectoral Risk Assessment (SRA) focuses the microscope on a specific industry or segment of the economy. An SRA examines how financial crime risks manifest within that particular operating environment.
Sectors Commonly Subject to SRAs
Authorities and industry bodies frequently evaluate risks across diverse sectors, including:
• Banking Segments: Retail banking, private banking, commercial banking, and correspondent banking.
• Payment and Money Transmission: Money services businesses (MSBs), payment service providers (PSPs), and e-commerce platforms.
• Emerging Tech & Digital Assets: Virtual asset service providers (VASPs) and cryptoasset platforms.
• Gatekeepers & Professional Services: Lawyers, notaries, accountants, and trusts and company service providers (TCSPs).
• Other High-Risk Sectors: Real estate, gaming and gambling, and high-value dealers.
Why Sectoral Differences Matter
Different sectors experience vastly different operational risks:
• An MSB deals with rapid, high-volume, cross-border cash remittances where sender identity and relationship duration may be fleeting.
• A trust and company service provider (TCSP) deals with legal entities, shell companies, and complex ownership arrangements that can obscure beneficial owners.
• A real estate brokerage deals with large, infrequent, high-value transactions that can absorb large amounts of illicit capital in a single deal.
Because these operating profiles differ, an SRA provides sector-specific typologies and indicators that general guidance cannot capture.
Key Takeaway: NRAs provide the nationwide risk baseline, while SRAs provide the industry-specific details needed to understand unique vulnerabilities and business models.
---The Impact of NRAs and SRAs on an Organization's Risk-Based Approach
Connecting Macro-Level Findings to Internal Programs
Don't worry if this seems complex at first—the relationship between external assessments and an institution's internal compliance program follows a clear, logical cascade:
Step 1: Public Assessments Published
The national government or sector regulator publishes an NRA or SRA identifying high-risk areas (e.g., increased cross-border trade-based money laundering, high vulnerability in real estate, or exploitation of specific legal structures).
Step 2: Enterprise Risk Assessment (ERA) Update
The organization reviews the published NRA/SRA and compares those findings against its own products, services, customers, geographic presence, and delivery channels. If the NRA identifies a product type as high risk, the organization must recognize that threat in its internal risk assessments.
Step 3: Updating the Risk Appetite Statement (RAS)
Executive management and governing committees evaluate whether the institution is willing to accept customers or activities in those high-risk sectors, and to what extent.
Step 4: Calibration of Controls
The organization adjusts its internal policies, procedures, and systems:
• Where risks are elevated: The organization institutes Enhanced Due Diligence (EDD), requires senior management approval, lowers transaction monitoring alert thresholds, or conducts more frequent periodic reviews.
• Where risks are demonstrably low: The organization may apply standard or simplified measures, ensuring resources are preserved for high-risk targets.
What Regulators Expect
During a regulatory exam, supervisors will expect compliance officers to know the findings of the jurisdiction's latest NRA and relevant SRAs. If an organization claims it has an effective risk-based approach but has completely ignored its national or sectoral risk reports, its compliance program will likely be judged deficient.
---Common Pitfalls to Avoid
• Mistake 1: Treating the NRA as an Internal Risk Assessment
Correction: An NRA is an external, national-level document produced by public authorities. An Enterprise Risk Assessment (ERA) is your institution's internal assessment of its own unique risks. The NRA informs the ERA, but it does not replace it.
• Mistake 2: Assuming Low Risk Means "No Checks"
Correction: Under a risk-based approach, lower risk may justify simplified or standard customer due diligence, but it never means completely ignoring customer identification, sanction screening, or reporting requirements.
• Mistake 3: Static Compliance (Setting and Forgetting)
Correction: An effective RBA is dynamic. When a new NRA or SRA highlights an emerging financial crime trend (such as a shift toward a new payment platform or a new typology for laundering funds), internal monitoring scenarios and policies must be updated promptly.
Chapter Summary & Quick Review
Core Concepts at a Glance
• Risk-Based Approach (RBA): The overarching standard that compliance resources and controls must be commensurate with the level of financial crime risk identified.
• National Risk Assessment (NRA): A macro-level assessment conducted by governments to identify nationwide financial crime threats, system vulnerabilities, and socio-economic consequences.
• Sectoral Risk Assessment (SRA): A targeted assessment focusing on risks, typologies, and vulnerabilities specific to a single industry or sector (e.g., banking, MSBs, TCSPs, gaming, VASPs).
• Flow-Through Effect: NRAs and SRAs serve as vital external inputs that shape an institution's Enterprise Risk Assessment, Risk Appetite Statement, customer due diligence tiers (standard vs. enhanced), and transaction monitoring systems.