The scope of the risk analysis is not entirely specified by law – it must be appropriate according to the nature and scope of the company’s business activities.
The risk of becoming a victim of money launderers varies in each industry. The gateways of organized crime can vary. In addition, the size, organizational structure, and complexity of the company also play a role.
For example, an internationally active real estate broker prepares a much more comprehensive risk analysis than a small law firm operating only locally.
A Risk Analysis process
The risk analysis must always be documented in writing. This documentation helps to ensure that it always corresponds to the current legal requirements.
Above all, the current business activities must be reviewed regularly – or at least annually – and updated if necessary.
Updates may be necessary; for example, if laws change, the company acquires new customer bases or expands its business activities to other countries.
Helping the Regulators
This process helps regulators to understand what obligated parties have done to comply with their legal obligations. All these processes must be transparently documented and archived.
Supervisory authorities attach great importance to ensuring that risk management procedures are not just set up once but are regularly reviewed and adapted – also against the background of constantly evolving legal requirements.
The responsible supervisory authority can request and review this documentation and all money laundering prevention measures at any time – regardless of whether a specific suspicion exists.
Outsourcing Risk Management
The scope of a risk analysis can be a major challenge for companies of all sizes, not only in terms of content but also in terms of effort.
The legislation does allow outsourcing to external service providers who can take over the risk management.
Outsourcing in this way can help companies stay legally secure – even when the legal situation changes, the size of the company changes and new risk factors need to be assessed.