AML Risk Assessment: Step-by-Step UK Compliance Guide 2025

An AML risk assessment helps you identify where money laundering could realistically happen in your business. It shows you which clients, services and transactions present the highest threats to your firm. You then use this information to build proportionate controls that protect your business while meeting all UK regulatory requirements.

This guide walks you through the complete process step by step. You'll learn how to scope your assessment correctly, identify and rate risks systematically, and build effective controls that actually work in practice. We've included practical steps suited for UK firms of any size, plus links to ready-made templates that speed up the entire process.

Why AML risk assessments matter in the UK

Regulation 18 of the Money Laundering Regulations 2017 requires you to carry out a written risk assessment of your business. This isn't optional guidance. Your supervisor (HMRC, SRA, FCA, or sector-specific body) will expect to see documented evidence that you've identified and assessed your money laundering risks. Failing to produce this document during an audit or inspection can result in enforcement action, fines, or even removal from your industry register.

Every UK firm covered by the regulations must maintain a current, written aml risk assessment that reflects the actual risks they face in their business.

Beyond compliance, your risk assessment serves a practical purpose. It helps you allocate resources efficiently by focusing attention on the areas where criminals are most likely to target your business. You avoid wasting time on low-risk scenarios while strengthening defenses around high-risk clients, services and transactions. The assessment also guides your customer due diligence approach, telling you when to apply standard measures and when enhanced checks become necessary.

Your assessment needs regular updates too. Market changes, new services, different client types, or emerging threats all require you to review and refresh your documented risks. Regulators increasingly check whether firms treat risk assessment as a living document rather than a one-time box-ticking exercise.

Step 1. Define scope, responsibilities and methodology

Your assessment begins with clear boundaries and structure. Start by deciding which parts of your business fall under the Money Laundering Regulations and what activities you need to assess. This includes all regulated services you offer, every client type you work with, and all jurisdictions where you operate or have clients. Write down exactly what's included and what sits outside your scope so everyone understands the assessment's coverage.

Determine what your assessment must cover

You need to identify every regulated activity your firm conducts under the MLR 2017. List all services that involve client money, property transactions, company formation, or other activities covered by the regulations. Include any third-party relationships where you rely on agents, introducers, or outsourced providers. Geographic scope matters too because different countries present different risks. Document whether you serve UK-only clients or work internationally, and specify which jurisdictions feature in your business.

Assign clear ownership and approval routes

Designate a specific person responsible for creating and maintaining your aml risk assessment. This individual needs sufficient authority and knowledge to gather information across your firm. You'll also need senior management approval once the assessment is complete. The regulations require board-level or equivalent sign-off, so identify who will review and formally approve your documented risks. Set a clear timetable for reviews (typically annual minimum, or sooner if circumstances change).

Choose your rating methodology

Pick a consistent scoring system that works across your entire assessment. Most UK firms use a simple three-tier approach (low, medium, high) or a numerical scale (1 to 5). Your methodology should rate both inherent risk (before controls) and residual risk (after controls). Document your scoring criteria so anyone reviewing your assessment understands what each rating means. Keep it simple and practical rather than overly complex.

Step 2. Identify, rate and document your risks

This step forms the heart of your aml risk assessment. You need to systematically work through every risk factor that applies to your business, assign meaningful ratings, and record everything in a clear written format. The process involves examining your clients, services, delivery channels, and geographic exposure to identify where money laundering vulnerabilities exist in your operations.

Break down risk categories systematically

Start by examining customer risk factors. Look at who your clients are and what behaviors might indicate higher risk. Consider whether you deal with politically exposed persons (PEPs), clients from high-risk jurisdictions, or businesses with complex ownership structures. New customers conducting large one-off transactions typically present elevated risk levels compared to longstanding local clients with transparent backgrounds.

Next, assess product and service risks. Certain activities attract money launderers more than others. Property transactions, trust formation, and client account services all feature on the National Risk Assessment as higher-risk areas. Services involving large cash payments, cross-border transfers, or asset purchases without face-to-face meetings require particular attention.

Geographic risk comes third. Identify which countries and regions feature in your business, either through client locations or transaction destinations. Countries on the high-risk third countries list automatically warrant enhanced scrutiny, as do jurisdictions with weak AML frameworks or high corruption levels.

Score each risk factor accurately

Apply your chosen rating system consistently across all identified risks. For each factor, record both inherent risk (the threat level before any controls) and residual risk (what remains after your controls operate). A simple three-tier system works well: low means minimal money laundering threat, medium indicates some potential for abuse, and high signals substantial vulnerability.

Create a written record

Compile everything into a single documented assessment. Use a table format showing each risk factor, its inherent rating, applicable controls, and residual rating. Include the date, your name, and approver details. Save this document where your team can access it, and mark it for annual review at minimum.

Step 3. Build controls, actions and review cycles

Once you've identified and rated your risks, you need to implement practical controls that reduce those threats to acceptable levels. This step transforms your aml risk assessment from a theoretical document into actionable protection for your business. You'll design specific measures for each risk category, assign responsibility for implementation, and set up regular reviews that keep your assessment current.

Design proportionate controls for each risk level

Match your control intensity to the risk rating you assigned. High-risk areas require enhanced due diligence, senior management approval, and additional monitoring. Medium risks typically need standard customer due diligence with some extra checks on transactions or beneficial ownership. Low-risk situations allow simplified measures while still meeting basic regulatory requirements.

Your controls should address specific vulnerabilities you identified. If you rated PEP clients as high risk, implement enhanced screening tools and approval work-flows. When property transactions present elevated risk, require source of funds evidence and conduct ongoing monitoring of transaction patterns.

Set up action plans and review schedules

Create a written action plan for any gaps or weaknesses your assessment revealed. List each item, assign an owner, set a deadline, and track completion. If you lack proper PEP screening tools, record that as an action with a target implementation date.

Schedule annual reviews at minimum, with triggers for earlier updates when circumstances change. New services, different client types, regulatory updates, or changes to the National Risk Assessment all require you to revisit your documented risks and controls immediately.

Useful resources and example templates

You can access free templates from UK regulatory bodies to speed up your aml risk assessment process. The SRA provides a downloadable client and matter risk template that covers common risk factors for legal practices. HMRC publishes comprehensive sector-specific guidance documents that include risk assessment frameworks for money service businesses, high-value dealers, and accountancy firms.

Ready-made assessment frameworks

Several UK supervisors offer structured templates you can adapt directly to your firm's needs. Download the SRA's client risk template from their website, or access HMRC's detailed sector guidance through the GOV.UK platform. These resources include pre-filled risk categories, scoring methodologies, and example controls that match UK regulatory expectations.

Key takeaways

Your aml risk assessment forms the foundation of your entire compliance programme under UK regulations. You've seen how to scope your assessment properly, identify and rate risks systematically, and build proportionate controls that address real vulnerabilities in your business. The three-step framework keeps the process manageable while ensuring you meet all regulatory requirements that HMRC, the SRA, or your sector supervisor expects to see.

Remember that risk assessment isn't a one-time task. Your documented risks need annual reviews at minimum, with immediate updates whenever your business changes. Markets shift, new threats emerge, and regulators publish updated guidance that affects how you classify and manage money laundering risks. Treating your assessment as a living document protects your firm far better than static compliance paperwork.

Building strong AML compliance skills takes more than completing risk assessments. If you're developing your career in financial crime prevention, consider structured training that covers the full spectrum of AML controls, investigations and reporting. Explore AML compliance training that helps you master these essential skills and advance your compliance career.