Enterprise-wide risk assessment
EWRAAlso called business-wide risk assessment, firm-wide risk assessment
An enterprise-wide risk assessment (EWRA) is a firm's documented analysis of the money laundering, terrorist financing and sanctions risks across its whole business. It rates inherent risk by customer, product, geography and channel, tests the controls in place and sets the residual risk that shapes AML policies and resources.
How it works
The compliance team gathers data on customer types, products, transaction volumes, countries and delivery channels, then scores inherent risk for each. It assesses how well controls such as due diligence, screening and monitoring reduce that risk. The result is a residual risk rating and an action plan. Senior management approves it. Most firms update it at least annually and when the business changes.
The EWRA is the base of the risk-based approach. It drives customer risk rating, monitoring rules and staffing decisions. Supervisors usually request it first in an inspection, and weak or generic assessments are a frequent enforcement finding. Under the EU AML Regulation from July 2027 it must also cover targeted sanctions risk, and AMLA consulted on guidelines on its minimum content in 2026.
The rules
Requires firms to identify and assess money laundering and terrorist financing risks, considering customers, countries, products, transactions and delivery channels, and keep a written record.
UK relevant persons, including banks, accountants, lawyers and estate agentsRequires a business-wide risk assessment covering money laundering, terrorist financing and targeted sanctions risks, prepared by the compliance officer and approved by senior management.
EU obliged entitiesRequires firms to identify, assess and understand their risks and apply proportionate measures; last amended in February 2025.
Countries, financial institutions and DNFBPsCommon questions
How often should an EWRA be updated?
UK rules require the assessment to be kept up to date. Most firms refresh it at least annually and after material changes such as new products, new markets, acquisitions or updates to the national risk assessment.
Who approves the EWRA?
Senior management approves it. Under the EU AML Regulation, the compliance officer prepares the business-wide assessment and the management body approves it. UK firms usually take it to the board or a board risk committee.
What is the difference between inherent and residual risk?
Inherent risk is the exposure before controls, based on customers, products, countries and channels. Residual risk is what remains after controls. The gap shows where controls are weak and where to invest.
Is AMLA issuing guidance on business-wide risk assessments?
Yes. Article 10(4) of the AML Regulation required AMLA to issue guidelines on the minimum content of the assessment. AMLA consulted on draft guidelines from 16 April to 15 July 2026. The regulation applies from 10 July 2027.
