National risk assessment
NRAAlso called national money laundering risk assessment, country risk assessment
A national risk assessment is a government's review of the money laundering, terrorist financing and proliferation financing threats facing its country, and of the sectors and products most exposed. FATF standards require every country to carry one out. Firms must take its findings into account in their own risk assessments.
How it works
Governments bring together finance ministries, law enforcement, financial intelligence units and supervisors to assess threats such as fraud, drugs, corruption and tax crime, and vulnerabilities in sectors including banking, money service businesses, property, legal services and cryptoassets. Each sector receives a risk rating. The results shape national policy, supervisory priorities and resources, and FATF examines them during mutual evaluations.
For regulated firms, the national risk assessment is a required input to the enterprise-wide risk assessment. Compliance teams map its high-risk sectors, products and typologies against their own customers and services, adjust customer risk rating and monitoring scenarios and record how they considered it. Supervisors expect firms to update their assessments when a new national risk assessment is published.
The rules
Requires countries to identify, assess and understand their money laundering and terrorist financing risks and to apply measures in line with those risks.
All countries, through national lawRequires each Member State to carry out a national risk assessment, review it at least every four years, publish a summary and share results with the Commission, AMLA and other Member States.
EU Member StatesThe UK's fourth national risk assessment, following 2015, 2017 and 2020; firms must take it into account under the Money Laundering Regulations 2017.
UK regulated firms and supervisorsTreasury's fifth money laundering risk assessment, published with companion terrorist financing and proliferation financing assessments.
US financial institutions and authoritiesCommon questions
Do firms have to use the national risk assessment?
Yes, in most regimes. UK and EU rules require firms to take the national risk assessment into account in their own risk assessments, and supervisors check that they have.
How often is a national risk assessment updated?
It varies by country. EU rules require a review at least every four years. The UK has published in 2015, 2017, 2020 and 2025, and the US in 2015, 2018, 2022, 2024 and 2026.
What is the difference between an NRA and an EWRA?
A national risk assessment covers a whole country's risks. An enterprise-wide risk assessment covers one firm's risks, and uses the national findings as one of its inputs.
