Submission of Business Risk Assessments with Applications

​The regulatory laws provide that a licence or registration application shall contain or be accompanied by such other information or documents as the Commission may reasonably require, for the purpose of determining the application.

Business Risk Assessments (“BRAs”)

The Financial Action Task Force (“FATF”) 2012 Recommendations (“the Recommendations”) place even greater emphasis on the importance of undertaking an effective assessment of financial crime risks.  This is further emphasised in its methodology in which it is stated, “Financial institutions and DNFBPs should be required to take appropriate steps to identify, assess and understand their ML/TF risks…”. 

With regard to a competent authority's responsibilities, the Recommendations note that supervisory controls expected to be undertaken by a competent authority, such as the Commission, should include a review of the assessment of the ML/TF risk profile of a financial institution or group.

All businesses to whom the AML/CFT Regulations apply, must undertake a BRA.  This requires that the business identifies the financial crime risks to which it could be exposed and the measures that will be taken to mitigate those risks.  This also informs the risk appetite of the business.

Under Regulation 3(1) a BRA must be carried out as soon as reasonably practicable after it becomes a financial services business.  This assessment must be completed by the time business starts to be undertaken.  It is also expected that measures will be adopted to mitigate the risks identified in the BRA.

It is therefore expected that a business will have commenced its review of these risks and identified possible measures to mitigate them prior to being licensed by the Commission under the Law.

New – Submission of BRA with Application Materials

With effect from Friday 5 September 2014, a draft business risk assessment, prepared in compliance with Regulation 3 of the AML/CFT Regulations and the rules in Chapter 3 of the Handbook, must be submitted with any application for a licence or registration under the laws.

Please note that this new requirement does not extend to applications submitted with respect to the authorisation or registration of a collective investment scheme or PCC Cell and Incorporated Cell applications.

Applicants will not be required to use a specific form or provide the assessment in a pre-determined format.  Further Guidance on how to prepare a business risk assessment can be found on the Financial Crime Supervision and Policy Division’s webpage at [link removed – see Chapter 3 of the Handbook].

Please send any questions you may have to the AML/CFT team.