How to Build a New Zealand ML/TF Risk Assessment

Part 1

What the Assessment Must Cover

Section 58 lists the areas that must be considered. The depth of the work should match the nature, size and complexity of the business.

1. Step 1

   Nature, size and complexity

   Consider branches, staff, systems, growth, transaction volume and how easy it would be for strange activity to be missed.

2. Step 2

   Products and services

   Look at how money or assets can be raised, held, changed or moved. Check high values, third-party payments and hidden ownership.

3. Step 3

   Delivery methods

   Assess in-person, remote, self-service and third-party delivery. Less staff contact can make identity and behaviour harder to check.

4. Step 4

   Customer types

   Consider ownership, control, public office, source of funds, criminal links, cash use, overseas links and any reason enhanced CDD may apply.

5. Step 5

   Countries and institutions

   Check the countries and other firms used in the service. Consider sanctions, corruption, crime, terrorism financing and weak AML/CFT systems.

6. Step 6

   Official risk information

   Relevant risks in the National Risk Assessment and Sector Risk Assessments must be brought into the business’s own assessment.

Part 2

A Simple Method That Can Be Explained

DIA suggests identify, assess, evaluate and respond. A small business can use a short rating scale if the reasons are clear.

1. Step 1

   Map the business

   List each product or service, customer group, delivery method, country and institution. Add the nature, size and complexity of the business.

2. Step 2

   Describe the misuse

   Write how a criminal or terrorist financier could use each area. Say what could be hidden, moved or made to look lawful.

3. Step 3

   Rate inherent risk

   Assess risk before AML/CFT controls are applied. A scale such as low, medium and high can work if each level is defined.

4. Step 4

   Record the reason

   Use business data, DIA guidance, the National Risk Assessment, the relevant Sector Risk Assessment and known warning signs.

5. Step 5

   Set the response

   Show how the programme will deal with each risk through CDD, customer risk rating, monitoring, approval, reporting or service limits.

6. Step 6

   Name the owner and review trigger

   Record who watches the risk, what change will trigger review and how the document will be kept current.

Part 3

Worked Example

This example shows the level of reasoning that should be visible. It is not a template and should not be copied without checking the facts.

Part 4

When the Assessment Must Be Reviewed

The document must state how it will be kept current. Review should be linked to business change, new risk information and the audit cycle.

• A product, service, customer group, country or institution changes.
• A new or developing technology or delivery method is planned.
• DIA or the Financial Intelligence Unit releases relevant risk information.
• The National Risk Assessment or a Sector Risk Assessment changes.
• Monitoring, a SAR decision or a control failure shows a new risk.
• An independent audit finds that the assessment is missing, unclear or out of date.

Part 5

Records and Independent Audit

The current assessment, earlier versions and the records used to build it should be kept. Risk assessment, programme and audit records must be kept for at least five years after they stop being used on a regular basis.

The risk assessment and programme must be independently audited. The default period is every three years. A four-year period can apply if DIA gives notice, and DIA can ask for an audit at another time.

• Keep the method, definitions and rating scale.
• Keep source dates, links and notes on how each source was used.
• Keep data extracts, meeting notes, decisions and approvals.
• Keep each version and a clear record of what changed.
• Give the auditor enough evidence to test how the assessment works in practice.

Part 6

Common Mistakes

• A sector risk assessment is copied and treated as the business’s own assessment.
• The National Risk Assessment or relevant Sector Risk Assessment is not used.
• Controls are used to lower the rating before inherent risk is understood.
• Every service or customer type is given the same rating.
• The rating scale is not defined.
• A rating is stated without facts, sources or reasons.
• The programme does not show how each higher risk is managed.
• New technology is used before the assessment is updated.