How to Conduct an Annual AML Risk Assessment for Your Payment Platform

What an Annual AML Risk Assessment Should Cover#

Treat your annual AML review as a decision exercise tied to real money movement, not a policy refresh. If you cannot trace how funds are collected, held, routed, converted, or paid out across contractor, seller, or creator flows, the review can look complete while still miss core risk.

A practical baseline is the FFIEC framing of a BSA/AML risk assessment: a written, complete analysis of money laundering, terrorist financing, and other illicit finance risk. FFIEC also notes this assessment is not a specific legal requirement. Still, a well-developed one helps identify risk and build internal controls, and putting it in writing is a sound practice.

For payment platforms, use that as an evidence standard without assuming bank-identical scope. Borrow the discipline, not the labels. Define risk in writing, tie it to actual products and counterparties, and keep evidence that legal, finance, compliance, and operations can defend.

Shared accountability is usually the hard part. Compliance may own the method, but legal defines the perimeter. Finance sees settlement and reconciliation breaks, and operations sees overrides, failed payouts, and exception handling that show whether controls work in practice. This guide stays anchored in that operator reality: what to review, how to score inherent and residual risk, what to report, and when to escalate.

Use one simple checkpoint before scoring: every risk statement should map to a concrete category and a concrete evidence source. FFIEC describes starting with categories such as products, services, customers, and geographic locations. It also notes there are no required categories, and depth should match size and complexity. For platforms, that usually means each stated risk should map to a live flow and a support artifact, such as transaction or reporting data, the documented risk assessment, or an independent review.

Keep the threat picture current. Treasury's 2026 National Money Laundering Risk Assessment (its fifth iteration) says top U.S. money laundering threats remained consistent, including fraud, drug trafficking, cybercrime, human trafficking, human smuggling, and corruption. It also explicitly includes categories relevant to platforms such as Money Services Businesses and Third-Party Payment Processors. That does not mean every platform has the same exposure. It means your annual review should be calibrated to current threat themes, not last year's template.

Start with scope, taxonomy, and evidence quality before model precision. FFIEC warns that weak risk identification can cascade into internal control deficiencies and weaken the broader program. If those foundations are solid, scoring becomes defensible. If they are weak, scoring can make a fragile assessment look more certain than it is.

What to prepare before you start#

Before you score anything, document governance, scope, and key timing assumptions. A written BSA/AML Risk Assessment is easier to defend when ownership, scope boundaries, and evidence sources are explicit.

Set accountability first#

Define accountable ownership for the review and a decision forum to challenge and approve it. The forum can be lightweight, but it should include the functions that will review results and act on them across business lines, management, and board reporting.

At kickoff, document who approves the assessment and who will execute remediation actions under your Anti-Money Laundering (AML) program. If there is no named approver or decision log, residual-risk decisions and open findings are harder to defend.

Build your operating baseline early#

Pull the prior assessment, open findings, and the AML policy and procedure set in force for the period you are assessing.

Document the key evidence sources you will rely on for each major risk area. Write the assessment clearly and share it across business lines, management, the board, and appropriate staff so review and follow-through stay aligned.

Define scope with counsel before scoring#

Start by identifying your institution-specific risk categories, typically including products, services, customers, and geographic locations, and explicitly note what is out of scope.

There is no required universal category set, so keep categories tailored to your institution and consistent for the full cycle. Improper risk identification can cascade into broader internal-control deficiencies.

Fix the review window and evidence cutoff#

Choose and document a review window and evidence cutoff before you pull data if you want repeatable results. Apply those definitions consistently across the data included in the assessment.

Use one current threat baseline consistently for the cycle, such as the 2026 National Money Laundering Risk Assessment (NMLRA), which Treasury describes as the fifth iteration after more than 10 years of NMLRA publications.

Define scope and risk taxonomy for your platform#

Define scope around how funds and decisions actually move through your platform, then build taxonomy from that map. If a category cannot be tied to a real activity, an owner, and current evidence, it is too abstract to support a defensible assessment.

Map transaction behavior first#

Start with your real payment paths, not template labels. Use the transaction behaviors that actually occur on your platform as the first lens for Money Laundering/Terrorist Financing (ML/TF) exposure.

For each path, confirm the trigger, systems touched, and where funds leave your control. If that chain is unclear, your scope is still too broad for reliable scoring.

Build a taxonomy you can use consistently#

Build a taxonomy you can apply consistently across the dimensions that matter for your platform. This keeps the assessment risk-based and focused on outcomes instead of looking complete on paper. Each segment should clearly answer these questions:

Keep one meaningful segment per row, with a named owner, source system, and control evidence. Treat these as operational design choices, not regulator-mandated minimum categories in the cited consultation response.

Split out counterparties that change control paths#

Split out counterparties that create different control or escalation paths instead of burying them in a generic partner bucket.

Use separate views when they change triage, investigation, or case management needs. If you need deeper vendor segmentation, use Vendor Risk Assessment for Platforms: How to Score and Monitor Third-Party Payment Risk.

Treat unowned categories as unresolved risk until ownership is clear#

If a category has no clear owner or no current control evidence, treat it as unresolved risk until ownership and evidence are clear. That is a risk management discipline for an effective, reasonably designed AML/CFT program, not a claim about a mandated scoring formula.

Before final scoring, require one accountable owner, one review forum, and one evidence trail per category. Prioritize segments where real-time data and decisions are weak, because low alerts without visibility can point to a detection gap.

Build an evidence pack from systems and records#

Once scope and taxonomy are set, the next job is proving what actually happened. Build an evidence pack that traces onboarding, monitoring, triage, investigation, and decision-making from system data, not policy language alone.

Pull onboarding artifacts by segment#

For each in-scope segment, pull onboarding and customer due diligence records, including beneficial ownership review for legal entity customers where applicable. Use underlying records that show what was submitted, what checks ran, what decision was made, who approved it, and when.

Include evidence of ongoing due diligence, not only initial onboarding outcomes. Risk-based monitoring expects customer information to be maintained and updated over time, including beneficial owner information for legal entity customers.

Sample across outcomes such as approved, rejected, pending, and escalated, not only approved cases. If decisions exist without a clear review trail, treat that as an evidence gap.

Export monitoring, alerts, and filing history#

Pull transaction data and alert data together so you can test detection coverage, not just alert volume. Your pack should support a trace from customer profile to transaction pattern to alert triage outcome and, when escalated, investigation result.

Include alert channels beyond the primary monitoring tool where relevant. Alerts may also come from due diligence processes, third-party reports, or law enforcement requests, and leaving those channels out can distort investigation volume and consistency.

Where your program includes suspicious-activity reporting workflows, include filing history and linked case references where applicable. The goal here is an auditable path from alert to reporting decision, not threshold analysis.

Because false positives are common, do not treat high alert counts as control strength by default. Review both triaged closures and escalations to see whether triage quality is credible.

Add operational exceptions and adjacent records#

When relevant to your workflow, bring in operational records that can affect investigation context, such as payout failures or returns, manual overrides, and case management decisions. These records are often where the gap between written policy and actual behavior shows up.

For override activity, capture reason, approver, timestamp, and linked case or ticket when those fields exist. That context often determines whether an exception was controlled or ad hoc.

You can also use adjacent records as consistency cross-checks when available. Treat them as supporting consistency checks, not substitutes for AML controls.

Set evidence-quality rules before scoring#

Set evidence-quality rules before scoring so missing proof is handled the same way every time. If a log is missing, ownership is unclear, or a timestamp cannot be verified, mark the item as "control not evidenced" until resolved.

Apply this as an internal assessment discipline, not a universal legal scoring rule. For broker-dealers, FINRA Rule 3310 sets minimum AML program standards. More broadly, the same evidence mindset helps confirm controls are designed to detect and support reporting of suspicious transactions.

Record metadata for each export: source system, query date, who pulled it, covered population, and filters. If population counts shift between pulls without a clear explanation, pause scoring until the dataset is stable.

Score inherent risk and control strength#

Score exposure first, then control performance. Keep this rule explicit: low alert counts or polished policies alone should not lower a segment's risk rating when evidence is partial.

Fix the scoring scale before scoring#

Define one scale for inherent risk and one for residual risk, and track evidence status separately. A High / Medium / Low scale is enough if each level is defined in writing and applied by segment and product line, not only at the enterprise level.

Consistency is the control here. If "partial evidence" is undefined, reviewers can score similar controls differently, which can lead to fragmented implementation and weak defensibility. Use this structure:

• Inherent risk: exposure before controls, based on customer type, geography, product, channel, and transaction pattern.
• Control effectiveness: scored separately for CDD, transaction monitoring, and escalation governance.
• Residual risk: remaining ML/TF risk after reviewing actual control evidence.

Before you move on, confirm the working paper includes shared definitions and evidence labels such as "evidenced," "partial," and "not evidenced."

Calibrate inherent risk with current Treasury threat context#

Set inherent risk by asking what could happen if controls were off. For U.S. context, calibrate with the 2026 National Money Laundering Risk Assessment (NMLRA) and broader U.S. Department of the Treasury threat themes, not only recent incident counts.

The 2026 NMLRA says major threat categories have remained consistent, including fraud, drug trafficking, cybercrime, human trafficking, human smuggling, and corruption. It also notes illicit trade generates billions of dollars each year. Map only the threats that fit each flow, and keep inherent scoring independent from control outcomes. A segment can still be high inherent risk even when incident counts are low.

Score CDD, monitoring, and escalation governance separately#

Score CDD, transaction monitoring, and escalation governance separately. Do not collapse them into one comfort score, because one strong control area can easily hide a weak one.

For CDD, verify records support understanding the nature and purpose of relationships and help determine when transactions may be suspicious over time. Check for ongoing monitoring, risk-based customer information updates, and beneficial owner information for legal entity customers where applicable.

For transaction monitoring, test coverage against the risks you identified. Low alert volume is not evidence of strong detection.

For escalation governance, verify owner clarity, evidence quality, case progression, and escalation consistency. Missing timestamps, unclear ownership, or informal closures can indicate material weaknesses.

Apply the residual-risk rule and record actions#

Apply this decision rule consistently: if inherent risk is high and a key control is only partially evidenced, rate residual risk high unless the gap is proven immaterial. Do not downgrade based only on low case volume.

Treat missing logs, unclear ownership, or unverifiable timestamps as incomplete evidence. Then record a dated action for each meaningful gap. Use a table like this in your working paper (illustrative example):

Final checkpoint: every high residual item needs a named owner, an action date, and a clear evidence gap. Low residual ratings should be supported by complete CDD, monitoring, and escalation records, not incident volume alone. Related: A Guide to Transaction Monitoring for High-Risk Payments.

Test critical controls end to end before final scoring#

Before you finalize residual scores, test the controls that matter most from end to end. This is where strong controls on paper often fail in practice: one stage works, but the handoff to the next stage is weak or undocumented.

Walk one realistic scenario from onboarding to payout#

Start with a segment you already rated high inherent risk and test a scenario that matches the real flow. Keep threat selection grounded in the 2026 National Money Laundering Risk Assessment (NMLRA) themes you already use. For example, use fraud, cybercrime, drug trafficking, human trafficking, human smuggling, or corruption, then map only what fits that segment.

Trace the full path: onboarding, profile or account changes, transaction activity, alerting, investigation, and payout or withdrawal outcome. A useful stress case is when onboarding checks pass, but later behavior escalates to suspicious activity review.

Capture evidence, not just screenshots: timestamps, owner names, case notes, decisions, and the final operational action. If an alert exists but reviewer ownership, approval trail, or downstream action is unclear, treat the control as partially evidenced.

Verify reporting and operational handoffs#

Case creation is not the same as a working reporting path. If your process includes regulatory reporting, confirm who prepares, who reviews, what artifact proves completion, and how operations receives the decision. Keep filing-specific triggers and timelines in your jurisdictional policy documentation.

Focus on execution clarity across compliance, legal, finance, and ops once a case moves from review to action. If ownership becomes ambiguous or the handoff relies on informal channels, score escalation governance down.

Where your program requires stronger governance, use clear artifacts such as dual-control approvals and immutable audit trails of who changed what and when.

Pressure-test failure modes and log the breakpoints#

Force realistic failure modes in a controlled test and observe what actually happens across systems and teams:

• settlement or payout handoff failures after a case decision
• delayed risk data propagation that reduces visibility
• manual override paths that move funds while review checks remain unresolved

Record each failure in operational terms: affected segment, exact break point, control owner, and required evidence for retest. If that chain is incomplete, do not soften the score.

Set escalation triggers and decision rights#

After control testing, escalation should be rule-based, not informal. Use written triggers, named owners, and clear evidence so high residual risk does not stay parked in routine review.

Define forced-escalation triggers in writing#

Set triggers that move issues from case handling to governance decisions. Anchor each trigger to assessment evidence and control-performance evidence, not judgment alone.

Useful triggers include known AML deficiencies that remain unresolved, transaction monitoring that has not been substantively updated as risk changes, and first-line capability gaps such as inadequate training. The point is not a universal numeric cutoff. It is making the trigger explicit enough that teams cannot leave known issues in manual review indefinitely.

For each trigger, require a source artifact tied to the issue and its control evidence. If no artifact can activate the trigger, the trigger is too vague.

Split decisions into lanes and assign named owners#

Route escalations into distinct decision lanes so ownership and outputs are unambiguous. A three-lane model is a practical structure, not a universal requirement.

Assign named individuals, not just functions, and make accountability for AML effectiveness explicit in the governance record.

Escalate persistent high residual risk upward#

If near-term remediation does not reduce residual risk, escalate to executive governance and legal review. Do not let manual review expand indefinitely.

Known deficiencies left unresolved, stale transaction monitoring approaches, and weak first-line capability are recurring failure patterns. Keep inherent risk, control effectiveness, and residual risk separate in the escalation memo so decision-makers can judge whether to accept, restrict, or exit risk.

A strong escalation pack includes supporting control evidence, impacted areas, current control owner, open remediation items, and the reason residual risk remains high. Governance artifacts can include committee or board minutes, policy approval records, and defined committee reporting lines.

Record emergency powers and reopening approvals#

Document escalation decision rights, temporary control approvals, and reopening approvals in writing, with named owners and audit-ready records.

Before finalizing escalation governance, verify that each named owner can execute the action operationally and that approvals are auditable. If execution rights or trails are missing, decision rights exist only on paper.

Write the annual assessment report leadership can act on#

Your annual report should turn assessment evidence into decisions with owners and deadlines. If leadership cannot tell what to approve, remediate, or escalate, the report is not ready.

Structure the report around decisions, not background#

Lead with a short decision summary, then show the evidence path: scope, methodology, risk register, control test results, residual risk decisions, and unresolved issues. This keeps the logic auditable from what you reviewed to what leadership must decide.

Define scope boundaries explicitly: legal entities, products, payment flows, geographies, review period, and the evidence cutoff date. Put that cutoff in the methodology section, not a footnote. If evidence is included through 18 March, for example, treat later information as out of scope unless you formally reopen scope and say so.

Write methodology so non-specialists can follow it. Explain how inherent and residual risk were assessed, how control testing was run, and what counted as passed, partial, or failed. If method detail is missing, ratings look discretionary.

Tie each major conclusion to a standard and an artifact#

For each major conclusion, show both the standard reference and the internal artifact. For U.S.-context programs, anchor reasoning to BSA/AML program, recordkeeping, and reporting expectations, and be explicit about which supervisory references or program control principles you used. Do not imply those references prescribe a single report template.

Use a consistent pattern: finding, supporting evidence, and the standard or principle affected. If the issue involves suspicious activity detection, state that directly. SAR obligations are tied to known or suspected criminal violations or suspicious transactions.

Use 2026 NMLRA threat context to sharpen the risk register narrative, not replace platform evidence. Persistent categories include fraud, drug trafficking, cybercrime, human trafficking, human smuggling, and corruption, and the report also flags third-party payment processors. If a conclusion has no source artifact and no standard reference, classify it as an observation or open question.

Add a one-page escalation matrix leaders can approve quickly#

Put high-priority items on one page so leaders can act without searching through prose.

Use individual names in the live report, not only team labels. Confirm each owner has the operational authority to execute the action listed.

Write a real known-unknowns section#

State unresolved legal or regulatory questions directly, especially for non-bank platform activity where requirements can depend on industry and jurisdiction. Do not hide uncertainty that could change reporting, recordkeeping, or assessment obligations.

For each known unknown, include the affected market or entity, the exact question, the interim control, the legal owner, and the target decision date. This turns uncertainty into managed work rather than passive disclosure.

Where an assessment is required by applicable authorities, failing to complete it can create compliance risk. End each unresolved item in one of three states: temporary acceptance, remediation by date, or escalation for legal determination. For related expansion planning, see How to Expand Your Subscription Platform to Europe for Payment and VAT Readiness.

Turn findings into a 90-day remediation plan#

The point of this 90-day plan is to reduce the highest residual risk first, not to close the easiest tickets. Start with gaps that can affect multiple products, customer segments, or reporting and control paths, then sequence narrower issues.

Rank by residual risk and blast radius#

Do not let implementation speed set priority. If a gap can weaken suspicious activity detection or reporting across more than one payment flow, treat it as first-wave work.

For each finding, record:

• affected flow and customer population
• residual-risk rating from the assessment
• likely consequence if it stays open through the quarter

This keeps the plan tied to operational exposure, not convenience.

Convert each finding into a closure-ready ticket#

Turn each finding into a trackable ticket with one accountable owner. Split tickets by control path when ownership, fix, or evidence differs.

At minimum, include:

• finding ID and affected control
• named owner and due date
• affected entity, product, market, or segment
• interim control until the permanent fix is live
• required closure artifact

Closure should be evidence-based. Where records and reporting controls are involved, do not close on policy text alone. Require artifacts that show the control operated on real activity, for example test output, case records, or report exports. If the artifact cannot show that, keep the ticket open.

Add a vendor lane for shared controls#

Include third-party actions in the same plan when controls are shared or outsourced, including payment processors and other partner arrangements. If a shared control is weak, treat the residual risk as still yours until evidence shows the control works.

Request partner evidence that is specific enough to verify operation, such as:

• control description and change date
• evidence of operation
• exception log
• escalation approver

Where a partner supports monitoring or reporting, require evidence that transactions and account activity can be reconstructed. If that evidence is missing, the finding remains open. For deeper partner follow-up, use Vendor Risk Assessment for Platforms: How to Score and Monitor Third-Party Payment Risk.

Set 30/60/90 verification checkpoints#

Treat each checkpoint as a retest point, not a status update.

For previously failed SAR or CTR paths, retest end to end, from trigger through handoff where applicable. For CTR-related gaps, verify required data capture and recordkeeping for reportable currency activity over $10,000 where that obligation applies. If a path still fails at Day 60, escalate and keep it open until evidence shows the control operates effectively.

Before assigning owners and deadlines, align your remediation workflow with implementation and audit-trail mechanics in the Gruv docs.

Common mistakes and how to recover#

The fastest way to weaken an annual AML assessment is to close findings with narrative instead of evidence.

Require artifacts, not policy language#

Treat any control without objective evidence as failed pending proof. A written procedure is not evidence that a control operated on real activity.

Define the closure artifact in advance for each control, and reject submissions that only restate policy. Useful artifacts include dated system exports, case records, alert dispositions, approval logs, or filing confirmations tied to the control owner and review period. If a second reviewer cannot reconstruct what happened from the artifact alone, keep the control unsupported and residual risk high.

Keep AML residual-risk scoring separate from tax and FBAR tracking#

Do not combine AML, tax reporting, and FBAR work into one blended score. Track adjacent tax-reporting interfaces, but keep AML residual-risk scoring distinct.

If an entity in scope has FBAR obligations, track FinCEN Form 114 in a separate compliance lane with its own evidence pack. Include filing status, the $10,000 threshold analysis, maximum account value support, and due-date tracking against April 15th and the automatic extension to October 15th, while checking for any event-specific FinCEN filing relief. Treat amended or missed FBAR filings as AML-relevant only when they show a real AML control gap.

Scale controls to risk#

Overbuilding controls in low-risk segments can burn resources without reducing meaningful exposure. Keep controls proportional, and redeploy effort to higher-risk ML/TF scenarios where onboarding, monitoring, and payout controls intersect. That keeps deeper testing and stronger evidence focused where the assessment is most likely to find real gaps.

Pre-approve escalation triggers before the cycle starts#

If residual risk stays high, escalation should already be defined. Set executive and legal triggers up front, including who can pause a product, restrict a segment, or require specialist counsel.

For adjacent FBAR failure modes, make escalation ownership explicit. Amendment and submission issues can stall if ownership is unclear. For example, amendments require checking the Amend box and retaining the Prior Report BSA Identifier, and missing required XML elements can cause rejection. Define the owner, decision point, and deadline before those issues occur.

Conclusion and copy-paste checklist#

Use one documented method each cycle, with one accountable approver, so results stay comparable and decisions stay defensible. If scope, evidence rules, or scoring logic drift mid-cycle, leadership cannot tell whether risk changed or the method changed.

Keep one owner and one approved record#

Run the closeout inside your compliance program, not as an orphan spreadsheet. Where you are a FINTRAC reporting entity, establishing and implementing a compliance program is required. If you use a self-assessment checklist, treat it as a structured review tool, not an exhaustive statement of AML/CFT obligations.

Assign a named Compliance Officer to supervise completion and approve the final output. Save and print the finalized checklist or workbook for internal review and follow-up, with a clear scope, evidence cutoff date, and version label.

Keep depth proportional to ML/TF risk#

Go deepest where ML/TF exposure is highest and keep lighter coverage only where controls are evidenced and stable. Higher-risk areas should get deeper testing, stronger evidence, and clearer escalation paths.

Treat any control answer that is effectively "No" as potential non-compliance, and document remediation actions and timing. Do not let easier low-risk testing crowd out higher-risk areas, because control gaps can increase legal, operational, and reputational risk.

Use this copy-paste closeout checklist#

• Confirm scope by entity, market, and product. State what was reviewed and what was excluded.
• Confirm taxonomy across customer, geography, product, and channel. Keep categories consistent across evidence, scoring, testing, and reporting.
• Confirm evidence pack for your defined controls. If an artifact has no owner, date, or version, mark it as not evidenced.
• Confirm your risk-scoring method is documented and applied consistently. Prevent strong controls in one area from masking weak controls elsewhere.
• Confirm end-to-end tests and documented failures. Retain passed and failed scenarios, including overrides and delayed investigations.
• Confirm escalation triggers, owners, and approval rights. Be explicit about who can restrict activity, approve workarounds, and escalate to legal or executive governance.
• Confirm report outputs, remediation plan, and time-bound follow-up checkpoints. Use this cadence as a management tool to verify fixes were completed and retested.

The checklist is not the conclusion. The decision is. If residual risk remains high after near-term remediation, escalate that clearly.

If your residual-risk actions require operational changes across collections, balances, FX, and payouts, confirm market and program fit with Gruv.