AML Risk Assessment Template — New Zealand Compliance

An AML risk assessment is a documented evaluation of where an organisation may be exposed to money laundering, terrorism financing, or related financial crime risk. It typically considers customers, products and services, delivery channels, transaction behaviour, geographic exposure, and the effectiveness of existing controls. The assessment helps leadership apply resources and due diligence measures proportionately under a risk-based compliance approach.

A useful template should define the assessment scope, methodology, risk factors, scoring approach, inherent-risk ratings, controls, residual-risk ratings, ownership, evidence sources, and review dates. It should also record the rationale behind each rating and identify remediation actions. For New Zealand use, the template should be structured to support AML/CFT Act obligations and your applicable supervisor’s expectations.

Review the assessment on a regular documented cycle and whenever material change occurs. Common triggers include new products, customer segments, markets, payment channels, high-risk geographies, acquisitions, significant control failures, or emerging typologies. A review should confirm whether inherent risks, control effectiveness, residual-risk ratings, and action plans still accurately reflect the business and its operating environment.

Inherent risk is the level of exposure before controls are applied, based on factors such as customer profile, product features, transaction patterns, and geography. Residual risk is the exposure that remains after evaluating the design and operating effectiveness of controls such as KYC, screening, monitoring, training, and governance. Both ratings should be supported by clear, documented rationale.

A risk assessment gives a reporting entity the factual basis for a proportionate AML/CFT programme. It helps explain why particular customer due diligence, monitoring, recordkeeping, escalation, and governance measures are appropriate for the organisation’s exposure. New Zealand businesses should consider the AML/CFT Act 2009, relevant guidance, sector-specific typologies, and the expectations of their designated supervisor when documenting their approach.

No. A standard template can provide a strong structure, but its risk factors, scoring thresholds, evidence requirements, and control mapping must reflect the organisation’s actual business model. A payments company, lender, digital-asset business, and traditional financial institution can face very different exposures. Tailoring prevents a document from becoming a generic exercise that does not inform real operational decisions.

The risk assessment should drive the design of KYC and transaction-monitoring controls. Higher-risk customer types may require enhanced due diligence, more frequent reviews, or additional verification. Product, channel, and transaction risks should influence monitoring scenarios, alert thresholds, investigation procedures, and escalation routes. Reviewing these connections helps ensure controls address identified risks rather than operating as disconnected compliance activities.

Support ratings with reliable internal and external evidence, including customer and transaction data, alert and case trends, suspicious activity indicators, product documentation, geographic exposure, regulatory publications, audit findings, and control-testing results. Keep a record of data limitations and management assumptions. Clear evidence makes the assessment easier to challenge, update, explain to leadership, and substantiate during an independent review or examination.