Documenting Risk Profiles Supervisors should document the risk profile of each financial institution or financial s ector. Where the assessment is of an institution, supervisors can provide a brief summary of the institution, followed by a summary of its inherent risks, mitigating measures, and residual risk. In addition, other relevant issues that may affect the risk profile of the institution can also be described. These issues can include, for instance, (proposed) changes in ownership, senior management, audit and compliance functions, mergers, acquisitions, or new product lines. This description can also take into account, as appropriate, the results of other areas of supervision, the internal control environment, and the culture of compliance. The following can serve as a guide: ●● Background information on the financial institution, including ■■
Ownership and control, corporate structure, (foreign) branches, and subsidiaries;
■■
Sector, size, and financial position;
■■
Business model, including client base and main business lines;
■■
Management issues, including recent changes and risk appetite; and
■■
Regulatory and supervisory history, including enforcement measures and other compliance issues.
●● ML/TF risk profile, including ■■
Principal inherent risks with respect to customers, products and services, geography, and delivery channels;
■■
Adequacy of mitigating measures;
■■
Overall residual risk assessment; and
■■
Trends in the institution’s inherent risks, controls, and residual risks.
●● Other significant issues and events, including ■■
Quality and history of STRs;
■■
Compliance and audit coverage of AML/CFT and management response;
■■
Open-source information (for example, reported ML/TF cases involving the institution or its clients);
■■
Home or host supervisory issues (where applicable); and
■■
Enforcement measures and regulatory measures by other (supervisory) authorities.
OTHER SUPERVISORY ACTIVITIES Risk profiles and sectoral risk assessments are important not only for identifying financial institutions for on-site inspections but also for selecting institutions for outreach activities, such as compliance meetings, roundtable discussions, and seminars or conferences. 80
PREVENTING MONEY LAUNDERING AND TERRORIST FINANCING
