The risk assessment is organized, led and owned by the country in question. This approach facilitates the development of the country’s own capacity to undertake future risk assessments with little or no external support. The World Bank provides a recommended process (which can be adapted to country circumstances), the risk assessment tool, training on how to use the tool, and guidance in making the assessment stronger and more reliable.
Working Group for the risk assessment
The World Bank recommends that countries establish a Working Group to carry out the risk assessment. Generally, this Working Group will comprise representatives of all relevant AML/CFT stakeholders (e.g., the Financial Intelligence Unit, the Central Bank and/or other regulatory and supervisory agencies, self-regulatory bodies, prosecutors, law enforcement, tax and customs authorities, and other relevant authorities). In addition, the involvement of representatives of the financial and other relevant sectors is strongly encouraged. Academics may also be invited to participate.
The Three Phases of the Risk Assessment Process
The risk assessment generally takes 8 to 12 months to complete. The World Bank recommends a three-phase process, as follows:
Phase 1 – Preparation
At Phase 1, the World Bank provides written guidance on how to set up a National Risk Assessment Working Group, collect pre-assessment data and information, and manage the logistics of the assessment process. Once the Working Group has been established, the World Bank team and the Working Group representatives come together in a video conference to ensure that the preparatory phase is well organized. Good preparation at this stage, especially in relation to data and information collection, will be essential for the effectiveness of the first workshop.
Phase 2 – Assessment
Phase 2 – the assessment itself – begins with a three-day workshop for all Working Group members. The purpose of this workshop is to introduce the assessment tool and launch the assessment process. The workshop includes a brainstorming session on the money laundering and terrorist financing risks in the country. Working Group members also get hands-on training on the Risk Assessment Tool. The assessment process starts during the workshop and usually continues for 5 to 10 months. During the workshop, the Working Group also draws up the roadmap for the completion of the assessment. The World Bank provides guidance throughout this phase, and reviews the draft risk assessment report to ensure the accurate use of the assessment methodology.
Phase 3 – Finalization
Phase 3 is the final stage of the process. During a final three-day workshop, the Working Group discusses the risk assessment and its results, with the managements of participating agencies, and policymakers. The workshop focuses on (i) a final review and discussion of risk assessment results, (ii) the design of risk-based action plans, and (iii) a discussion of implementation issues.
Outputs of the Risk Assessment Process
- Risk Assessment Results: The main output of the assessment process is the populated tool, which highlights the areas of higher, medium, or lower risk in various sectors, as well as at a general, national level.
- Risk Assessment Report: A risk assessment report, which documents the assessment process, findings, and evidence, is strongly encouraged. We recommend publishing at least a summary of the assessment. However, the dissemination strategy of the assessment results is for the country itself to decide.
- Risk-Based Action Plan: Based on the risk assessment results, a detailed action plan is developed for the implementation of a risk-based approach to prevent and mitigate the identified ML/TF risks.
- Managed and owned by the countries themselves. The World Bank’s role is limited to providing technical support.
- A capacity-building activity, which aims to enable countries undertaking future risk assessments without external support.
- Aims to include all AML/CFT stakeholders from public and private sectors to bring in different perspectives and enhance their cooperation.
- Clear timetable set at the beginning of the process, ensuring completion of the NRA within a reasonable timeframe (generally 6-9 months).
- Helps authorities to identify data and information gaps, and to develop a framework for future data collection.