A Practical Guide on AML Risk Assessment and Monitoring Program in 2025

1. What is Money Laundering and Terrorist Financing?

The firm must have a clear understanding about Money Laundering (ML) and Terrorist Financing (TF). Money Laundering (ML) refers to the process of making illegally obtained funds appear legitimate through placement, layering, and integration stages. Terrorist Financing (TF) involves the collection or use of funds, often from legal sources, to support terrorism. While ML is financially motivated, TF is ideologically driven, but both rely on similar methods like wire transfers and shell companies to conceal fund origins and evade detection. 

The CySEC has a supervisory role over entities such as CIFs, UCITS, ASPs, and CASPs. Using a risk-based approach, CySEC assesses firms based on their exposure to ML/TF threats, client profiles, and transaction types. The legal framework supporting this oversight includes the 4th, 5th, and upcoming 6th AML Directives, which are implemented into national law. These directives guide regulated entities in maintaining robust AML/CFT systems aligned with EU standards and evolving regulatory expectations. 

2. What is the purpose of AML Risk Assessment and responsibilities of AML Function?

Anti-Money Laundering (AML) Risk Assessment 

The AML risk assessment influences various areas of the business, including onboarding procedures, transaction monitoring systems, employee training, and third-party relationships. It also serves as a key input to the firm’s broader Business Risk Assessment (BRA), which incorporates financial, operational, and reputational risks alongside AML/CFT exposure. By identifying and prioritizing risks, firms can design targeted control measures and ensure compliance with national and EU regulations. Ultimately, the assessment ensures that AML policies remain effective and adaptive to both regulatory changes and internal developments. 

The AML function uses the assessment to allocate resources effectively and to ensure that risks related to money laundering and terrorist financing are actively monitored and addressed. This assessment must be reviewed regularly and considers factors such as customer profiles, geographic locations, products and services offered, and delivery channels used. These risk factors are analyzed to categorize clients and activities into low, medium, or high-risk levels, which then determine the frequency and depth of monitoring activities. 

Anti-Money Laundering (AML) Function 

The AML function is responsible for developing policies, conducting risk assessments, monitoring controls, ensuring compliance with legal requirements, and reporting directly to the Board or senior management. It must operate independently and be adequately resourced in terms of staffing and tools to ensure effective performance of its duties. Key roles include the AML Compliance Officer (AMLCO), the Alternate AMLCO, and the AML Director—each playing a specific part in maintaining a compliant and responsive AML framework. 

Additionally, the function must regularly assess the firm’s risk exposure through a structured monitoring program based on the outcomes of the AML risk assessment. This includes desk reviews, on-site inspections, and transaction monitoring tailored to the risk level of business activities. The AMLCO must prepare annual and other periodic reports, manage internal and regulatory communications, and provide staff training. Overall, the AML function is central to embedding a culture of compliance, managing financial crime risks, and demonstrating regulatory accountability. 

3. How should an organization structure its AML Monitoring Program and Inspection Areas?

Anti-Money Laundering (AML) Monitoring Program  

The firm should develop and implement a risk-based AML Monitoring Program tailored to their business activities and client risk profiles. The AML monitoring program must cover all areas of investment and ancillary services and be aligned with the firm’s AML risk assessment to ensure that identified risks are effectively managed. Its primary aim is to verify compliance with national and EU AML obligations, ensure that internal policies remain effective, and evaluate the adequacy of existing controls. The monitoring program must adapt to changes in the firm’s risk profile and assess the effectiveness of any remedial actions taken. 

Anti-Money Laundering (AML) Inspection Areas 

The AML inspection framework includes core areas such as corporate governance, client onboarding, customer verification, KYC documentation, and transaction monitoring. Inspectors assess how well the firm identifies, documents, and manages client risk, especially for high-risk clients or complex structures. Particular attention is given to suspicious transaction reporting, the use of third-party service providers, compliance with international sanctions, and handling of cash deposits exceeding regulatory thresholds. Firms are encouraged to adopt a proactive, well-documented approach and ensure that internal processes align with the AML risk profile and CySEC expectations. 

4. Good and Bad practices based on CySEC Circular C656

The CySEC Circular C656 focuses on key observations from CySEC’s inspections conducted between 2022 and 2023, summarizing both good practices and common deficiencies among regulated entities. Good practices identified include using open-source checks for high-risk clients and PEPs, involving senior management in client approvals, maintaining detailed customer files with risk assessments, and keeping AML policies updated in line with regulatory developments. Enhanced monitoring of newly onboarded clients and strong documentation processes also reflect a proactive approach to AML compliance. These practices demonstrate a firm’s commitment to effectively identifying and mitigating money laundering and terrorist financing risks. 

On the other hand, CySEC highlighted several weaknesses in areas such as generic AML manuals, incomplete customer profiles, improper application of Enhanced Due Diligence (EDD), and poor transaction monitoring. Many firms failed to assess risks from adverse media or UN/EU sanctions exposure and neglected to justify large transactions or loan sources adequately. Weaknesses were also found in suspicious activity reporting and record keeping, with some firms unable to produce key AML documents during inspections. CySEC expects all regulated entities to thoroughly review the findings of Circular C656, enhance their AML frameworks accordingly, and ensure robust, risk-based internal controls to avoid administrative sanctions. 

5. How can SALVUS assist you?

The SALVUS Anti-Money Laundering team offer deep regulatory insight and hands-on experience in developing, implementing, and monitoring effective AML/CFT frameworks for regulated entities. Our expertise spans across multiple financial sectors, including investment firms, crypto-asset service providers, and other supervised entities, enabling us to deliver tailored AML/CFT strategies that align with your business model, risk exposure, and regulatory obligations. 

We serve as a trusted compliance partner, supporting your firm at every stage of AML/CFT readiness—from designing risk-based monitoring programs and conducting AML risk assessments to preparing for inspections and drafting AMLCO reports. We ensure that your internal policies, procedures, and reporting mechanisms are not only compliant with CySEC and EU requirements, but also operationally efficient and audit-ready. Our approach includes training key personnel, optimizing controls, and applying industry best practices to enhance your firm’s resilience against financial crime. 

In essence, the SALVUS AML/CFT team provides a full-spectrum compliance solution that simplifies regulatory expectations, reinforces your internal safeguards, and strengthens your firm’s integrity and trustworthiness in the financial marketplace. 

Contact us  at info@salvusfunds.com to discover how our dedicated AML/CFT experts can help enhance your firm’s compliance strategy and ensure alignment with regulatory best practices. We are always ready to answer your questions and support you in achieving regulatory compliance.

#StayAhead

Should you be interested to read more about relevant topics in the DORA reporting obligation, feel free to visit our earlier news and articles: 

• AML: suspicious activity reporting and ML offences
• AML: compliance culture and reporting obligations
• AML: Customer verification and deposits
• Compliance Tips and Enforcement of AML Best Practices

The information provided in this article is for general information purposes only. You should always seek professional advice suitable to your needs.