A Practical Guide on AML Risk Assessment and Monitoring Program in 2026

1. What is Money Laundering and Terrorist Financing?

Firms must have a clear understanding of Money Laundering (ML) and Terrorist Financing (TF) and the risks associated with both. 

Money Laundering refers to the process of disguising the proceeds of illegal activity so that they appear to originate from legitimate sources, commonly through the stages of placement, layering, and integration. Terrorist Financing, on the other hand, involves the collection or use of funds to support terrorist activities and may involve funds derived from legitimate as well as illegitimate sources. 

Although the underlying purposes of ML and TF differ, they may involve similar methods, including wire transfers and the use of shell companies, to obscure the source, movement or intended use of funds. 

CySEC supervises a range of regulated entities, including CIFs, UCITS, ASPs, and CASPs. Through a risk-based supervisory approach, CySEC assesses firms according to their exposure to ML/TF risks, taking into account factors such as their client base, business activities, and transaction types. 

The applicable framework is supported by EU AML Directives as implemented into national legislation, requiring regulated entities to maintain effective AML/CFT systems that remain aligned with evolving regulatory expectations. 

2. What is the purpose of AML Risk Assessment and responsibilities of AML Function?

Anti-Money Laundering Risk Assessment 

The AML risk assessment plays a central role in shaping a firm’s AML/CFT framework. Its findings influence areas such as client onboarding, transaction monitoring, employee training, and relationships with third-party service providers. 

It also contributes to the firm’s wider Business Risk Assessment (BRA), which considers financial, operational and reputational risks alongside AML/CFT exposure. 

By identifying and prioritising relevant risks, firms can implement controls proportionate to their exposure and ensure that their AML policies and procedures remain responsive to both regulatory developments and changes within the business. 

The AML function relies on this assessment to allocate resources appropriately and ensure that ML/TF risks are effectively identified, monitored, and addressed. The assessment should be reviewed regularly and take into account factors such as customer profiles, geographic exposure, products and services offered, and delivery channels. 

These factors help the firm categorise clients and activities according to their level of risk and determine the appropriate frequency and depth of ongoing monitoring. 

Anti-Money Laundering Function 

The AML function is responsible for developing and maintaining policies and procedures, carrying out risk assessments, monitoring the effectiveness of controls, ensuring compliance with applicable legal requirements and reporting to the Board or senior management. 

To perform these responsibilities effectively, the function should operate independently and have sufficient resources, including appropriate staffing and systems. Key roles may include the AML Compliance Officer (AMLCO), Alternate AMLCO and AML Director, each contributing to the maintenance of an effective AML/CFT framework. 

The AML function should also assess the firm’s exposure through a structured monitoring programme informed by the results of the AML risk assessment. Depending on the firm’s risk profile, this may include desk-based reviews, on-site inspections, and transaction monitoring. 

The AMLCO is also responsible for preparing annual and periodic reports, managing internal and regulatory communications, and ensuring that employees receive appropriate AML/CFT training. 

Overall, the AML function plays a central role in embedding an effective compliance culture, managing financial crime risks, and demonstrating regulatory accountability. 

3. How should an organization structure its AML Monitoring Program and Inspection Areas?

Anti-Money Laundering Monitoring Program 

A firm should establish and maintain a risk-based AML Monitoring Program that reflects its business activities, services, and client risk profile. 

The program should cover all relevant areas of the firm’s investment and ancillary services and remain aligned with the AML risk assessment so that identified risks are subject to appropriate controls and monitoring. 

Its purpose is to assess compliance with applicable national and EU AML requirements, evaluate whether internal policies and procedures remain effective, and determine whether existing controls are adequate. 

The program should also evolve as the firm’s risk profile changes and should assess whether identified deficiencies and remedial actions have been addressed effectively. 

Anti-Money Laundering Inspection Areas 

AML inspections typically cover areas such as corporate governance, client onboarding, customer identification and verification, KYC documentation, and transaction monitoring. 

Particular focus is placed on how effectively the firm identifies, documents and manages client risk, especially in relation to high-risk clients and complex ownership structures. 

Other important areas include suspicious transaction reporting, reliance on third-party service providers, compliance with international sanctions requirements, and the handling of cash deposits exceeding applicable regulatory thresholds. 

Firms should therefore maintain a proactive and well-documented approach, ensuring that their processes remain consistent with their AML risk profile and CySEC’s supervisory expectations. 

4. Good and Bad practices based on CySEC Circular C656

CySEC Circular C656 sets out key observations arising from inspections carried out by CySEC during 2022 and 2023, highlighting both good practices and common deficiencies identified across regulated entities. 

Examples of good practice include conducting open-source checks for high-risk clients and Politically Exposed Persons (PEPs), involving senior management in higher-risk client approvals, maintaining comprehensive customer files supported by documented risk assessments and keeping AML policies up to date with regulatory developments. 

Enhanced monitoring of newly onboarded clients and comprehensive documentation practices were also identified as indicators of a proactive AML/CFT framework. 

At the same time, CySEC identified several areas of weakness. These included overly generic AML manuals, incomplete customer profiles, inadequate application of Enhanced Due Diligence (EDD), and deficiencies in transaction monitoring. 

Further shortcomings included inadequate assessment of adverse media and UN/EU sanctions exposure, insufficient justification for significant transactions or sources of funds, weaknesses in suspicious activity reporting and inadequate record keeping. 

In certain cases, firms were unable to provide key AML documentation during inspections. 

Regulated entities should therefore carefully consider the findings set out in Circular C656 and assess whether improvements are required within their own AML/CFT frameworks, particularly in relation to risk-based controls, documentation, and monitoring. 

5. How can SALVUS assist you?

The SALVUS Anti-Money Laundering team combines regulatory expertise with hands-on experience in developing, implementing and monitoring effective AML/CFT frameworks for regulated entities. 

Our experience spans a range of financial sectors, including investment firms, crypto-asset service providers and other supervised entities, allowing us to develop AML/CFT solutions tailored to each firm’s business model, risk profile and regulatory obligations. 

SALVUS supports firms throughout the AML/CFT compliance lifecycle, from designing risk-based monitoring programmes and conducting AML risk assessments to preparing for regulatory inspections and drafting AMLCO reports. 

We also assist with reviewing and enhancing internal policies, procedures and reporting arrangements to ensure they remain aligned with CySEC and EU requirements while being practical and effective in day-to-day operations. 

Our support further includes training key personnel, strengthening internal controls, and incorporating relevant industry practices to enhance a firm’s ability to identify, manage and mitigate financial crime risks. 

Through this comprehensive approach, the SALVUS AML/CFT team helps firms navigate regulatory expectations, reinforce their internal safeguards, and maintain effective and sustainable AML/CFT frameworks. 

Contact us at info@salvusfunds.com to learn how our AML/CFT specialists can support your firm in strengthening its compliance framework and aligning its practices with applicable regulatory requirements. 

#StayAhead

Should you be interested to read more about relevant topics in AML and compliance function requirements, feel free to visit our earlier articles: 

• Know all 2026 Anti-Money Laundering Regulatory Updates 
• A Complete Client Onboarding Procedure as per AML & MiFID in 2026 
• An AML Guide in 2026: Assessing Risks, KYC, CDD, Duties & Responsibilities 
• Compliance Monitoring Program & Assessment in 2026 

The information provided in this article is for general information purposes only. You should always seek professional advice suitable to your needs.