Risk assessment
Also written Risk assessment (SEBI formulation) · ML/TF risk assessment
An intermediary's documented, up-to-date assessment of its own money-laundering and terrorist-financing risk across clients, geographies, transactions and payment channels — and of new products before launch.
In plain language
Client risk categories answer the question "how risky is this client?". A risk assessment answers an earlier one: "where is this business exposed to money laundering at all?"
It is the intermediary looking at itself — its client base, the places its clients come from, the products it sells, the way money comes in and goes out, the channels through which clients arrive — and deciding where the laundering risk concentrates. Everything else in the risk based approach, from which clients get enhanced diligence to how closely transactions are monitored, is supposed to follow from that exercise.
The law is specific about the form it must take. A risk assessment in someone's head, or one done once and filed, does not meet it.
How it works
The statutory duty — Rule 9(13). Every reporting entity shall carry out risk assessment to identify, assess and take effective measures to mitigate its ML and TF risk for clients, countries or geographic areas, and products, services, transactions or delivery channels, consistent with any national risk assessment conducted by a body or authority notified by the Central Government. The assessment shall:
- be documented
- consider all the relevant risk factors before determining the level of overall risk and the appropriate level and type of mitigation
- be kept up to date
- be available to competent authorities and self-regulating bodies
SEBI's formulation (Chapter 6, section 6.2.5) frames the scope as clients, countries or geographical areas, nature and volume of transactions, payment methods used by clients, etc., and adds three things:
- New products and technologies. Stock exchanges and registered intermediaries shall identify and assess the ML/TF risks arising from new products, new business practices including new delivery mechanisms, and new or developing technologies for new and existing products — and undertake that assessment prior to the launch or use, adopting a risk based approach to mitigate them.
- Country information circulated by the Government of India and SEBI from time to time.
- Sanctions lists — the updated list of individuals and entities subject to sanction measures under the various United Nations Security Council Resolutions.
What it feeds. Under Rule 9(14)(iii) the Client Due Diligence Programme must include policies, controls and procedures, approved by senior management, to manage and mitigate the risks identified either by the reporting entity or through national risk assessment. And simplified measures are not acceptable where the risk identified is not consistent with the national risk assessment.
A worked example
An illustrative broker and product; the requirements are the workbook's.
Konark Capital Ltd plans to launch an app that lets non-resident Indians open accounts without visiting a branch. Its compliance head is told the launch date is 1 October.
What Rule 9(13) and section 6.2.5 require first. The ML/TF risk assessment of the new product and delivery channel must be done before launch, not after the first quarter's data arrives.
| Factor | Assessment | Mitigation adopted |
|---|---|---|
| Clients | NRIs — a Client of Special Category | Enhanced due diligence; source of funds documented |
| Delivery channel | Non-face-to-face — also a CSC ground | VIPV with liveliness check and tamper-proof recording |
| Geography | Clients in several overseas jurisdictions | Country-specific information from the Government of India and SEBI built into onboarding; clients in high-risk jurisdictions escalated |
| Sanctions | Any client could match a listed name | Screening against the updated UNSC sanctions lists at onboarding and on each list update |
| Payment methods | Inward remittances only | Internal thresholds per client class; alerts above them |
The document is approved, dated and filed so that it can be produced to SEBI or FIU-IND on request, and a review date is set so that it is kept up to date.
What not doing it looks like. In the Raima Equities matter in Chapter 8, SEBI found the broker had no basis for classifying clients into high, medium and low risk and an AML risk management system limited to stock-market risks such as delivery, payment and margin. The penalty was Rs 2,00,000 under section 15HB of the SEBI Act.
Why NISM asks about it
Rule 9(13) is in Chapter 3 (PML Rules, 2005) and SEBI's version is Chapter 6, section 6.2.5 (Risk Assessment), immediately after the risk based approach in 6.2.4. Expect a question on the four attributes of the assessment (documented, all factors, up to date, available to authorities), one on the requirement to assess new products and technologies before launch, and one on the two external inputs — country information and the UNSC sanctions lists.
Common exam traps
- Risk assessment is not client risk categorisation. The assessment is of the intermediary's own exposure; the low, medium and high categories are applied to clients using what it produces.
- New products are assessed before launch or use — not after.
- "Available to competent authorities and self-regulating bodies", not published to clients.
- It must be consistent with the national risk assessment. Simplified measures are not acceptable where the identified risk is not consistent with it.
- Both stock exchanges and registered intermediaries carry the new-products obligation.
- The wording differs slightly between Rule 9(13) and SEBI's section 6.2.5. The Rule speaks of products, services, transactions or delivery channels; SEBI speaks of nature and volume of transactions and payment methods used by clients. Both lists end open, and neither excludes the other.
Check yourself
1.Under the risk based approach, when may simplified client due diligence NOT be applied?
- a)When there are suspicions of ML or TF, or when other factors give rise to a belief that the customer does not in fact pose a low risk
- b)Only for corporate clients
- c)Only where the client invests above Rs. 10 lakh
- d)Simplified CDD is never permitted
Show the answer
Answer: (a) When there are suspicions of ML or TF, or when other factors give rise to a belief that the customer does not in fact pose a low risk
It may be noted that low risk provisions shall not apply when there are suspicions of ML/FT or when other factors give rise to a belief that the customer does not in fact pose a low risk.
Two triggers — actual suspicion, or a belief that the low-risk classification was wrong.
Option D overstates the position. The basic principle enshrined in this approach is that the registered intermediaries shall adopt an enhanced client due diligence process for higher risk categories of clients. Conversely, a simplified client due diligence process may be adopted for lower risk categories of clients.
Simplified CDD is permitted — it is simply unavailable once suspicion arises.
Options B and C invent classifications the guidelines do not use. Risk classification rests on the client's location (registered office, correspondence address, and any other relevant addresses), nature of business, trading turnover, and mode of payment for transactions, producing low, medium, or high-risk categories.
And no client escapes CDD altogether: there shall be no minimum investment threshold/ category-wise exemption available for carrying out CDD measures by registered intermediaries.
What the RBA requires structurally. Intermediaries shall apply a Risk Based Approach (RBA) for mitigation and management of the identified risk and should have policies approved by their senior management, controls and procedures in this regard. Further, the registered intermediaries shall monitor the implementation of the controls and enhance them if necessary.
The documentation demanded also varies: the type and amount of identification information and documents that registered intermediaries shall obtain necessarily depend on the risk category of a particular client.
And so does monitoring: the extent of monitoring shall be aligned with the risk category of the client.
The underlying risk assessment covers clients, countries or geographical areas, nature and volume of transactions, payment methods used by clients, etc., and must be documented, updated regularly and made available to competent authorities and self-regulating bodies, as and when required.
2.Which of the following is NOT a purpose of the CFT and PF Guidelines?
- a)To prevent entities from engaging in VDA activities
- b)To indicate best practices in the design and implementation of an effective risk-based approach
- c)To establish an efficient reporting mechanism to prevent money laundering
- d)To assist engaged entities to better understand their AML/CFT/CPF obligations
Show the answer
Answer: (a) To prevent entities from engaging in VDA activities
The four stated purposes are:
Understand and apply the risk-based approach and indicate best practices in the design and implementation of an effective risk-based approach
Identify the entities that conduct activities or operations relating to VDAs i.e., SPs
Establish an efficient reporting mechanism to prevent money laundering, terrorist financing and proliferation financing
To assist entities engaged in or seeking to engage in VDA activities or operations to better understand their AML/CFT/CPF obligations and how they can effectively comply with the AML/CFT/CPF requirements as notified under PMLA/PMLR
Nothing about preventing the activity itself.
Indeed the fourth purpose points the other way — it expressly contemplates entities seeking to engage in VDA activities or operations and sets out to help them.
The scope confirms the approach. The guidelines apply to SPs and explain how they should implement the AML/CFT/CPF obligations effectively, focusing on VDAs that are convertible to other funds or value, including both VDAs that are convertible to other VDAs and VDAs that are convertible to fiat or that intersect with the fiat financial system.
Convertibility is what creates the risk — value that can leave the regulated system.
Which explains the one exclusion: Central Bank issued Digital Currencies (CBDCs) are outside the scope of this guidance since they are digital representation of fiat currencies (government issued currency that is not backed by a precious metal).
The whole framework is risk-based, not prohibitory. The first purpose is to understand and apply the risk-based approach — the same approach the PML Rules take, requiring each entity to carry out risk assessment to identify, assess and take effective measures to mitigate its money laundering and terrorist financing risk for clients, countries or geographic areas, and products, services, transactions or delivery channels.
These guidelines became effective from 10th March 2023.
3.Under the FATF framework, countries subject to increased monitoring are included in which list?
- a)Grey list
- b)Black list
- c)Blue list
- d)None of the above
Show the answer
Answer: (a) Grey list
When the FATF places a jurisdiction under increased monitoring, it means the country has committed to resolve swiftly the identified strategic deficiencies within agreed timeframes and is subject to increased monitoring. This list is often externally referred to as the grey list.
"Increased monitoring" is the formal description of grey list status.
The grey list statement identifies countries that are actively working with the FATF to address strategic deficiencies in their regimes to counter money laundering, terrorist financing, and proliferation financing.
The black list is the harder category. This statement, (previously called "Public Statement"), identifies countries or jurisdictions with serious strategic deficiencies to counter money laundering, terrorist financing, and financing of proliferation. This list is often externally referred to as the Black list.
And its consequences escalate: for all countries identified as high-risk, the FATF calls on all members and urges all jurisdictions to apply enhanced due diligence, and in the most serious cases, countries are called upon to apply counter-measures to protect the international financial system from the ongoing money laundering, terrorist financing, and proliferation financing risks emanating from the country.
Both lists concern deficiencies. What separates them is cooperation — a grey-listed country has committed to resolve swiftly the identified strategic deficiencies within agreed timeframes.
Publication schedule: FATF identifies these jurisdictions in two FATF public documents/statements that are issued three times a year.
And the process works: the FATF's process to publicly list countries with weak AML/CFT regimes has proved effective.
Why it matters to a reporting entity. Rule 9(2)(d) of the PML Rules permits reliance on a third party only where the third party is not based in a country or jurisdiction assessed as high risk, and Rule 9(13) requires a risk assessment covering countries or geographic areas.
Where this is taught
Free preparation for NISM Series XXIVRelated terms
- Clients of Special CategoryA named list of client types — NRIs, HNIs, trusts, NGOs, PEPs, non-face-to-face clients and others — on whom SEBI requires enhanced due diligence rather than the ordinary standard.
- Client Due DiligenceScreening and verifying a client using reliable, independent sources — identity, beneficial owner, purpose of the relationship — and then continuing to scrutinise it for as long as it lasts.
- FATF black listThe informal name for FATF's public statement of jurisdictions with serious strategic AML/CFT/PF deficiencies, on which FATF calls for enhanced due diligence and, in the most serious cases, counter-measures.
- FATF grey listThe informal name for FATF's list of jurisdictions under increased monitoring — countries working with FATF that have committed to fix identified strategic deficiencies swiftly within agreed timeframes.
- UNSC sanctions listsThe UN Security Council's ISIL (Da'esh) & Al-Qaida Sanctions List and 1988 Sanctions List — no IFSC regulated entity may hold an account in a listed name, and resembling accounts go to FIU-IND and MHA.
- Risk Based ApproachApplying each due diligence measure in proportion to the money-laundering risk a client poses — enhanced diligence for higher-risk clients, simplified for lower-risk, never simplified where suspicion exists.
- Financial GroupA parent company, or other legal person exercising control and coordinating functions, together with the branches and subsidiaries that are subject to AML/CFT policies and procedures at group level.