The firm's AML risk assessment

The Anti-Money Laundering Act, 2020 (Act 1044) asks the firm to assess where it is exposed to money laundering and to keep that assessment up to date. Compliance, Risk assessment keeps every version of the firm's assessment.

Start the assessment

Start the assessment opens the first version with a line for each kind of client (individuals, organisations, politically exposed persons), Ghana and every other country, each way clients reach the firm (in person, never met, through an intermediary), and each of the firm's matter types with the risk band it already carries. Add a line for any other country with Add line, choosing it from Country. A line's risk after controls is never higher than its risk before them: controls only lower a risk.

Each line has three parts:

• Risk before controls: low, medium or high.
• Controls: what the firm does about it, such as verifying identity against the Ghana Card or asking for the source of funds.
• Risk after controls: the rating left once the controls are applied.

Edit the summary in the version's menu holds the firm's overall reading.

Approval by the managing partner

Submit for approval is refused while any line names no controls, or while a kind of client, service, country or channel has no line. A submitted version waits in the approver's Approvals inbox. Whoever holds risk_assessment.approve, the managing partner by default, then chooses Approve, with a note, or Return, with what to change. Nobody approves or returns a version they prepared or submitted themselves.

An approved version takes effect that day, its overall rating is its worst line after controls, and the version before it is superseded. Approved and superseded versions cannot be changed, not even directly in the database.

Reviews

The review falls due the firm's Risk assessment review period (months) after approval, 12 by default; the preparers and approvers are reminded on the firm's Risk assessment review reminders (days before). A matter type the firm rates high that the version in force does not read is a change in the firm's profile: whoever prepares the assessment is told, it is named above the register, and the dashboard turns amber until a new version reads it. Start the next version copies the version in force.

How it reaches client risk

The ratings of the version in force are read when a KYC record suggests a client's risk: the line for the kind of client, the country (or every other country), the matter type and the channel each add their rating after controls, named in the suggestion's reasons.

Export

Export on an approved or superseded version gives a dated PDF or CSV of every line, with who approved it and when and its review date. The export is audited.