Risk analysis under the AMLR: Why the data basis is becoming more of a focus

The analysis of risks within a company is defined in Article 10 of the AMLR (Association of Management by Risks and Risks in the Globally Oriented and Risk-Based Management). Further details are provided in the draft Guidelines on Business-Wide Risk Assessment. The basic logic is well-established: First, the company-specific situation is assessed. Then, inherent risks are identified and evaluated, the quality of existing controls is examined, and the remaining risk is determined. Finally, areas for action and specific measures are derived from the results.

Even for the initial assessment, a comprehensive picture of the company is needed. This includes, among other things, information on the customer base, products and services, distribution channels, geographic exposure, the organization of anti-money laundering measures, and outsourcing.

This quickly makes it clear why data quality is relevant for risk analysis. Information doesn't just need to be available; it must be structured in such a way that a reliable picture of one's own risk situation can be derived from it.

Customer Risk Rating and risk analysis are related

The link between company-wide risk analysis and individual customer risk rating is particularly important. Various risk factors and customer information are used to assess individual customers. At the same time, the customer base assessments provide important insights into the company-wide risk situation.

The relationship thus works in both directions: Risk analysis provides the framework for classifying individual customer risks. The information from individual customer relationships, in turn, shapes the overall risk profile of the company.

For both assessments to be meaningfully integrated, a unified customer database is needed. Customer characteristics and risk factors should be available in such a way that they can be used for both individual and company-wide risk assessments.

The same data will also be relevant for supervision.

In addition to company-wide risk analysis, supervision is also becoming more data-driven. The Draft RTS on risk assessment (under Article 40(2) of AMLD6 and under Article 12(7) AMLAR) are part of the supervisory component of the EU AML package. They provide for comprehensive annual data reporting and simultaneously establish a methodological framework for how the reported information is used for a company's risk assessment.

This involves significantly more than just individual customer data. Information collected includes details about customers, products and services, geographical risks, distribution channels, and security measures. Based on this, the supervisory authority first assesses a company's inherent risks. It then examines the quality of the measures in place and derives the remaining risk from this assessment.

This is relevant for risk analysis under AMLR because the draft guidelines for company-wide risk analysis rely on this data. When identifying and assessing inherent risks, at least the relevant data points from the Draft RTS on risk assessment (under Article 40(2) of AMLD6 and under Article 12(7) AMLAR) should be considered. This creates a direct link between internal risk analysis and regulatory risk assessment.

For companies, this means that some of the information collected for regulatory reporting may also be relevant for their own risk analysis. This makes a consistently structured database that can be used for various analyses all the more important. This is precisely where KYC, risk analysis, and data-driven supervision intersect.

What role KYC data plays in this

Many of the customer and structural data relevant for risk assessment are already generated during the KYC process. These include, for example, company master data, shareholding information, customer characteristics, and data from the determination of beneficial ownership.

This information is initially collected for the verification and evaluation of individual customers. Once structured, it can also be used for aggregated analyses of the customer base. This is precisely the link between KYC and risk analysis. Individual KYC data points become components of a comprehensive risk assessment.

KYC data alone does not cover all information needs. Transaction data, product information, or details of internal controls can originate from other systems. Therefore, the crucial factor is how the various data sources are combined.

What companies can check now

Preparation for the AMLR can therefore begin with the existing database.

Four questions are particularly helpful in this regard:

• What customer-related data is needed for customer risk rating and company-wide risk analysis?
• Is this information up-to-date, structured, and recorded consistently across the entire customer base?
• Do Customer Risk Rating and Risk Analysis use the same definitions and risk characteristics?
• What data is already available and what data needs to be supplemented from other systems?

Especially with larger databases, missing or inconsistent information can later lead to significant processing efforts. Early analysis of the KYC database reveals where data gaps exist and which information needs updating.

KYC data as a basis for AMLR preparation

KYCnow can automatically collect and provide a wealth of customer-related and organizational information in a structured format. This includes, among other things, company master data, shareholding information, and data for determining beneficial ownership. The main benefit for risk analysis lies in this structured availability. Data that is collected and maintained accurately during the KYC process can be more easily used for further analyses and risk management processes.

AMLR preparation is therefore not solely a matter of new processes. Existing data also deserves attention. Creating transparency today regarding data quality, data gaps, and differing definitions lays an important foundation for customer risk rating, risk analysis, and future reporting.