Assessing and Managing Risks

16 free CySEC AML Chapter 5 flashcards. Tap a card to flip, or use the arrow keys to move through the deck.

Card 1 of 16Risk-based approach

1 / 16

Tap the card to flip · use ← → arrow keys to navigate

All 16 cards in this deck

What does the risk-based approach require?: Effort proportionate to the nature and size of the firm, concentrating controls and resources where ML/TF risk is highest.
Which authority leads AML/CFT coordination and the Risk Factors Guidelines from 1 January 2020?: The EBA (European Banking Authority), until the end of 2025. On 1 January 2026 the EU Anti-Money Laundering Authority (AMLA) took over; the EBA guidelines stay in force until AMLA replaces them.

What are the two steps of assessing ML/TF risk?: First identify the risks the firm is exposed to, then assess their level — both are needed.
How current must the firm's risk assessment be?: Updated and under ongoing review — risk is not static, so controls must keep fitting the actual level of ML/TF risk.

What are the four categories of AML risk factor?: Customer, country/geography, product/service/transaction, and delivery channel.

What are the three standard risk levels and their CDD responses?: High (EDD + enhanced monitoring), medium/normal (standard CDD under Article 61(1)), and low (SDD).

Which situations are mandatorily high-risk by law?: A PEP customer or beneficial owner, and a link to a high-risk third country; EDD applies regardless of the firm's own score. Exam material: a customer based in a high-risk third country. Since 23 February 2021: any business relationship or transaction involving one, wherever the customer is based.

Does simplified due diligence remove CDD?: No — SDD adjusts the amount, timing or type of CDD to fit low risk, but never removes it entirely.

What is the main driver of delivery-channel risk?: Distance — non-face-to-face onboarding, and the use of introducers or intermediaries.

What is the baseline record-retention period, and how far can it extend?: 5 years after the end of the relationship or occasional transaction, extendable by up to a further 5 years (10 total) where justified for ML/TF purposes.

Which article requires ongoing transaction monitoring?: Article 61(1)(d) of the AML/CFT Law.

What makes a risk-weighting methodology sound?: No single factor disproportionately dominates, profit must not influence the rating, and the model must always be capable of producing a high-risk result.

Which geographies are higher-risk?: Sanctioned countries, those with strategic AML/CFT deficiencies, significant corruption, or terrorist links.

When must records be produced to the Unit or Supervisory Authority?: Upon request and without delay.

Is EDD a replacement for regular CDD?: No — EDD is always applied in addition to normal CDD, never as a substitute.

On what does customer risk turn?: The customer's activity, reputation, and nature/behaviour — for example demands for unnecessary secrecy or unexplained wealth raise risk.