How is a risk assessment kept up to date, and how long must AML records be kept?

Risk management is a continuous process, not a one-off exercise. Customers' activities change, the firm's services and instruments change, and so do the methods criminals use. The firm must therefore keep checking whether its measures and procedures are working and still suit the level of risk it has assessed, and keep its business-wide and individual risk assessments current.

Information from monitoring feeds back into the assessment. When a customer's transactions or circumstances change, the firm considers whether the customer's risk rating and the CDD measures that go with it should change too, proportionately to the risk. Transaction monitoring itself, and the events that trigger a fresh review of customer data, are part of ongoing CDD.

Changes to risk assessments are documented, so that the firm can show its supervisor that its assessments and the resulting controls are adequate.

Firms need systems and controls that pick up emerging risks quickly, so that both the firm-wide assessment and individual customer ratings can be updated in good time. Useful controls include alerts on changes to sanctions lists, screening customers against a reputable database at regular intervals, reviewing media reports relevant to the firm's sectors and jurisdictions, following publications by the authorities, and attending relevant seminars and training.

Alerts and typology reports from MOKAS or the supervisor are a good example. They are new risk information: the firm builds them into its own controls and customer ratings, for example with targeted checks where the pattern fits, and reports when it has an actual suspicion.

An obliged entity keeps a copy of the documents and information needed for CDD, including information obtained through electronic identification, the evidence and records needed to identify transactions, and relevant correspondence with customers and others it has a business relationship with. They are kept for 5 years after the business relationship ends or after the date of the occasional transaction.

At the end of that period personal data is deleted, unless another law provides otherwise. Where further retention is reasonably justified for preventing, detecting or investigating money laundering or terrorist financing, the records are kept for up to 5 more years. CySEC's Directive adds that records relevant to an ongoing investigation are kept until MOKAS confirms that the case has been closed.

Records may be held electronically, other than originals or certified copies kept on paper, provided they can be retrieved without undue delay. They must be made available to MOKAS and the supervisor promptly and without delay on request. Firms also need systems that let them answer, fully and quickly, enquiries from MOKAS or their supervisor about whether they have had a business relationship with specified persons during the previous 5 years, and what kind of relationship it was.