Most institutional risk assessments end where they should begin: on the heat map.
Customers, products, channels and geographies are scored. Inherent risk is set against controls. Residual risk lands in a matrix, and the board approves the document. Then the institution does next year what it did last year. The assessment described the exposure accurately and decided nothing.
The scores are the middle, not the end
This guide’s position: an institutional ML/TF/PF risk assessment is judged by the decisions it changed. Every residual risk rated High leaves the assessment with a decision attached, and the decision is one of three: reduce it, accept it within a named limit, or stop doing the activity. An assessment that leaves High residual risks without a decision is incomplete, however rigorous the scoring.
The law points the same way. Regulation 7(2)(b) of the Proceeds of Crime and Anti-Money Laundering Regulations 2023 requires an institution to consider all relevant risk factors “before determining what is the level of overall risk and the appropriate level and type of mitigation to be applied”. The scoring exists to set the mitigation. Regulation 7(3) then requires board-approved policies, controls and procedures built “on the basis of the results of the assessment”.
What the rules require
| Source | Requirement |
|---|---|
| POCAMLA Regulations 2023, reg 7(1) and (2) | Every reporting institution assesses its ML, TF and PF risks; documents the assessment; considers customers, countries, products, services, transactions and delivery channels; keeps it up to date; and can provide it to the authorities |
| Same, reg 7(3) and (4) | Board-approved policies, controls and procedures based on the results; procedures to monitor implementation of the controls and enhance them where necessary |
| Same, reg 7(5) | Update the risk assessment policies or programs regularly, at least once every two years, taking account of changes such as new markets and new products |
| Same, reg 8(2) | Assess ML, TF and PF risk before introducing a new product, business practice or technology, and document the outcome |
| CBK draft AML/CFT/CPF prudential guideline (August 2026), 5.2.1 | For Banking Act institutions, in draft: review at least every two years or earlier on material change; monitor the effectiveness of controls; submit the assessment to CBK every year |
The regulations apply to every reporting institution: banks, microfinance banks, payment service providers, money remittance providers, forex bureaus, life insurers, capital markets intermediaries and virtual asset service providers alike. The draft guideline adds detail for banks. Its list of material changes is a useful trigger list for everyone.
The decision register
The single most useful page in an institutional risk assessment is the one most of them lack: a register of what management decided for each High residual risk.
| Residual risk (High) | Decision | What changes | Owner | Date | How we will know it worked |
|---|---|---|---|---|---|
| One line per risk | Reduce, Accept or Exit | The control, criterion or limit that changes | A named executive | A date | The metric or test that proves it |
Three rules make the register honest:
- Reduce names a specific change: a control strengthened, an acceptance criterion tightened, monitoring added, staff or budget committed. “Continue to monitor” is not a reduction.
- Accept is valid only within the board’s approved appetite, signed by someone with the authority to accept it, with a limit and a review date. A legal obligation cannot be accepted away; only business risk can.
- Exit means restricting or stopping a product, channel, corridor or customer segment. It is the decision assessments avoid most, and the one that most often shows the assessment was taken seriously.
When to reopen it
Two years is the outer limit, not the cycle. Reopen the assessment when any of these happens:
- A new product, channel, technology or market goes live, under reg 8(2).
- The National Risk Assessment, a sectoral risk assessment or a typologies report identifies a risk you rated lower.
- Kenya’s status with the FATF changes. Kenya has been under increased monitoring since February 2024 and was retained at the June 2026 plenary.
- An inspection, audit or a cluster of STRs exposes a control failure inside a risk you rated Low or Medium.
- Strategy, ownership or senior management changes materially.
An assessment that decided something
An illustrative example, not a real case. A money remittance provider’s assessment rates two exposures High after controls: cash-funded outbound transfers through agents in border towns, and one high-risk corridor where most of its STRs originate.
The previous assessment rated the same exposures High and recorded “enhanced monitoring”. This time the decision register reads differently. For the agent network: reduce, by moving agents in two counties to daily rather than monthly transaction review, owned by the head of agency, with alert-closure times as the test. For the corridor: accept within a limit, with a monthly value cap per sender approved by the board risk committee and reviewed each quarter. For new agent recruitment in one county where monitoring coverage is thin: exit, with no new agents until coverage is in place.
The residual ratings barely moved on paper. The business did.
Where assessments fall short
An institutional risk assessment can be technically complete and still leave management unsure what to change. Working in banking risk and compliance, I have met assessments that spent their effort scoring customers, products, channels and geographies, then stopped short of the decisions those scores should drive. The questions that matter come after the scoring. Do the controls actually reduce the largest exposures? Where is residual risk still unacceptable? Has management responded with stronger controls, tighter acceptance criteria, sharper monitoring, more resources or limits on particular activities? The useful assessments have also tracked what changed in the business, new threats and real control failures, rather than reissuing the last cycle’s assessment with new scores. An institutional risk assessment earns its place when it changes what the institution does, strengthens and accepts, and, above all, what it declines to pursue.
Five tests before it goes to the board
- Does every High residual risk carry a decision, an owner and a date?
- Does any decision read “continue to monitor”? Rewrite it.
- Has any legal obligation been “accepted”? Remove it and fix the control.
- Does the assessment reflect the control failures, STR patterns and inspection findings of the period, or only last cycle’s scores?
- Can you name one activity the institution restricted or stopped because of it? If not, ask whether it was needed.
For what examiners ask to see during an inspection, including the risk assessment itself, see Preparing for a CBK AML inspection.
What the board should be signing
A board that approves a risk assessment is approving the decisions in it, not the methodology. Put the decision register at the front, the scoring behind it, and ask the board to approve both.
Riskill’s Enterprise-Wide ML/TF/PF Risk Assessment Pack is built for that order of work: riskilled.com/toolkits. For an independent challenge of your current assessment before it goes to the board or to CBK, talk to the advisory desk: riskilled.com/engage.