{"id":11465,"date":"2026-06-25T09:46:32","date_gmt":"2026-06-25T09:46:32","guid":{"rendered":"https:\/\/www.amlcc.com\/?p=11465"},"modified":"2026-06-23T09:46:42","modified_gmt":"2026-06-23T09:46:42","slug":"whats-meant-by-residual-risk","status":"publish","type":"post","link":"https:\/\/www.amlcc.com\/cw\/whats-meant-by-residual-risk\/","title":{"rendered":"What’s meant by residual risk?"},"content":{"rendered":"\n

What’s meant by residual risk?<\/h1>\n\n\n
\"Lisa<\/div>
Lisa Simms<\/span>

Director and Founder of AMLCC and AMLCC Consult<\/h3><\/div><\/div><\/div><\/div>\n\n\n
\"What's<\/figure><\/div><\/div>\n\n\n\n
\n
\n

\u2018Residual risk\u2019 is the level of money laundering, terrorist financing or proliferation financing risk your business faces after you have effectively applied your AML policies, controls and procedures (PCPs) which detail your risk mitigation steps.<\/p>\n\n\n\n

To be able to calculate your residual risk, you first need to have an accurate picture of your inherent risk. This is the risk presented by your business, services, delivery channels, the geographies you operate in and your clients, before any controls are applied. <\/p>\n\n\n\n

Once you understand these risks, you can then develop AML PCPs that mitigate them. <\/p>\n\n\n\n

\n

If you haven’t read our guide to inherent risk<\/a>, you should start there to understand the full process of assessing your business\u2019 risk.\u00a0\u00a0<\/p>\n\n\n\n

\n
Read it now<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n

What affects your residual risk?<\/h2>\n\n\n\n

Residual risk can change depending on how well your AML PCPs address the inherent risks your business faces and how well those PCPs are applied by staff across your business.<\/p>\n\n\n\n

FATF’s risk-based approach<\/a> guidance identifies some of the common weaknesses in the day-to-day practices of regulated businesses that make residual risk higher than risk assessments might suggest.<\/p>\n\n\n\n

Client\u00a0identity verification<\/strong><\/h3>\n\n\n\n

Identify verification<\/a> means confirming who your client is and that they are who they say they are. If the identity of the person or entity you’re dealing with hasn’t been properly established and verified, every decision you make from that point is based on an uncertain foundation.<\/p>\n\n\n\n

Beneficial ownership<\/h3>\n\n\n\n

The ultimate\u00a0beneficial owner<\/a>\u00a0of your client\u2019s business can easily be obscured through nominee arrangements and\u00a0layered ownership structure<\/a>. You need to unpick these structures and identify the natural person behind them to have an accurate idea of inherent and\u00a0residual risk.<\/p>\n\n\n\n

Ongoing monitoring<\/strong><\/h3>\n\n\n\n

Risk evolves over time, as your\u00a0client\u2019s circumstances or nature of business\u00a0\u00a0changes. FATF’s Recommendation 10 requires regulated businesses to keep client documents, data and information up to date. This ongoing monitoring<\/a> means you\u2019re aware of any changes and can update your risk assessments and AML PCPs to mitigate them.<\/p>\n\n\n\n

Risk assessment documentation<\/h3>\n\n\n\n

Business and client risk assessments that exist but don\u2019t accurately document the inherent risk and the reasoning behind your risk rating isn\u2019t enough. Inspectors and law enforcement expect you to show why your risk decisions about a client were made.<\/p>\n\n\n\n

Complacency in established relationships<\/h3>\n\n\n\n

Residual risk isn\u2019t ever lower because you have a long-standing relationship with a client. If anything, it\u2019s higher because many regulated businesses stop updating their risk assessments and ongoing monitoring because they \u2018know the client\u2019.<\/p>\n\n\n\n

What happens if your residual risk is high?<\/strong><\/strong><\/strong><\/h2>\n\n\n\n

There will be clients and situations where residual risk remains high, even after you have applied your AML PCPs. This doesn\u2019t mean you can\u2019t do business with that client. You just need to have the correct levels of mitigations in place and make sure they\u2019re being used effectively.<\/p>\n\n\n\n

Higher residual risk should trigger some form of enhanced due diligence<\/a> (EDD). This might mean:<\/p>\n\n\n\n