A BSA/AML risk assessment where every rating opens the data behind it
The annual risk assessment built in days, every rating cited, refreshed each quarter.
See one case, screen by screen ↓A BSA/AML risk assessment is a bank's written reading of where money laundering and terrorist financing risk sits in its products and services, customers and entities, geographies and delivery channels (and, at a sponsor bank, its fintech partner programs), how strong its controls are, and what risk is left. Examiners start every BSA/AML exam from it. BSA/AML Risk Assessment builds it with agents that pull the data, score inherent risk and controls with the bank's own methodology, draft the narrative with a citation on every figure and challenge the draft; the BSA Officer, the BSA Committee and the board decide.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
The BSA/AML risk assessment is the bank's own reading of where money laundering and terrorist financing risk sits in its products and services, customers and entities, geographies, delivery channels and, at a sponsor bank, its fintech partner programs; how strong the controls are; and what risk is left. Examiners start every BSA/AML exam from it. At most community banks it is still rebuilt each fall in a spreadsheet: an analyst copies counts from the core, monitoring, case management, the ledger, the partner files and the board portal, and the source is rarely written down.
Then the BSA Officer edits last year's narrative, and last year's sentences survive into the board pack. When examiners ask why a row is what it is, the data has to be there, and a sponsor bank's partner programs can double inside a year. FinCEN's April 2026 proposal would make a risk assessment process part of every AML/CFT program and ask for prompt updates when the risk profile changes significantly, which a once-a-year spreadsheet cannot show.
Estimated split for the annual assessment at a community bank with 112 data points in six systems: about five weeks by hand, and the four-day target with the solution.
Seven agents pull, score, draft and challenge the assessment; the BSA Officer submits, and the committee and the board approve.
Tessaly Community Bank, a $3.4 billion bank with 41 branches and a sponsor bank for fintech partner programs, builds its 2026 BSA/AML risk assessment with data as of September 30, 2026. Here is what happens, screen by screen, in the working solution.
The Data Gatherer pulls 112 data points from six systems: 48 from the core banking system, 17 from transaction monitoring, 9 counts from case management, 19 from the general ledger, 15 from the partner records and 4 from the board portal. The Risk Scorer scores 38 categories with Methodology v4, the Control Assessor rates 41 controls (14 Strong, 24 Adequate, 3 Needs improvement), and the Narrative Writer drafts nine sections. The Challenger finds 7 claims out of date, and the draft goes to the BSA Officer.
The Data Gatherer reads SAR figures as counts only, and never estimates a missing value: it marks it provisional for the analyst.
Each row reads inherent risk, control strength and residual risk. Fintech partner programs reads High → Adequate → Moderate-High, up from Moderate; products and services and delivery channels rose too. Customers and entities and geographies are unchanged, and overall residual risk stays Moderate. Above the rows, the path to the board: Drafted, BSA Officer reviewed, Committee reviewed, Board approved.
Next step: the challenger says §5 still reads “six partner programs”; the register says 11.
Renee clicks High on fintech partner programs. The panel shows why: the program book nearly doubled, to 11 programs, 214,000 end customers and $1.9 billion of ACH a month, with 44% of monitoring alerts. A weighted score of 4.6 of 5 under the bank's methodology, last year Moderate-High, confidence 0.96, and all 24 data points with this year's and last year's values.
Every one of the 15 rating words on the five rows opens its data, its rule and its sources.
A citation opens the record a figure came from: the partner program register, exported September 30, 2026, with the 11 active programs named and the count highlighted. Owen confirmed all 112 data points against their sources on October 16.
“Pulled by the Data Gatherer, read-only connection, kept five years.”
Deposit and card programs and payments programs read High → Adequate → Moderate-High; lending programs read Moderate → Strong → Low. The partner performs CIP in 7 of the 11 programs, and partner data feeds and monitoring is the control that needs improvement. Below, the 11 sponsored programs with their end customers and monthly ACH, the largest at 48,000 end customers and $120 million a month.
The challenger read the draft against last year's board-approved assessment, the FFIEC manual and FinCEN's publications. Of its seven claims, Renee has accepted five fixes, one after editing it, and dismissed one with the reason code “Claim still accurate”: the eight national priorities have not been revised. One is open. §5 still says “Tessaly sponsors six fintech partner programs, serving about 88,400 end customers,” carried from 2025, while the register shows 11 programs and 214,000 end customers.
The challenger never edits the draft. Sign-off stays closed while a claim is open.
Renee accepts the fix. §5 now reads “Tessaly sponsors eleven fintech partner programs serving 214,000 end customers, with $1.9 billion of ACH a month,” cited to the register, the partner files and the payments hub, and marked with what changed and who changed it. Program activity produced 4,310 of 9,840 monitoring alerts and 61 of 138 SARs, shown as counts.
The Narrative Writer never writes a figure without a citation, and never mentions an individual SAR or customer.
Each of the three controls rated Needs improvement has a plan with an owner and a due date: partner data feed exceptions tracked to closure by December 18, instant payment scenarios validated and tuned by January 29, a liveness check on online account opening by February 26. Last year's plan to finish site visits for money services businesses is 22 days overdue with 20 of 23 done, so it was escalated to Graham.
A due date never moves without the checker.
With 7 of 7 challenges resolved, 112 of 112 data points confirmed and 41 of 41 controls rated, Renee submits the assessment and the committee pack goes to Graham Okafor for the BSA Committee. Acting as Renee, the approve button stays locked, and the screen says why.
“You submitted this draft. A maker cannot approve her own work.”
After the committee's review on November 10, Judith reads the board view: overall risk unchanged, three areas that rose and why, three new action plans, one late plan escalated to the Chief Risk Officer, and seven out-of-date statements found and resolved. Her questions to the agents are answered with citations and go into the minutes record, and she records the board's approval.
“Our overall risk is unchanged.”
The same assessment, seen by the five people who carry it from the agents' draft to the board's vote: what their fall looked like, and what it looks like now.
Seven agents pull, score, draft and challenge the assessment; the BSA Officer submits, and the committee and the board approve.
Pulls the 112 data points from six systems as of the assessment date, and records the system, the record and the passage of each.
Scores inherent risk for 38 categories with the bank's own methodology and rolls them into five rows, explaining each level in one sentence that names the data points behind it.
Rates 41 controls from control tests, QA results, the independent test and exam findings, applies the residual matrix and proposes action plans.
Drafts the nine-section narrative from the data points, the ratings and last year's assessment, with a citation on every figure.
Reads the draft against last year's approved assessment, the FFIEC manual, FinCEN's priorities and the April 2026 proposal, and lists every claim that is out of date with the evidence and a proposed fix.
Each quarter and on events such as a new partner program, checks every data point against its change threshold, reruns only the categories that moved, and runs what-ifs.
Assembles the assessment and everything behind it for examiners, internal audit or the BSA Officer, and seals it with a manifest.
Resolves every challenge and submits; never approves her own work. The agents propose; a named person decides.
The BSA Officer, the analyst and board members can ask the agents about the assessment in plain words. Every answer cites where it came from.
Why did fintech partner programs rise to Moderate-High?
The program book nearly doubled in a year: 11 programs, 214,000 end customers and $1.9 billion of ACH a month. Program activity produced 4,310 of 9,840 monitoring alerts and 61 of 138 SARs. Inherent risk is High (score 4.6); controls stay Adequate, so the matrix gives Moderate-High. One control needs improvement: partner feed completeness, 94.1% on time.
Which rows rose since 2025?
Three rows rose: products and services (instant payments since March 9, 2026), delivery channels (two controls need improvement) and fintech partner programs (11 programs, up from 6). Customers and geographies are unchanged. Overall residual risk stays Moderate, as in 2025.
Are we taking on too much partner risk?
Partner programs are now the bank's highest inherent risk, but program limits held with no breaches and 10 of 11 partner reviews are current. The gap is feed completeness, 94.1% on time, with a plan due December 18. The committee can set a cap on new programs until that plan closes.
What did the independent test find last time?
The April 2026 independent test rated the program Satisfactory with two findings: instant payment monitoring not yet in place, and partner feed exceptions not tracked to closure. Both are now action plans, AP-2026-01 and AP-2026-03.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rules every assessment is scored, refreshed and approved by are settings. A change to them is proposed, approved and versioned like the assessment itself.
| Setting | Default | Choose from |
|---|---|---|
| Methodology and row weights | Version 4: products and services 25%, customers and entities 25%, fintech partner programs 25%, delivery channels 15%, geographies 10% | The administrator proposes a change; the Chief Risk Officer approves it as a new version, and the agents rescore on the next run |
| Scales and residual matrix | Inherent risk on five levels, Low to High; control strength Strong, Adequate, Needs improvement or Weak | Residual risk read from the bank's own matrix of inherent risk against control strength |
| When a data point moves | A change of 15% or more | Any change for partner programs and products · partner feeds on time below 96% |
| Cycle | Annual, as of September 30 | Quarterly refresh in January, April and July, and on events such as a new partner program or product |
| Confidence threshold | 0.80 | 0.90 for SAR and partner figures · below the threshold, the value goes to the analyst |
| Reason codes for overrides and dismissals | Claim still accurate · Known event after the as-of date · Data timing | Methodology judgment · Compensating control not in the library · Duplicate challenge |
| Clocks and escalations | Committee pack 5 business days before the meeting | Control attestations 8 days after the request · action plans escalate to the Chief Risk Officer after 14 days overdue · quarterly refresh within 15 business days of quarter end |
| Retention and redaction | Five years under 31 CFR 1010.430; customer names redacted in exports | SAR figures counts only, locked · board and committee views aggregated figures only · connections to systems of record read-only |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate from the work steps, with the split shown · “typical” = published figures (FinCEN proposed AML/CFT program rule, April 7, 2026, not final: a risk assessment process evaluating products, services, distribution channels, customers and geographic locations · FinCEN AML/CFT National Priorities, June 30, 2021 · FFIEC BSA/AML Examination Manual, BSA/AML Risk Assessment, revised February 27, 2020 · 31 CFR 1020.210, 12 CFR 326.8 and 31 CFR 1010.430). The bank, the partner programs, the people and every figure on the screens are fictional: characters and sample data in the working solution.
A BSA/AML risk assessment is a bank's written reading of where money laundering and terrorist financing risk sits in its products and services, customers and entities, geographies and delivery channels (and, at a sponsor bank, its fintech partner programs), how strong its controls are, and what risk is left. Examiners start every BSA/AML exam from it. BSA/AML Risk Assessment builds it with agents that pull the data, score inherent risk and controls with the bank's own methodology, draft the narrative with a citation on every figure and challenge the draft; the BSA Officer, the BSA Committee and the board decide.
The FFIEC manual asks the bank to identify its specific risk categories: products, services, customers, entities, transactions and geographic locations. In the working solution they sit in five rows (products and services, customers and entities, geographies, delivery channels and fintech partner programs) holding 38 categories, from domestic wires and money services businesses to reliance on a partner's CIP. The rows, categories and weights are the bank's own.
Inherent risk is the risk a product, customer group or channel carries before controls; residual risk is what is left after them. Each row reads the two with control strength between them, for example High → Adequate → Moderate-High, and residual risk comes from the bank's own matrix. The BSA Officer can override a residual rating with a reason code, and the override shows on the row and in the audit trail.
The FFIEC manual expects it to be kept current, and FinCEN's April 7, 2026 proposal, not yet final, would require prompt updates when the risk profile changes significantly. The solution builds the annual assessment and refreshes it each quarter, rerunning only the categories whose data moved past a threshold, and an event such as a new partner program triggers a what-if. A refresh that moves a row goes back to the committee.
Yes. The rows, categories, weights, scales, residual matrix and change thresholds are the bank's methodology, set by the administrator. A change is approved by the Chief Risk Officer and becomes a new methodology version, and every rating names the version that scored it.
Yes. The agents pull, score, draft and challenge; they never submit or approve. The BSA Officer resolves every challenge and submits as maker, the BSA Committee and then the board approve, and a maker cannot approve her own work. Dismissals and overrides need a reason code.
SAR figures appear only as counts, never case detail, and never on a customer-facing view; the setting is locked. Customer names are redacted in exports by default, board and committee views show aggregated figures, and connections to the systems of record are read-only. Versions, sources and approvals are kept five years.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as last year's assessment, your methodology and your control library, and it goes live once every quality gate has passed. We will walk you through it on your own assessment first.
Every subject searched and proven, every true match replied to inside the 14 days.
1-min demoBaaS ComplianceEvery fintech partner tested every quarter and tied out every day, with the evidence.
1-min demoBSA/AML Manual SearchCited BSA answers in under a minute, with your own procedure beside the rule.
1-min demoWe'll build BSA/AML Risk Assessment from last year's assessment and your methodology, so you can compare its draft with the one your team wrote.