A BSA/AML risk assessment template is a ready-made structure of risk categories, scales and a residual matrix that a bank fills in to produce its institution-wide money laundering risk assessment. No regulator publishes one. The FFIEC BSA/AML Examination Manual says "various methods and formats may be used" and "there is no expectation for a particular method or format" (FFIEC, BSA/AML Risk Assessment), so templates come from associations, consultants, software vendors and banks' own past work. Choosing one is really choosing an approach: fill in a spreadsheet, hire a consultant, buy packaged software, or have agents draft the assessment from the bank's own data, as Botminds' BSA/AML Risk Assessment does. Each leaves a different amount of work, and a different kind of evidence, with the BSA officer.
The comparison below uses a fictional sample bank, Tessaly Community Bank, a $3.4 billion sponsor bank whose assessment draws on 112 data points in six systems. Effort figures are our estimates, said so where they appear; the agent figures are the solution's sample results and design target.
Four ways to build the same assessment, compared on one sample bank
| Approach | Who gathers the data | Repeatability | Evidence an examiner can follow | What it leaves the BSA officer |
|---|---|---|---|---|
| Spreadsheet template | Bank staff copy every figure by hand; our estimate for the sample bank is about 25 working days in all | Depends on who fills it in; weights and formulas drift between versions | Whatever staff wrote down about sources, often nothing | Everything: gathering, scoring, writing, checking |
| Outside consultant | Mostly still bank staff, answering the consultant's data request | Good within one engagement; method may change with the firm | The consultant's workpapers, if the bank keeps them | Owning ratings it did not score, and the next refresh |
| Packaged questionnaire or scoring software | Staff enter values; some tools import files | High for the scoring step; inputs still vary | Scores and their weights; sources only if entered | Gathering, citing, writing the narrative |
| Agent-built draft (BSA/AML Risk Assessment) | Agents pull from read-only connections with a citation on each figure; the analyst confirms | High: the same written method on the same data gives the same score | Every rating opens its data, rule and source passage | Judgement: overrides, challenges, submission; design target four days |
Is there a BSA/AML risk assessment template?
There is no official template. The closest thing the regulators publish is the FFIEC's Appendix J, a quantity of risk matrix that describes low, moderate and high inherent risk for factors such as the customer base, electronic banking, funds transfers and geography, which "banks and examiners may use to formulate summary conclusions" (FFIEC Appendix J). It covers the inherent side only and was written for a deposit bank; it says nothing about control strength, residual risk or how to weight the factors.
What the manual does set is a standard for whatever format the bank picks. The assessment should identify the bank's specific risk categories and analyze the data within each. Sound practice, the manual adds, is to record the factors considered and how they were weighted, to put the whole assessment in writing, and to share it with the business lines, the board, management and staff. A template is good if it makes those things easy and bad if it lets them be skipped.
What is a BSA/AML risk assessment matrix?
A BSA/AML risk assessment matrix is the grid at the center of most templates: inherent risk on one axis, control strength on the other, and the residual rating where they meet. A five-level inherent scale against a four-level control scale gives twenty cells, each holding a residual rating the bank has decided in advance. High inherent risk with Adequate controls reading Moderate-High, as at the sample bank, is one such cell.
Matrices are simple to use and easy to over-trust. Research on risk matrices in the journal Risk Analysis found that they can give the same rating to very different risks, and that different users can rate the same risk in opposite ways (Cox, 2008). The fix is not to abandon the matrix but to define each level by data the bank holds, which is the subject of inherent and residual risk in AML.
Excel vs software for AML risk assessment
A spreadsheet is the right tool when the bank's book is small and stable and one careful person keeps it; software earns its place when data sits in several systems, the book moves within the year, or more than one person scores. The new model risk guidance is no reason to avoid either: the agencies' April 2026 guidance leaves spreadsheet arithmetic out of its definition of a model and places generative and agentic AI outside its scope (OCC Bulletin 2026-13). The choice is about effort and evidence.
Spreadsheet template or agent-built assessment, row by row
Spreadsheet template: Staff copy counts from each system and paste them in; the source is a note, if anyone writes one.
Agent-built draft: Agents pull each figure as of the assessment date and keep the system, the item and the passage it came from.
Spreadsheet template: Formulas apply the weights, until someone overwrites a cell or a row is added below the range.
Agent-built draft: The bank's written methodology, versioned; a change needs the chief risk officer's approval.
Spreadsheet template: Last year's document, edited; old sentences survive.
Agent-built draft: Drafted from this year's figures with a citation on each, then checked against last year's approved version.
Spreadsheet template: The BSA officer reconstructs the answer from tabs and emails.
Agent-built draft: The rating opens its weighted score, its data with last year's values, and the sources.
Spreadsheet template: Usually waits for next year's rebuild.
Agent-built draft: A quarterly refresh reruns only the categories whose data moved past a threshold.
Spreadsheet template: Staff time, which for the sample bank we estimate at about 25 working days a year.
Agent-built draft: A subscription and set-up, plus the officer's review; the design target is four days a year.
Community banks already split on this. In the Conference of State Bank Supervisors' 2025 survey, 34.3% met their BSA/AML technology needs in-house, 47.8% through a combination of in-house and third-party tools, and 17.9% through a third party (CSBS, 2025 Annual Survey of Community Banks). The survey does not break out the risk assessment, but the pattern is familiar: monitoring is bought, and the assessment that steers it is often still a spreadsheet.
Should a bank hire a consultant for its risk assessment?
A consultant is worth hiring when the bank lacks the expertise to design a method or needs an outside view after a finding, and less so as a yearly substitute for owning the assessment. A consultant brings a method and experience across banks. It does not bring the bank's data, which staff still have to gather, and it does not stay to refresh the assessment when a new product launches in March.
One limit is structural. The firm that builds the assessment should not also be the one that tests it. The FFIEC manual expects independent testing to review the risk assessment and how the bank used it to build the compliance program (FFIEC, BSA/AML Risk Assessment), and FinCEN's April 2026 proposal, not yet final, would require testing "conducted by individuals or parties who are truly independent of the AML/CFT function" that "avoid conflicts of interest" (FinCEN fact sheet, April 2026). A consultant who wrote the ratings cannot independently judge them.
Bank management designs the appropriate method or format and communicates the ML/TF and other illicit financial activity risks to all appropriate parties.
FFIEC BSA/AML Examination Manual, BSA/AML Risk Assessment
Whatever the approach, that sentence decides who owns the result. A consultant, a vendor or an agent can do the work; management designs the method and the BSA officer answers for every rating in it.
What does an AML risk assessment example look like? One row, worked
A complete row shows the data, the inherent rating and why, the controls and their evidence, the residual rating, the sentence the board reads and the plan for any weakness. Most templates have cells for the ratings; fewer have room for the rest. Here is the sample bank's fintech partner programs row, as it appears in the solution.
An AML risk assessment example: one row, every part filled in
| Part of the row | The sample bank's fintech partner programs |
|---|---|
| Data, this year against last | 11 programs (6 last year); 214,000 end customers (88,400); $1.9 billion of ACH a month; 4,310 of 9,840 monitoring alerts and 61 of 138 SARs from program activity, shown as counts |
| Inherent risk and why | High: weighted score 4.6 of 5 under methodology version 4, across five categories; the partner performs identity verification in 7 of 11 programs |
| Controls and their evidence | Adequate overall across seven controls; partner data feeds and monitoring rated Needs improvement, with feeds 94.1% on time; 10 of 11 partner reviews current |
| Residual risk | Moderate-High, read from the bank's matrix; up from Moderate last year |
| The sentence the board reads | "Tessaly sponsors eleven fintech partner programs serving 214,000 end customers, with $1.9 billion of ACH a month," cited to the partner register, the partner files and the payments hub |
| The plan for the weakness | Track every partner data feed exception to closure: owner named, due December 18 |
The row also shows why the narrative needs checking. The draft first carried last year's sentence, "Tessaly sponsors six fintech partner programs, serving about 88,400 end customers," while the partner register showed 11 programs and 214,000. The challenger caught it, and the BSA officer accepted the fix. In a spreadsheet template, that sentence would have reached the board.
BSA/AML Risk Assessment: the narrative, every figure cited
What the best BSA risk assessment template has that most don't
The best template is the one that makes the FFIEC's expectations hard to skip: documented factors and weights, both steps of the analysis, and a trail from every rating to its data. Most downloadable templates supply categories and a matrix. The items below are what separates a template that survives an examination from one that only fills a binder.
What a BSA/AML risk assessment template should contain
- The bank's own categories, built from its general ledger
Not a generic list; a missing product line is the most expensive gap.
- Written definitions for every level of every scale
Thresholds on named data points, so two reviewers score alike.
- Weights, written down
The FFIEC calls documenting the factors and any weighting sound practice.
- A source for every figure, and an as-of date
System, report and date, so the figure can be reproduced.
- Last year's value beside this year's
So every movement, and every non-movement, is visible.
- Control ratings with dated evidence
Test, finding and date for each control, not a description.
- A narrative tied to the figures
Sentences that quote the current numbers, not last year's.
- Action plans with owners and dates
For every control rated below Adequate.
- A change log and approvals
Who changed which rating, when and why, and who approved the result.
Where BSA/AML Risk Assessment fits, and where a template is enough
A template is enough for a bank with a few products, one or two systems, a stable book and a BSA officer who can rebuild the assessment in a couple of weeks and explain every cell. FinCEN's April 2026 proposal supports that choice in so many words: community banks may assess risk from their staff's direct knowledge of products, customers and markets rather than from elaborate models, and the proposal requires no particular technology (91 FR 18704).
BSA/AML Risk Assessment fits where the template breaks: data in several systems, a book that moves within the year, partner programs or new channels, an examiner who asks "why" row by row, and a board that needs the answer in ten minutes. It runs the bank's own methodology, drafts with a citation on every figure, challenges the draft against last year's approved version and the regulators' current texts, refreshes only what moved each quarter and leaves every decision with named people. It is not a fit for a bank that has not written its method down; that comes first, and the inputs to gather before a BSA/AML risk assessment tool lists what it takes. What the agents may and may not decide is set out separately.
What the board reads, built from the same assessment
To compare the approaches on your own assessment, start from last year's version and your methodology in BSA/AML Risk Assessment.
Questions people ask
Is there a BSA risk assessment template PDF from the FFIEC?
No. The FFIEC manual sets no required format, and its Appendix J quantity of risk matrix, which describes low, moderate and high inherent risk for several factors, is the nearest official tool. Templates in circulation come from associations, consultants, vendors and banks.
What should an AML risk assessment template in Excel include?
At minimum: the bank's categories, the data for each with its source and as-of date, written definitions of each rating level, the weights, control ratings with dated evidence, a residual matrix, last year's values for comparison and a change log. Protect the formulas, because an overwritten cell is the commonest way a spreadsheet's scoring drifts.
How long does a BSA/AML risk assessment take to complete?
It depends on the bank's size and systems. For the sample bank, a $3.4 billion sponsor bank with 112 data points in six systems, our estimate is about 25 working days by hand, most of it copying, against a design target of four days with BSA/AML Risk Assessment. A small bank with a few products may need far less.
Can the same firm build our risk assessment and do our independent test?
It should not test work it built. The FFIEC manual expects independent testing to review the risk assessment, and FinCEN's April 2026 proposal would require testers who are truly independent of the AML/CFT function and free of conflicts of interest. Many banks use one firm to advise and another to test.
Does the bank's risk assessment need to follow Appendix J?
No. Appendix J is an aid that banks and examiners may use to summarize inherent risk; the manual says there is no expectation for a particular method or format. Examiners may refer to it when they have to develop an assessment for a bank whose own is missing or inadequate.
Will examiners criticize the format we choose?
Not for the format itself. The FFIEC manual says that when a bank has an appropriate risk assessment process and follows its own policies, examiners should not criticize individual risk or process decisions unless they affect the program's adequacy or compliance. What draws criticism is an assessment that misses the bank's business or cannot show where its ratings came from.