A BSA/AML risk assessment tool turns a bank's data into ratings: inherent risk for each product, customer type, geography and delivery channel, the strength of the controls against it and the risk left over. Whatever tool a bank chooses, a template, a scoring engine or agents, the first weeks go to the same job: finding the inputs, deciding who owns each, and knowing which system each one lives in. Botminds' BSA/AML Risk Assessment pulls those inputs itself, with a citation on each, but only from systems the bank has named and only under a methodology the bank has written. This guide is the list to assemble before any tool, ours included, can do useful work.
The counts and systems in the examples come from a fictional sample bank as it runs through the solution, Tessaly Community Bank, whose assessment draws 112 data points from six systems. The rules are the FFIEC manual's and FinCEN's, linked where they appear.
The input template: each item, its owner and the system it hides in
| Input | Usual owner | Where it usually lives | What the assessment does with it |
|---|---|---|---|
| Products and services, with account counts and balances | Finance and deposit operations | Core banking system and general ledger | Builds the product inventory; the general ledger shows lines a product list forgets |
| Customers by type and by risk rating | BSA analyst or customer due diligence team | Core system and the customer due diligence platform | Sizes the customer row: businesses, money services businesses, nonprofits, foreign and higher-risk customers |
| Enhanced due diligence status | BSA team | Customer due diligence platform or case management | Shows whether high-risk customers are reviewed on time |
| Funds transfers: count, dollars, countries | Wire and payments operations | Wire system or payments hub | Domestic against international, recurring against one-off, higher-risk corridors |
| Cash: currency transaction reports, exemptions, large cash | BSA team and branch operations | Currency reporting module or case management | Cash intensity by branch and customer type |
| Alerts by scenario, and SAR filing counts | BSA team | Transaction monitoring and case management, counts only | Where activity is concentrated; never case detail |
| Branch and customer geography | Branch administration and BSA | Core system, branch list, FinCEN's HIFCA map, ONDCP's HIDTA list | Geographic risk, including higher-risk jurisdictions |
| Delivery channels | Digital banking | Online banking and account opening platforms | Share of accounts opened remotely, instant payments, remote deposit |
| Third-party and fintech partner programs | Partner oversight | Partner register and monthly program files | End customers, volumes and who performs identity verification |
| New products, services, mergers since last year | Product committee and board secretary | Board portal minutes | The changes that should move a row |
| Control inventory and test results | BSA officer and quality assurance | Control library and quality review files | Control strength, with dated evidence |
| Independent test and exam findings | Internal audit | Audit system or board portal | Open findings against each control |
| Last year's approved assessment and the methodology | BSA officer | Board portal and the policy library | Categories, weights, scales, matrix and last year's ratings to compare |
What is a BSA/AML risk assessment tool, and what does it need from you?
A BSA/AML risk assessment tool is software that holds the bank's risk categories, takes in the data for each, applies the bank's scoring method and produces the written assessment. It needs three things from the bank: the data, the method, and the evidence for the controls. The FFIEC manual sets no format and no required categories, so the method has to come from bank management, which the manual makes responsible for designing it (FFIEC, BSA/AML Risk Assessment).
The difference between tools is how much of the gathering they do. A template asks staff to type every number in. A connected tool reads some numbers from source systems. BSA/AML Risk Assessment's data gatherer reads all of them, as of the assessment date, and keeps the system, the item and the passage each came from, so an analyst confirms rather than copies. None of that works if the bank has not decided which inputs count and where they live.
What goes into a BSA risk assessment?
A BSA risk assessment covers the bank's products and services, customers and entities, and geographic locations, analyzed with the data behind each; FinCEN's April 2026 proposal would add distribution channels to the list explicitly. The FFIEC manual describes the first step as identifying the risk categories particular to the bank: its products, services, customers and geographies. The proposal, not yet final, would require risk assessment processes that evaluate the money laundering and terrorist financing risks of those same activities plus distribution channels, which it defines as the ways an institution opens accounts and delivers its products, remote and non-face-to-face channels included (91 FR 18704; the guide to the proposal quotes the text).
Many banks add rows of their own. The sample bank, a sponsor bank, scores fintech partner programs as a fifth row with five categories of its own, because program activity produced 4,310 of its 9,840 monitoring alerts. The BSA risk assessment categories guide covers the choice of rows, and what happened to a bank whose rows missed its main business.
What data do you need for an AML risk assessment? Counts first, then the second step
You need counts and dollar volumes for each category, then enough detail to tell routine activity from unusual activity within them. The FFIEC manual's examples of quantifying risk include "the number and dollar amount of domestic and international funds transfers, the nature of private banking customers or foreign correspondent accounts, the existence of payable through accounts, and the domestic and international geographic locations where the bank conducts or transacts business."
The information collected by two banks in the first step reflects that each sends 100 international funds transfers per day. Further analysis by the first bank shows that approximately 90 percent of its funds transfers are recurring well-documented transactions for long-term customers.
FFIEC BSA/AML Examination Manual, BSA/AML Risk Assessment
The second bank in the manual's example finds 90% of its transfers "nonrecurring or are processed for noncustomers." Same count, different risk. That is why the inputs above include breakdowns, not only totals: international wires by country and by whether the sender is a customer, accounts opened by channel, alerts by scenario. A tool that receives only totals can complete the first step and never the second.
For the sample bank, the 112 data points split across six systems as below. The proportions are typical of a bank whose risk sits in its products and partners: the core system holds most of the counts, and the general ledger supplies the balances that show where the money actually is.
Where the sample bank's 112 data points come from
Controls evidence: the input most often missing
The controls side needs evidence, not descriptions: for each control, what it is meant to catch, when it was last tested, what the test found and what is still open. Banks usually have a control list. Fewer have the test results attached to it in one place, and without them every control rating is a guess that looks like a judgement.
Four sources supply the evidence: the bank's own control tests, quality assurance reviews of alert and case work, the independent test and examination findings. The sample bank rates 41 controls this way and, as a bank setting, will not rate a control without evidence dated within the last 18 months. Its 2026 run rated 14 Strong, 24 Adequate and 3 Needs improvement, and the three became action plans with owners and due dates. The age rule is the useful part to copy: an "Adequate" resting on a test from three years ago is an inherited rating, not a current one.
The methodology and last year's assessment: inputs nobody exports
Two inputs are documents, not data, and they are the ones a tool cannot work without. The first is the methodology: the rows and categories, the weight of each, the scales for inherent risk and control strength, the residual matrix and the threshold at which a moved number should trigger a re-score. The FFIEC manual's only firm expectation of method is that the factors considered, and any weighting, are documented. The second is last year's board-approved assessment, which a tool needs to say what changed and to catch last year's sentences surviving into this year's draft.
At the sample bank the methodology is version 4. It weights products and services, customers and entities and fintech partner programs at 25% each, delivery channels at 15% and geographies at 10%, uses five levels of inherent risk and four of control strength, and re-scores any data point that moves 15% or more. A bank that has never written these down will find that writing them is the first deliverable of any tool project, and the most valuable one.
BSA/AML Risk Assessment: every figure opens the passage it came from
How do you start a BSA risk assessment? A four-week plan
You start a BSA risk assessment by fixing an as-of date and writing down the method, then building the inventory from the general ledger outward, so no business line is missed. The plan below assumes a bank doing its first structured assessment, or moving an existing one into a tool.
Four weeks to a first assessment the bank can defend
- Week 1: fix the as-of date and write the method
Rows, categories, weights, scales, the residual matrix and the change threshold, approved by whoever approves the program's risk appetite.
- Week 1: start the inventory from the general ledger
Every product with a balance gets a category, so a business line cannot be left out because nobody thought of it.
- Week 2: name an owner and a system for every input
Use the template above; an input without an owner will be late every year.
- Week 2: pull the breakdowns, not only the totals
Wires by country and customer status, accounts by channel, alerts by scenario.
- Week 3: attach dated evidence to every control
Tests, quality reviews, the independent test and exam findings, with what is still open.
- Week 3: review the national priorities and current advisories
Note which apply to the bank's products and which do not, and why.
- Week 4: score, then compare with last year
Every row that moved needs a reason; every row that did not move while its data did needs one too.
- Week 4: have someone else score a sample
Disagreements show where the method needs a tighter rule.
The general ledger step is the one that protects the bank most. In October 2026 the OCC fined American Express National Bank $350 million in part because its risk assessment looked at its deposit accounts and too little at its far larger card business (OCC, October 2026). An inventory built from where the balances are would not have made that mistake. For geography, FinCEN's map lists seven High Intensity Financial Crime Area regions (FinCEN HIFCA map) and the White House drug policy office counts 33 regional HIDTAs (ONDCP, 2024 report); the FFIEC's Appendix J rates a bank located in both as higher risk (FFIEC Appendix J).
What a BSA/AML risk assessment tool should not be given
A risk assessment tool needs aggregate counts, not case files, and it needs read access, not write access. SAR confidentiality is the hard line: the SAR rule bars disclosing a SAR, or anything that would show one exists (31 CFR 1020.320(e)), and the assessment is read by the board, business lines and examiners. The FFIEC manual expects it to go to every business line, the board, management and staff, so nothing in it should identify a SAR subject.
Give the tool this, and keep this out
Give the tool: SAR and alert counts by category, scenario and period
Keep out, or keep locked: SAR narratives, subjects and case files
Give the tool: Counts by type and risk rating; balances by segment
Keep out, or keep locked: Customer names in anything the board, committees or business lines see
Give the tool: Read-only connections to systems of record, as of a fixed date
Keep out, or keep locked: Any ability to change a source system
Give the tool: Counts, where the bank uses them as a risk factor
Keep out, or keep locked: Details of 314(a) requests, subpoenas or keep-open letters
Give the tool: The bank's written method and last year's approved assessment
Keep out, or keep locked: Authority to approve, submit or change the method
Treasury's 2026 National Money Laundering Risk Assessment gives a reason to be strict: among common deficiencies in recent enforcement it lists new compliance tools from third-party providers that open vulnerabilities of their own (Treasury, 2026 NMLRA). A tool is a service provider. Read-only access and counts-only data shrink what it could expose.
What the inputs become: an exam pack with every source
Where the solution fits is now clear: a bank that can name the owner and system of each input above can have the agents draft the assessment from them; a bank that cannot will find the list itself is most of the work. What the agents may and may not decide is set out in its own guide, and how often the inputs should be refreshed in another. See the inputs in use in BSA/AML Risk Assessment.
Questions people ask
What is a BSA/AML risk assessment matrix?
It is the grid that turns ratings into a conclusion: inherent risk on one axis, control strength on the other, residual risk where they meet. The FFIEC manual's Appendix J offers a quantity-of-risk matrix that describes low, moderate and high inherent risk for each factor, which banks and examiners may use; the residual matrix is each bank's own.
Who should own the BSA risk assessment?
The BSA officer owns it, because the officer is responsible for managing all aspects of the program. Each input should still have its own owner in the business, finance, operations or audit, and the assessment goes to the board, management and business lines once it is done.
Can the risk assessment use SAR data?
It can use SAR counts, such as filings by product or category, but not SAR content, because the SAR rule bars disclosing any information that would reveal a SAR and the assessment is widely read. Commenters on FinCEN's 2024 proposal also argued banks should not be required to base risk assessments on SARs and CTRs, and the 2026 proposal dropped that element.
How many data points does a BSA risk assessment need?
No rule sets a number; it depends on the bank's products and size. The sample bank, a $3.4 billion sponsor bank, uses 112 across 38 categories and 41 controls. A bank with a few products may need far fewer, but each category needs enough data for the FFIEC's second step, the analysis.
What is the as-of date of a risk assessment?
It is the single date all data points are taken from, such as September 30, so that every figure describes the same moment. Without one, a cash count from June and a wire count from September end up in the same rating. The sample bank uses September 30 for the annual assessment and quarter ends for its refreshes.
Do we need a new tool to meet FinCEN's 2026 proposal?
No. The proposal names no required technology, and says community banks may rely on direct knowledge rather than highly parameterized approaches. It would require documented risk assessment processes that cover distribution channels, review the national priorities and update promptly on significant change; it is not yet final.