BSA risk assessment categories, and the product line that got left out

BSA risk assessment categories are the groups a bank sorts its money laundering and terrorist financing risk into before it rates anything. The FFIEC BSA/AML Examination Manual names them as "products, services, customers, and geographic locations" unique to the bank, says "there are no required risk categories," and leaves the number and detail to the bank's "size or complexity, and organizational structure" (FFIEC, BSA/AML Risk Assessment). FinCEN's April 2026 proposal, not yet final, would add distribution channels to the list. The categories are the easy part. The hard part is an inventory complete enough that no product line, customer type or channel falls outside them, and the enforcement history shows what happens when one does. Botminds' BSA/AML Risk Assessment builds the inventory from the bank's own systems, so a line with a balance in the general ledger cannot go unscored without someone deciding it should.

The inventory below is illustrative, a fictional card-heavy bank built in the pattern the OCC described, not American Express's actual assessment. The worked rows come from a fictional sample bank as it runs through the solution, Tessaly Community Bank.

What are the BSA risk assessment categories?

The standard BSA risk assessment categories are products and services, customers and entities, and geographic locations, with delivery channels increasingly scored as a fourth. The FFIEC manual describes the first step of an assessment as identifying "the bank's risk categories" and warns that "improper identification and assessment of risk can have a cascading effect, creating deficiencies in multiple areas of internal controls and resulting in an overall weakened BSA/AML compliance program." FinCEN's proposal would require risk assessment processes to evaluate products, services, distribution channels, customers and geographies (91 FR 18704).

Within each, banks build sub-categories that match their business. The sample bank uses five rows holding 38 categories, adding fintech partner programs as a row of its own because it is a sponsor bank. Each row carries a different number of data points, which is itself a check: a row with very few data points is either low risk or under-inventoried, and the assessment should say which.

The product line that got left out: what the American Express order says

The American Express consent order is the clearest recent case of a risk assessment built on the wrong categories. On October 8, 2026, the OCC announced a cease-and-desist order and a $350 million civil money penalty against American Express National Bank, finding that "the bank failed to tailor its BSA/AML risk assessment to its business activities. The bank focused on the risks in its relatively narrow demand deposit account products and services and insufficiently on the risks in its more dominant credit and charge card products" (OCC, October 2026).

The consequence was a monitoring failure years long. The OCC said the bank's "ineffective risk assessments," together with its customer due diligence and identification procedures, "contributed to the bank's monitoring and reporting failures," including "a failure to timely identify, evaluate, and sufficiently report approximately $13 billion of suspected trade-based money laundering activity that took place over the past decade." The Federal Reserve's concurrent order against the parent company cited weak transaction monitoring, fraud referrals, third-party risk assessment and financial crimes risk management (Federal Reserve order, October 2026).

TD Bank: the transactions no category could see

A category can exist on paper and still miss the activity, when the systems behind it cannot see the transactions. FinCEN's 2024 order against TD Bank found the bank's monitoring system had no transaction codes for 98% of its domestic ACH activity, that "roughly half of TD Bank's fund transfers went unmonitored and included international debit card purchases," that the bank "failed to monitor nearly all monetary instruments," and that it "knew since 2011 it lacked specific transaction codes and scenarios necessary to monitor RDC transactions" (FinCEN consent order, 2024). The OCC's parallel action listed "risk assessments" among the deficiencies (OCC, October 2024).

The lesson for the categories is that the inventory has two sides. One is what the bank offers, read from the general ledger and the product list. The other is what each control can actually see, read from the monitoring system's transaction codes and scenarios. A product that is in the assessment but outside monitoring coverage is, for practical purposes, left out, and the control rating for it should say so.

What products should be in a BSA risk assessment?

Every product and service the bank offers belongs in the BSA risk assessment, including the ones that seem low risk, because the assessment's job is to show why they are low. The safest way to build the list is from balances and transaction volumes, not from memory: every general ledger line with a balance, every transaction code with volume, and every product the board has approved since the last assessment.

The FFIEC's quantity of risk matrix alone names the usual candidates for higher risk: electronic banking, funds transfers, foreign correspondent accounts, pouch activities, special-use accounts, payable-through accounts, U.S. dollar drafts, private banking and trust services. Treasury's 2026 National Money Laundering Risk Assessment adds the current pressure points: peer-to-peer payments, which "are fast, widely adopted, and often irrevocable," cards and prepaid access, and check fraud enabled by mail theft (Treasury, 2026 NMLRA). At the sample bank, products and services rose to Moderate residual risk this year after instant payments went live on March 9, 2026, with 18,400 payments worth $41 million by September 30, and international wires grew.

How do you identify high risk products?

You identify high risk products by the characteristics that make laundering easier: speed, anonymity, volume, cross-border reach, cash and third parties standing between the bank and the customer. The FFIEC's Appendix J, the quantity of risk matrix, describes those characteristics at three levels; it is an optional aid for reaching summary conclusions, not a required scale (FFIEC Appendix J).

The matrix's limit is that it was written for a deposit bank. It has no row for cards, partner programs or instant payments, which is why a bank whose business is mostly one of those needs categories of its own. A useful test: rank the bank's products by balance or volume, then rank them by the risk score they received. If the largest product sits at the bottom of the risk list, either it really is low risk and the assessment explains why, or the inventory has the American Express problem.

What is geographic risk in AML?

Geographic risk in AML is the risk that comes from where the bank operates and where its customers and transactions go: domestic areas designated for drug trafficking or financial crime, and foreign jurisdictions with weaker controls or higher threat. Domestically, FinCEN's High Intensity Financial Crime Area map lists seven regions (FinCEN HIFCA map), and the White House drug policy office counts 33 regional High Intensity Drug Trafficking Areas covering all 50 states, Puerto Rico, the U.S. Virgin Islands and the District of Columbia (ONDCP, 2024 report). The FFIEC glossary still says 28 HIDTAs; the current count is ONDCP's.

The data that measures it is plain: branches and customers in designated counties, funds transfers by destination and origin country, and customers whose activity sits outside the bank's footprint. At the sample bank, 14 of 41 branches sit in HIDTA-designated counties, and wires to six higher-risk jurisdictions totaled $18.6 million in the year, which with Adequate controls reads Low-Moderate residual risk.

Customers and entities: is any customer type automatically high risk?

No customer type is automatically high risk, and the regulators have said so in writing. Their 2022 joint statement reinforces "a longstanding position that no customer type presents a single level of uniform risk or a particular risk profile related to money laundering, terrorist financing, or other illicit financial activity" (joint statement, July 2022), and the FFIEC's 2021 manual update reminds examiners "that no specific customer type automatically presents a higher risk" (FDIC FIL-76-2021).

For the categories, that means customer rows are built on data about how customers behave and what they need, not on labels alone. Money services businesses, charities, cash-intensive businesses and politically exposed persons are worth their own categories because their risk varies widely, and the assessment should show the spread: how many, how much activity, how many under enhanced review. The sample bank serves 23 money services businesses, up from 18, and has 1,184 customers rated high risk, 1,161 of them with enhanced due diligence reviews current.

Delivery channels and partner programs: the categories growth adds

New channels and partners are where inventories most often fall behind, because they grow faster than an annual assessment. Treasury's 2026 assessment counts failure to assess the risks of new products and services among common deficiencies in recent enforcement, and warns that fintech growth in bank partnerships can outrun the compliance staff and controls built for it.

The cost can be the bank. City National Bank of New Jersey, with $120.6 million in assets, was closed on November 1, 2019. The Treasury Inspector General found "the primary cause" was "a new business strategy that led to dramatically increased transaction activity from an expanded base of money service business customers," pursued "without implementing adequate policies, procedures, risk management commensurate with the risk of its activities, or controls to comply with the Bank Secrecy Act" (Treasury OIG-20-039). A category that existed for money services businesses did not keep pace with the business added to it.

BSA/AML Risk Assessment: every category in five rows, with what moved since last year

The answer is to score a new channel or partner before it launches, not after the next annual cycle. At the sample bank, a proposed twelfth partner program is scored as a what-if against the current assessment: two rows would rise, and the controls that must be ready first are listed for the chief risk officer.

A new partner program, scored before it joins the inventory

How to test that the inventory is complete

You test completeness by reconciling the assessment's categories against independent lists of what the bank does, and treating every unmatched item as a finding. The checks below take a few days and catch most omissions before an examiner does.

The inputs these checks need are listed in the inputs to gather before a BSA/AML risk assessment tool; how to score the categories consistently once they are complete is covered in inherent and residual risk in AML. See every category opened to its data in BSA/AML Risk Assessment.

Questions people ask

What is a product risk assessment in AML?

It is the part of the institution-wide assessment that rates each product and service for money laundering and terrorist financing risk, using data such as volumes, customers and cross-border reach, and the controls that address it. Some banks also run one before each new product launch, so the product enters the main assessment already scored.

Are delivery channels a required BSA risk assessment category?

Not under today's rules: the FFIEC manual names products, services, customers and geographic locations and says no categories are required. FinCEN's April 2026 proposal would add distribution channels, defined as how a bank opens accounts and provides products, including remote means. It is not yet final, but many banks already score channels.

How many categories should a BSA risk assessment have?

As many as the bank's business needs to show where its risk varies. The FFIEC manual says the number and detail vary by size, complexity and structure. The sample bank, a $3.4 billion sponsor bank, uses 38 categories in five rows; a small bank with a few products may need far fewer.

What did the American Express consent order say about the risk assessment?

The OCC found American Express National Bank "failed to tailor its BSA/AML risk assessment to its business activities," focusing on its narrow deposit products rather than its dominant credit and charge cards. With other weaknesses, that led to failures to timely identify and report about $13 billion of suspected trade-based money laundering, and a $350 million penalty in October 2026.

What is the difference between a HIDTA and a HIFCA?

A HIDTA, a High Intensity Drug Trafficking Area, is a region designated by the White House drug policy office for coordinated drug enforcement; there are 33. A HIFCA, a High Intensity Financial Crime Area, concentrates enforcement against money laundering; FinCEN's map lists seven regions. The FFIEC's quantity of risk matrix rates a bank located in both as higher geographic risk.

Should OFAC risk be a category in the BSA risk assessment?

Many banks keep a separate OFAC risk assessment, because sanctions compliance sits outside the BSA. The FFIEC manual says examiners review the bank's OFAC risk assessment and related independent testing when OFAC is in an examination's scope, so whichever document holds it should be current.