In plain English
An enterprise-wide risk assessment (EWRA), sometimes called a business risk assessment, looks at the whole institution rather than individual customers. It identifies inherent risks, assesses how well controls reduce them, and arrives at the residual risk that remains.
A good EWRA drives decisions. It should shape the controls, resources, monitoring scenarios and screening that follow, and it should be updated periodically and whenever the business changes.
Why it matters to a board
The board and senior management should receive and approve the EWRA, and be able to say what it concluded and what changed as a result.
Common mistakes
- A generic template that could describe any institution.
- No link between the assessment and monitoring scenarios or resourcing.
- Completed once and filed.
What the standards and regulators say
- FATF Recommendations: international standards on combating money laundering and the financing of terrorism and proliferation
- UAE: Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation, and its executive regulations (Cabinet Resolution No. 134 of 2025)