Risk Assessment vs. Transaction Monitoring
Complementary, not interchangeable. A bank Chief Risk Officer and an AML consultant on why each has to test the other, and what examiners look for first.
Chapters
- What an entity-wide risk assessment is for
- Where to point the flashlight
- Using monitoring results to test the assessment
- The proposed AML/CFT program rule
- What examiners look for first
- Where programs break down
- Case study: an OCC consent order
- Poll: how often do you retune?
- Poll: where the manual hours go
- Closing thoughts
One tells you where to look. The other tells you what you found.
Where should we point the flashlight?
Strategic and bank-wide. Rates inherent and residual risk across customers, products and services, delivery channels and geography, and tells the board where resources belong.
What did the light find?
Tactical and continuous. Applies rules and thresholds to activity and produces alerts, investigations and SARs.
The assessment is a blueprint, and it has to be living
It comes first because a risk-based program cannot be designed until you know where the risk lies. It cannot sit still, because monitoring results have to flow back into it.
The feedback loop is the test
If your assessment puts your risk in international activity and every SAR you file is domestic fraud, the risk is misstated, monitoring is miscalibrated, or both.
Can you explain the rating?
Examiners start with logic, then alignment to what the bank actually does, then data integrity. If management cannot explain a rating, the rating is not helping.
Every threshold needs a story
If the monitoring team cannot explain why a threshold exists, it is not good enough. A rule producing zero alerts is a question, not a clean bill of health.
Three in four said alert work is their heaviest manual load.
Which area of your BSA/AML program demands the most manual effort?
How often do you tune monitoring rules based on changes in your risk assessment?
Live polls of webinar attendees, October 8, 2026. Remaining responses to the first question named CDD/EDD for high-risk customers.
Andrea Valentin
Chief Risk Officer, Maxwell State Bank. Speaker and advisor with the Financial Fraud Consortium. Views her own.
Cody J. Smith
Managing Director, CSMB International, and Chief Product Officer, RiskRator.
Jose Lamas
Co-Founder and Chief Revenue Officer, RiskRator.
