Risk Assessment vs. Transaction Monitoring
Complementary, not interchangeable. A bank Chief Risk Officer and an AML consultant on why each has to test the other, and what examiners look for first.
Chapters
- What an entity-wide risk assessment is for
- Where to point the flashlight
- Using monitoring results to test the assessment
- The proposed AML/CFT program rule
- What examiners look for first
- Where programs break down
- Case study: an OCC consent order
- Poll: how often do you retune?
- Poll: where the manual hours go
- Closing thoughts
Three takeaways from the panel, and a test to run on your own program
What Andrea and Cody want every BSA officer to walk away with, distilled for your team.
- Why the risk assessment and transaction monitoring are complementary, not interchangeable
- The feedback loop examiners now test, and the consent order that shows it running in reverse
- How to check whether your highest-rated risk would hold up at exam
One tells you where to look. The other tells you what you found.
Where should we point the flashlight?
Strategic and bank-wide. Rates inherent and residual risk across customers, products and services, delivery channels and geography, and tells the board where resources belong.
What did the light find?
Tactical and continuous. Applies rules and thresholds to activity and produces alerts, investigations and SARs.
The assessment is a blueprint, and it has to be living
It comes first because a risk-based program cannot be designed until you know where the risk lies. It cannot sit still, because monitoring results have to flow back into it.
The feedback loop is the test
If your assessment puts your risk in international activity and every SAR you file is domestic fraud, the risk is misstated, monitoring is miscalibrated, or both.
Can you explain the rating?
Examiners start with logic, then alignment to what the bank actually does, then data integrity. If management cannot explain a rating, the rating is not helping.
Every threshold needs a story
If the monitoring team cannot explain why a threshold exists, it is not good enough. A rule producing zero alerts is a question, not a clean bill of health.
Three in four said alert work is their heaviest manual load.
Which area of your BSA/AML program demands the most manual effort?
How often do you tune monitoring rules based on changes in your risk assessment?
Live polls of webinar attendees, October 8, 2026. Remaining responses to the first question named CDD/EDD for high-risk customers.
