A compliance officer opening a new file is not asking what risk is, but what they will have to show.
The duty sits in L.188(I)/2007, not in a supervisor's directive. The operative text is Greek and there is no official English version; the renderings here are ours. Section 58A(1) requires the obliged entity to take appropriate measures to identify and assess the money laundering and terrorist financing risks it faces, taking into account risk factors, including those relating to its customers, the countries or the geographic areas, the products, the services, the transactions or the delivery channels, with those measures proportionate to its nature and size. The word is "including": the Law's own factor list is not closed. A Bar Association lawyer and a CySEC investment firm carry the identical duty.
Two decisions get conflated. Section 58A is business-wide: under 58A(2) the risk assessments are documented, updated and made available to the competent supervisory authority. Section 61(2) is per customer: obliged entities apply the section 61(1) measures but may determine the extent of those measures according to the degree of risk, taking into account at least the variables in Annex I, and must be able to demonstrate to the competent supervisory authorities that the extent is proportionate to the money laundering and terrorist financing risks they face. The second half is what gets tested.
Annex I holds three variables: the purpose of an account or relationship; the level of assets to be deposited or the size of transactions carried out; the regularity or duration of the relationship. Annex II holds potentially lower-risk factors, taken into account at least when assessing money laundering and terrorist financing risk under section 63(2); section 63(1) permits simplified due diligence only after the entity has satisfied itself of a lower degree of risk and there is no suspicion, and its proviso still requires monitoring sufficient to detect unusual or suspicious transactions. Annex III holds potentially higher-risk factors, taken into account at least under section 64(3) in other cases which by their nature present a high risk. All three open with the same two Greek words: indicative list, in our rendering. Treating any as exhaustive inverts what the Law wrote.
ICPAC supplies the operational layer for accountants. Firms must document the client risk assessment performed for each individual client, in line with the framework and consistent across all client risk assessments. Firms must document the firm-wide risk assessment performed annually, taking into account the overall risks undertaken by the firm. The framework must be clearly documented, aligned to the Client Acceptance Policy, and made available to the Institute upon request. Method stays discretionary: firms may find it more convenient to draw up a simple scorecard. It is important, ICPAC adds, for the approach to incorporate a provision for raising the rating from low or normal to high where information surfacing during due diligence causes concern or suspicion.
FATF Recommendation 1 stands behind all of it, and its criteria address countries and assessors rather than you. Criterion 1.12 asks that firms be required to identify, assess and understand their money laundering and terrorist financing risks for customers, countries or geographic areas, and products, services, transactions or delivery channels, to document those assessments, to consider all the relevant risk factors before determining the level of overall risk and the appropriate level and type of mitigation, to keep them up to date, and to have appropriate mechanisms to provide risk assessment information to competent authorities and self-regulatory bodies. Then work from section 58A, the text you are inspected against.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗