18.3 Changes That Should Trigger a Financial Crime Risk Assessment Review
Key Takeaways
New products, new countries, new customer segments and new distribution partners are standard triggers for a financial crime assessment review.
Regulatory and sanctions changes, such as the US revocation of the Syria sanctions programme on 1 July 2025, require screening rules and procedures to be updated.
Acquiring a company or a customer portfolio means inheriting its customers and risks, so it should trigger due diligence and a review of the combined risk.
A trigger register records each event, its impact assessment, the decision taken and the owner, so that reviews are traceable.
CAFCA sub-topic 5.3 asks about the types of changes that should lead to a financial crime assessment review. A scheduled annual review is not enough for a FinTech that changes every sprint. The firm needs a defined list of triggers and a light, proportionate process for assessing each one.
The trigger list
| Trigger category | Examples | Minimum response |
|---|---|---|
| Products and features | New account type, crypto, credit, instant payouts, removing a hold | New product approval assessment (Chapter 18); update the risk assessment |
| Markets and geographies | Entering a new country; adding payout corridors; serving non-residents | Corridor and country assessment; licensing; sanctions lists; local rules |
| Customer segments | Onboarding businesses, minors, MSBs or VASPs, high-risk industries | New CDD standards and rating factors; monitoring baselines |
| Channels and partners | New embedded-finance partner; agents; white-label deals; API resellers | Partner due diligence; nested-risk analysis; data feeds |
| Technology and vendors | New identity verification vendor, screening tool or monitoring system; AI models | Validation and parallel running; gap analysis; model governance |
| Corporate events | Merger, acquisition of a portfolio, change of ownership or control | Due diligence on acquired customers; integration plan; combined risk review |
| Material growth or volume shifts | Customer base doubles; a corridor spikes; a new marketing campaign | Data refresh; capacity modelling (Chapter 18) |
| Regulatory change | New laws and rules (for example the EU AML Regulation from July 2027, implementing rules under the US GENIUS Act, FinCEN exceptive relief or withdrawn proposals) | Obligations-register update; policy and procedure changes |
| Sanctions and FATF changes | New designations or programmes; lifted programmes; FATF list changes after each plenary | Update screening configuration, high-risk country lists and EDD rules |
| Typology intelligence | New FIU alert, national risk assessment or partner-bank intelligence | New or tuned scenarios; training |
| Internal events | Audit or exam findings; a large fraud loss; data breach; control failure; spike in SARs on one product; enforcement | Root-cause analysis; targeted reassessment; remediation |
| Partner requirements | Sponsor bank changes its risk appetite or prohibited list | Update the policy and customer terms to match (Chapter 17) |
Example: sanctions programme changes
Sanctions change in both directions. On 30 June 2025, US Executive Order 14312 revoked the Syria sanctions programme with effect from 1 July 2025. OFAC removed the Syrian Sanctions Regulations and delisted hundreds of persons, while keeping targeted measures against Assad-linked and other actors under a new programme. A FinTech that kept Syria as a comprehensively sanctioned country in its geofencing and screening rules would block lawful activity. One that removed every Syria control would miss the persons who remain designated. The change is a trigger: review the rules, update the configuration, keep the lists that still apply, and record the decision. The same applies when new programmes start or existing ones tighten.
A proportionate trigger process
- Identify: product, legal, sanctions and operations teams log triggers in a trigger register. Make it part of change management and new product approval.
- Assess impact: a short assessment asks which risk factors change, which controls are affected and whether residual risk moves against appetite.
- Decide the scope: a targeted update of one section, or a full refresh if the change is material.
- Act: update controls, procedures, training and MI.
- Record: the decision, the owner, the date and the evidence. Examiners ask how the firm learned of a change and what it did.
Calibrate the process so that it is used. If every minor release needs a full reassessment, teams will avoid logging triggers. If nothing ever does, the register becomes decoration. A short screening question in the release checklist works well in practice: "Does this change who can use the product, where money can go, how fast it moves, or what data we capture?" A yes routes the change to compliance.
Who owns trigger monitoring
- Compliance or the MLRO owns the process and the final assessment.
- Product and engineering must notify compliance of feature changes through the release process.
- Legal and regulatory affairs watch for law changes.
- Sanctions teams watch list and programme updates.
- Partnership teams report new and changed partners.
Realistic exam scenario
A payments FinTech acquires a smaller competitor with 80,000 business customers in three new countries. The deal closes on Monday, and integration is planned for six weeks later. This is a trigger for due diligence on the acquired portfolio: risk ratings, CDD quality, open alerts and SAR history, and sanctions exposure. It also triggers a review of the combined risk assessment covering the new countries and segments, and a remediation plan for gaps before the customers move onto the main platform. The partner bank should be told as the contract requires.
Common exam traps
- Waiting for the annual cycle after a major change.
- Forgetting lifted sanctions. Lifting a programme is a trigger too, and stale rules create compliance and fairness problems.
- Acquiring customers without reviewing their CDD.
- No record of what triggered a review and what changed.
Which event is a trigger for reviewing a FinTech's financial crime risk assessment outside the normal cycle?
The office relocates to a new building within the same city
An employee takes annual leave
The firm starts onboarding money services businesses as customers
The marketing team changes the app's colour scheme and logo
After a sanctions programme is lifted, what is the correct compliance response?
Review and update screening rules, keep designations that still apply, and record it
Keep blocking the country indefinitely, just to be on the safe side
Remove all screening for that country, including persons who remain designated
Nothing, because only new sanctions programmes can affect screening
A FinTech buys another company's customer portfolio. What should the trigger process require?
Closing all acquired accounts as a precaution
Only a review of the purchase price and the integration budget
Immediate migration of every acquired customer without any additional review
Due diligence on the acquired customers and a combined risk review, fixing CDD gaps
Sections you finish are checked off in the contents.