18.2 Refreshing the Financial Crime Risk Assessment as the Business Scales

CAFCA sub-topic 5.2 emphasises the importance of reviewing and updating the risk assessment as part of scaling. Many FinTech financial crime failures share one storyline. The business grew quickly, the risk assessment stayed as it was written for a smaller firm, and the controls fell behind. Regulators' consent orders against BaaS sponsor banks in 2023 and 2024 repeatedly cited exactly this.

Why scaling changes the risk picture

How to refresh during growth

1. Refresh the data. Customer counts by segment and risk rating; volumes and values by product, channel and corridor; alert volumes and outcomes by scenario; SARs; fraud losses and chargebacks; QA results; complaints.
2. Re-score inherent risk for each factor using the new data, not last year's figures.
3. Re-test control effectiveness with current evidence: QA error rates, testing results, backlog ageing, data-feed completeness and audit findings.
4. Recalculate residual risk and compare it with the risk appetite. Flag any breaches.
5. Model capacity. Forecast customer growth, then expected alerts (alerts per 1,000 customers multiplied by growth), then the analysts needed at the expected productivity and quality, plus QA, training and tooling.
6. Decide on actions: hiring, automation and tuning, product limits, a slower rollout in high-risk areas, or exiting segments.
7. Report and approve. Present the findings to senior management and the board. Share them with partner banks as agreed, and tie them to the budget and roadmap.

A worked capacity example

A FinTech has 400,000 customers, generating 6 alerts per 1,000 customers each month: 2,400 alerts. Each analyst closes about 400 alerts a month at the required quality, so 6 analysts are needed. Marketing forecasts 1.2 million customers in 12 months. At the same alert rate that means about 7,200 alerts a month, or 18 analysts, before allowing for QA, leave, training or tuning. If the plan funds only 8 analysts, the refreshed assessment should show the expected backlog, the rise in residual risk, and the options to close the gap. Those options include tuning to cut false positives, automation, outsourced surge capacity (Chapter 18) and growth caps.

Signs that the assessment is out of date

• The risk assessment still describes products or countries the firm launched or left months ago.
• Alert or SAR volumes have changed sharply with no explanation in the assessment.
• The partner bank's own analysis gives different risk levels from the FinTech's assessment.
• Staffing plans assume last year's customer numbers.
• New typologies reported by the FIU or the partner bank are not mentioned.
• Control effectiveness ratings are based on opinion rather than recent testing or QA data.

Any of these signs should prompt an interim update rather than waiting for the annual cycle.

Frequency during scaling

An annual refresh is common practice, but fast-growing firms often need more frequent updates, for example quarterly checks of key metrics. They also need event-driven reviews when triggers occur (next section). The aim is to keep the assessment current, not to follow a calendar.

Communicating the refresh

• Use a short executive summary covering what changed, where residual risk now exceeds appetite, and the decisions needed.
• Explain trends with normalised figures (Chapter 14).
• Give the partner bank enough detail to fulfil its own oversight duties.

Realistic exam scenario

A neobank's user base has grown tenfold in a year, but the risk assessment and staffing plan date from before the growth. Its sponsor bank cites a 60-day alert backlog. The MLRO should refresh the risk assessment with current data and quantify the capacity gap. The board should then approve a remediation plan with funding, interim growth limits on the highest-risk products, and agreed MI for the bank. Clearing the backlog by raising thresholds without analysis would be a further failure (Chapter 11).

Common exam traps

• A risk assessment that never changes while the business grows.
• Ignoring capacity: effective controls on paper are not effective in practice if the queue is months behind.
• Treating growth as purely a commercial matter without considering financial crime.