The AML risk assessment: how to build one that holds when settlement runs in stablecoins

An AML risk assessment is the document every other control answers to. It names the money laundering and terrorist financing risk your business actually carries, rates it, and explains which controls reduce it. An examiner reads it before anything else. Many institutions still treat it as an annual form, then meet a finding on a control they never knew they depended on.

This article sets out what belongs in an AML risk assessment at a cross-border payment institution, how to rate the three layers properly, and what changes when the settlement leg runs in stablecoins. It is general information for compliance and treasury leaders, not legal advice on your own programme.

What is an AML risk assessment, and why is it not a questionnaire?

The assessment does three things in order. It identifies inherent risk, meaning the exposure you carry before any control is applied. It assesses how well your controls work against that exposure. It concludes residual risk, which is what remains. Everything downstream, from monitoring thresholds to who may approve a payout, should be traceable to the conclusion.

The expectation is not new. FATF Recommendation 1 requires financial institutions to identify, assess and understand their money laundering and terrorist financing risks and to apply resources accordingly. In the United States the FFIEC BSA/AML Examination Manual treats the risk assessment as the foundation of the programme, and examiners use it to scope their own work. FinCEN's proposed AML/CFT programme rule, published in June 2024, would make a risk assessment process an explicit requirement and would require firms to consider the eight national priorities FinCEN published in June 2021.

In Canada the same logic is written into the compliance programme requirements that FINTRAC supervises. A risk assessment is a required element, and the programme's effectiveness must be reviewed at least every two years.

So why do so many of these documents read like a survey? Because they are built from opinions collected in a meeting. A questionnaire records what people believe. A risk assessment records what the book shows. If a rating cannot be traced to a count, it is a view, and a view does not survive challenge.

Which risk categories belong in a cross-border AML risk assessment?

Start with the categories supervisors already use: products and services, customers and entity types, geographies, delivery channels and transaction types. Then add the categories a cross-border payment business genuinely runs on. A domestic bank template will miss them.

• Corridors, scored individually rather than as a single international line, with volume and value concentration shown for each.
• Payout partners and agents, including whether the partner is supervised, who it in turn relies on, and what you can see of its own customers.
• Customer segments by business model, because a licensed exchange house, a payroll processor and a goods importer carry different typologies.
• The settlement asset and its issuer, including redemption and freeze behaviour.
• Each chain you settle on, with the confirmation policy you apply to it.
• Counterparty wallets, split between addresses you verified and whitelisted and addresses you merely received funds from.
• Channels: a portal, an API, a batch file and a partner-initiated instruction do not carry the same risk.

Keep the categories stable between versions. Comparability over time is most of the value.

What does a stablecoin settlement leg actually change?

It changes risk in both directions, and an honest assessment says so. Some risk falls. Every settlement movement is observable, timestamped and permanently recorded. The flow of funds between your own addresses is verifiable by anyone, which is a stronger evidence position than a correspondent statement that arrives the next day.

Other risk rises, and these are the lines reviewers will test. Attribution is the first. An address is not a name. Linking a counterparty address to a verified legal entity is work your onboarding has to do, and the assessment should state how often it succeeds. Exposure to high-risk sources is the second: funds that reached you through a mixer, a sanctioned address or a service with no controls. The third is dependence on the issuer, whose freeze powers and redemption terms sit outside your control.

The Travel Rule is the fourth, and it deserves its own line. FATF Recommendation 16 applies to virtual asset transfers, and FATF sets the threshold for originator and beneficiary information at 1,000 US dollars or euro. The practical risk is the sunrise problem: a counterparty in a jurisdiction that has not implemented the rule cannot receive your payload or send you one. That gap is a real residual risk, not a theoretical one, and the mitigation is usually a corridor decision rather than a system change.

Operational risk belongs here too. A chain reorganisation, congestion or a node failure changes when you treat a payment as settled, which shapes what your monitoring sees and when.

How do you rate inherent risk, control effectiveness and residual risk?

Rate inherent risk from the book, not from the brochure. For each line, show the count, the value, the share of the total and the direction of travel over the last four quarters. A corridor carrying a small share of volume but most of your alerts is a high inherent risk line even if the revenue is small. Write the basis next to the rating.

Control effectiveness is where most assessments quietly fail. A control is effective because it was tested, not because it exists in a policy. Pull the evidence you already have: screening match testing, monitoring threshold tuning, quality assurance sampling, the findings file from the last independent review. Where no test exists, rate the control as unproven and say so. That creates the work item.

Residual risk is the conclusion, and it has to do something. If a line comes out high, something should change: a lower monitoring threshold, an enhanced due diligence trigger, a senior approval before release, a cap on exposure, or more people. An assessment where every line is medium and nothing changes is a document, not a control.

Use a scale you can defend and apply it the same way everywhere. Four points work better than three, because a three-point scale pushes everything into the middle.

How do you build the assessment, step by step?

• Fix the scope and the as-at date: which legal entities, which licences, which corridors, which products, and the data cut-off you measured from.
• Pull the data first: customer counts by segment and risk rating, payment counts and values by corridor, partner volumes, alert and case counts, escalations and filed reports.
• Build the inherent risk register line by line, with the count or value that supports each rating written beside it.
• Map each control to the lines it reduces, then attach the most recent test result and its date.
• Score residual risk per line, and flag every line where the control is untested.
• Write the actions: an owner, a date and a measurable change for every high residual line.
• Have it challenged by someone who did not write it, usually the second line or an independent reviewer, and keep their comments.
• Approve it at the right level, record the approval, and version the file so the superseded edition stays readable.

A register with no counts beside the ratings and no test dates beside the controls can be written in an afternoon, and it will be taken apart in an hour.

When should it be refreshed, and what will an examiner ask for?

An annual refresh is the baseline. Events matter more. Refresh when you open a corridor, add a payout partner, add a settlement asset or a chain, enter a new customer segment, change a licence or a regulatory perimeter, see a material audit or monitoring finding, or when a sanctions regime changes in a market you serve. Record the trigger in the document, because the reason for a version is part of the evidence.

An examiner or an auditor will ask a short list of questions. Show me the current version and who approved it. Show me the data behind three ratings I pick. Show me a control you rated effective and the test that proved it. Show me a high residual line and what changed because of it. Show me the previous version and explain what moved.

The test of an AML risk assessment is not whether it is thorough. It is whether a threshold, an approval level or a corridor decision would have been different had the assessment said something else.

Keep the file small and current rather than long and stale. An assessment that ties every rating to a number, names an owner for each action and shows what changed since the last version is worth more than a hundred pages of description. Build the AML risk assessment before the corridor opens, then let the evidence from live operations update it.

Where StableNet fits

StableNet, built by SpendTheBits, is a cross-border B2B payment and settlement platform for banks, credit unions, licensed money service businesses, exchange houses and remittance fintechs. Settlement runs in regulated stablecoins on public blockchains and completes in minutes with on-chain auditability, which gives a risk assessment real data to rate rather than estimates. Compliance is built in, with KYB and KYC onboarding, KYT, sanctions and PEP screening, FATF Travel Rule data in IVMS101 form, a compliance workbench and a tamper-evident audit trail. Because the platform is ISO 20022 native, with pacs.008 customer credit transfers, pacs.009 interbank legs, pacs.002 status reports and pacs.004 returns tracked end to end by UETR, the counts and evidence an assessment depends on come out of the system rather than out of a spreadsheet.