SAMA AML Risk Assessment Checklist: Seven Data Sources

This SAMA AML risk assessment checklist is for compliance officers and AML managers who are building or refreshing an institutional risk assessment. The principle is simple and often reversed in practice: the institution-level assessment comes first, and the customer-risk scoring model is built from it. Teams that begin with the model tend to reverse-engineer a justification afterward, and the gaps show up at the annual review or in an independent assessment.

SAMA's AML/CTF framework expects a documented, institution-wide assessment of money laundering and terrorist financing risk before customers are rated. FATF Recommendation 1 sets the same expectation: identify, assess and understand your risks, then apply controls in proportion. The brief for this article refers to Article 4.1.2; confirm the exact article reference against the current SAMA text before you cite it in your own documents.

Use the checklist below as a working document. For each item, note the source, the owner, the date, the conclusion and where the evidence is stored.

How to use this checklist

Each of the seven items has a one-line reason it matters. The evidence format at the end applies to all of them. Work through the items in order, because the later ones depend on the earlier ones.

Group A: External risk inputs

1. Country risk from FATF statements. List the jurisdictions you have exposure to and map each against the current FATF public statements on high-risk and monitored jurisdictions. Why it matters: it is the most visible external input, and a reviewer will check that it is current.
2. Geographic risk from transaction patterns. Analyze where your funds actually move, by origin and destination, rather than only where customers say they are based. Why it matters: stated and observed geography often differ, and the observed picture is the defensible one.
3. Customer-segment risk from demographics. Break the customer base into segments such as individuals, corporates, non-residents, cash-intensive businesses and politically exposed persons, and record the profile of each. Why it matters: segments are the unit the scoring model will later rate, so they must be defined here first.

Group B: Your own business

1. Product and service risk from your own portfolio. Inventory every product and service, and assess each for anonymity, speed, cross-border reach and cash use. Why it matters: risk sits in what you offer, and a new product launched without this step creates an unassessed exposure.
2. Delivery-channel risk from digital versus branch. Record how customers onboard and transact: branch, digital, agent or third party, and whether they are face to face or remote. Why it matters: non-face-to-face channels change identity-verification risk and need explicit treatment.

Group C: Internal inputs

1. Internal intelligence: alerts and suspicious activity reports. Review monitoring alert volumes, case outcomes and the themes in your own suspicious activity reports. Why it matters: it shows where risk has materialized in your institution, not just where it could.
2. Internal control and audit findings. Collect prior audit results, regulatory observations, testing results and known control weaknesses. Why it matters: inherent risk only becomes residual risk once you account for how well your controls work.

Completeness check against FATF Recommendation 1

Once the seven items are drafted, test completeness with a short cross-reference. Recommendation 1 expects risks to be understood across customers, countries or geographic areas, and products, services, transactions and delivery channels. Map your seven items to those categories:

• Customers: item 3
• Countries and geographic areas: items 1 and 2
• Products and services: item 4
• Transactions: items 2 and 6
• Delivery channels: item 5
• Control effectiveness and residual risk: items 6 and 7

If any category has no supporting item, the assessment is incomplete. If any item maps to no category, ask why you are collecting it. Also check whether any national risk assessment or supervisory guidance applies to you and whether you have reflected it.

The evidence format that satisfies reviewers

Both the SAMA annual review and an independent assessor look for the same thing: a trail from data to conclusion. For each of the seven items, keep a single evidence record with these elements:

1. The data source, named precisely, with the extraction date and period covered.
2. The method used to turn the data into a risk rating, including any weighting.
3. The inherent risk rating and the reasoning behind it.
4. The controls considered and the residual risk rating.
5. The named owner and the approver, with the approval date.
6. The next scheduled refresh and the events that would trigger an earlier one, such as a new product, a new market or a change in FATF listings.

Keep the records together with a single consolidated assessment document approved by senior management and reported to the board. Version it, so a reviewer can see what changed between cycles and why.

Common gaps to look for

• Country risk copied from a prior year without checking current FATF statements.
• Geographic risk based on customer addresses only, with no transaction analysis.
• A product inventory that omits recently launched or partner-delivered services.
• Internal inputs missing entirely, so the assessment reflects only external data.
• A scoring model whose risk factors cannot be traced to any line of the assessment.

Moving from assessment to scoring

When the seven items are complete and approved, the customer-risk scoring model has a documented basis. Each factor in the model should trace back to an item above, and each weighting should have a reason you can state. That traceability is what turns a scoring model from a technical tool into a defensible control.

How CISO Consulting can help

If you want an independent view of whether your risk assessment holds up, our AML Assessment reviews your AML/CTF program against the SAMA rules and the FATF Recommendations. It includes an enterprise-wide ML/TF risk assessment review, a policy and procedure review, and sample testing of customer files and alerts.

The assessment runs in four stages: plan, review, test and report. The assessment takes 5–8 weeks. You receive an independent AML/CTF assessment report, findings rated by severity, a remediation roadmap and a board summary. The assessment is designed to serve as independent testing of your AML/CTF program, and the sample is risk-based and agreed with you, typically covering every high-risk segment.