Wolfsberg questionnaire FATF risk assessment alignment is a practical problem before it is a theoretical one. A bank completes its correspondent banking questionnaire, names the jurisdictions it regards as high risk, and then submits an internal risk assessment in which every customer receives the same due-diligence steps regardless of country. Anyone reading both documents side by side can see the mismatch. This guide explains how to remove it.
The expectation comes from two sources. SAMA's AML/CTF rules and FATF Recommendation 1 both require a risk-based approach: the institution identifies and assesses its money laundering and terrorist financing risks, and applies measures proportionate to them. The Wolfsberg Group's correspondent banking questionnaire asks how you assess risk. If your answers describe differentiation that your procedures do not deliver, the questionnaire becomes evidence against the assessment.
When you need to do this work
Consider a review if any of the following applies:
- You are about to complete or refresh a Wolfsberg questionnaire for a counterparty.
- Your enterprise-wide risk assessment was last updated without reference to your KYC procedures.
- Country risk is scored in one document and applied in none.
- A SAMA inspection or internal audit is approaching.
- Relationship managers answer questionnaire items from memory rather than from a controlled source.
The seven indicators
We use seven indicators as the quantified backbone of country and relationship risk. Check the current Wolfsberg questionnaire wording for how each is framed, because versions change.
- Sanctions exposure: dealings with, or nexus to, sanctioned jurisdictions or persons under UN, local, OFAC or EU regimes.
- Corruption Perceptions Index score: the published country score, used as a proxy for corruption risk.
- FATF grey-list status: whether the jurisdiction is under increased monitoring or subject to a call for action.
- Correspondent volume: the value and number of transactions with a given respondent or country.
- Product complexity: for example payable-through accounts, trade finance, cash services or nested relationships.
- Ownership transparency: how readily beneficial ownership can be established and verified.
- PEP prevalence: the share of the respondent's customer base, or ownership, that comprises politically exposed persons.
The four-column matrix
For each indicator, record four things. The matrix works because every row has a number, an action and a proof.
- Indicator: one of the seven above, defined in the same words used in your questionnaire response.
- Threshold: the quantified level at which the indicator changes the risk rating. Use a defined score, a list status, a value band or a yes/no condition. A threshold such as "elevated" is not a threshold.
- Due-diligence trigger: the specific procedural consequence when the threshold is crossed, such as enhanced due diligence, senior management approval, a shorter review cycle, restricted products or exit review.
- Evidence artifact: the document that proves the trigger operated, such as a dated country-risk register, an approval record, a screening log or a file note.
An illustrative row: indicator, FATF grey-list status; threshold, jurisdiction appears on the list at the date of onboarding or review; trigger, enhanced due diligence and senior approval before the relationship continues; artifact, the approval record with the list date shown. Thresholds are yours to set and justify. The matrix does not prescribe values.
How to build it
Start from the risk assessment, not the questionnaire. Define each threshold in the enterprise-wide assessment, then trace it into the KYC policy and the onboarding and periodic review procedures. Only then draft the questionnaire answers, quoting the matrix.
Three checks catch most inconsistencies. First, every jurisdiction you call high risk in the questionnaire must map to at least one trigger that differs from standard due diligence. Second, every trigger must have an owner and an evidence artifact that exists in practice. Third, the thresholds must be applied in sampled customer files, not only written in policy.
Common failures include a country score that has no effect on review frequency, grey-list changes that are not fed into the register, and ownership transparency described as a concern but never tested.
What a good outcome looks like
A well-aligned bank can answer a simple question: show me how this country rating changed what you did for this customer. The risk assessment, the KYC procedure, the questionnaire and the customer file tell the same story. Changes in country status flow into the register and then into reviews. Where the bank chooses not to differentiate, the reasoning is documented.
How we run an AML assessment
Our AML Assessment is an independent review of your AML/CTF program against the SAMA rules and the FATF Recommendations, covering governance, risk assessment, KYC, monitoring, reporting and training. Wolfsberg is among the frameworks we work to. The process has four stages.
- Plan: scope, risk profile and sample design.
- Review: policies, risk assessment and governance.
- Test: customer files, alerts and reports.
- Report: rated findings, roadmap and board summary.
The features most relevant here are the enterprise-wide ML/TF risk assessment review, the policy and procedure review, and sample testing of customer files and alerts. The file sample is risk-based and agreed with you, typically covering every high-risk segment, which is where a matrix of this kind is most likely to be tested. The assessment takes 5–8 weeks.
You receive an independent AML/CTF assessment report, findings rated by severity, a remediation roadmap and a board summary. The assessment is designed to serve as independent testing of your AML/CTF program.
If the thresholds in your matrix depend on screening or monitoring, the model validation and sanctions program work we offer can examine those controls separately.
Next step
If your questionnaire and risk assessment have not been read against each other recently, an AML Assessment is a sound way to do it. Contact CISO Consulting to agree scope and sample design.
