Risk refers to the likelihood or probability that an event will actually occur.  The likelihood or probability factors for ML TF include customer, product, service, geography and delivery channel. 

Once the likelihood or probability is known, the consequence or impact is measured. The consequence or impact elements for ML TF will include regulatory action and reputational damage.  

Measurement of risk may be in quantitative or qualitative terms, or a combination of both.  Once the level of risk is known, the question is then asked, ‘Is the risk tolerable”? If the risk is tolerable, no further action may be necessary but the situation will still need to be monitored and the risk assessment repeated at a later date or as changes arise. 

If the risk is not tolerable, systems and controls will be put in place to mitigate, manage and monitor the risk.  The robustness of the controls and the frequency of monitoring will reflect the level of risk.  Controls being relied upon will be set out in the AML CFT programme and will include matters such as customer due diligence, transaction monitoring and senior management reporting.