Risk assessment refresh: stages and deadlines
A risk assessment refresh moves through four stages: trigger review, data collection, reassessment, and sign-off. For an obliged entity handling digital assets, the full cycle typically runs four to eight weeks. The point of no return arrives once the updated risk rating is approved and filed, because reopening it afterwards means starting a new cycle, not correcting the old one.
What triggers a refresh
Triggers fall into three groups: internal, external, and supervisory. An internal trigger is a new product line or a change in ownership structure. An external trigger is a new vendor relationship carrying elevated data risk, often flagged when a security addendum arrives with a contract; that situation is covered separately in When a security addendum arrives with the order form.
A supervisory trigger arises when the authority asks direct questions about governance and accountability. Decisions on who signs off shift at that point, and the refresh restarts from the moment those questions are raised. That scenario is set out in A supervisor asks about governance authorisation who decides and.
Stages and documents
Each stage produces a defined output before the next one begins. Skipping an output does not shorten the cycle; it usually restarts it once a reviewer notices the gap.
| Stage | Output | Typical duration |
|---|---|---|
| Trigger review | Written trigger log entry | 1–3 business days |
| Data collection | Updated customer and product data set | 1–3 weeks |
| Reassessment | Draft risk rating with rationale | 1–2 weeks |
| Sign-off | Approved and filed risk assessment | 2–5 business days |
Who decides
The compliance officer owns the process from trigger to draft rating. Senior management reviews and approves the draft before it becomes the current assessment. For material changes — a new business line, a new jurisdiction, a governance shake-up — the board or an equivalent body is informed even where it does not sign the document itself.
Internal policy usually sets two clocks running at once: a fixed review cycle, often annual, and a shorter trigger-based clock that starts the moment a qualifying event is logged. The trigger-based clock takes priority when both apply at the same time.
What to do
- Compliance officer logs the trigger event on the day it is identified.
- Compliance officer collects updated customer, product, and channel data.
- Compliance officer drafts the revised risk rating with written rationale.
- Senior management reviews the draft and either approves it or sends it back with comments.
- Compliance officer files the approved assessment and notifies the teams whose controls depend on it.
Forks
If the trigger is supervisory rather than internal, notify senior management immediately and move the assessment to the front of the queue. A delayed response to a supervisory question compounds faster than a delayed internal review.
If your organisation operates through contracts spanning several jurisdictions and the territorial scope of those contracts was never clearly fixed, the refresh must also close that gap before sign-off; the underlying contract problem is described in When the parties never agreed the territory.
If the customer base includes politically exposed persons, add an enhanced review step before the draft rating goes to senior management, rather than folding it into the standard reassessment stage.
Limit
This page describes the mechanics of a refresh: stages, documents, and the sequence of approvals. It does not set out the specific statutory deadlines that apply to your entity, and it does not determine whether a given delay exposes you to a supervisory sanction. Those questions depend on facts we have not reviewed here and should go to counsel before a deadline is missed rather than after.
Verified
We checked this procedure description against our internal AML policy before publication and update it whenever that policy changes. It does not cite external legal provisions, because a stage-by-stage procedural overview does not require them; the specific rules applicable to your entity should be confirmed separately with counsel.
Related publications
The onboarding process that feeds the data collection stage above is covered in Customer due diligence design step by step.
FAQ
How long does risk assessment refresh take in practice?
Most refreshes complete in four to eight weeks from trigger to sign-off. Straightforward internal triggers with clean data sit near the shorter end; supervisory triggers with cross-border data tend to sit near the longer end.
Which documents are needed to start?
You need the trigger log entry, the prior risk assessment, current customer and product data, and, where governance has changed, an updated organisational chart showing who now signs off.
What happens if the other side does not respond?
If a customer or counterparty does not provide requested information during data collection, log the non-response, extend the timeline in writing, and rate the relevant risk conservatively until the gap closes. Silence is not treated as a clean result.
Next step
If your organisation is also facing a related dispute — for example, a counterparty demanding damages without evidence to support the claim — our overview of that situation may help: When damages are demanded without evidence. Contact us to talk through your current refresh cycle or any adjacent dispute; we respond in minutes during business hours and confirm scope within one business day.