Risk assessment refresh: what the decision maker looks at
A risk assessment refresh checks whether an obliged entity's exposure to money laundering and terrorist financing has changed since the last review. The compliance officer prepares the file, senior management approves it, and the supervisory authority is told only if the rating moves to a higher band.
What changes once the refresh is triggered
The refresh resets the clock on the entity's monitoring cycle. Enhanced due diligence measures stay in place until the new rating is confirmed, not until the trigger event closes. A refresh also pauses onboarding of new high-risk customers in the same segment until the file is signed off.
Certain events shorten the interval between refreshes automatically. A change in beneficial ownership, a new product line, or a jurisdiction added to a sanctions list all move the next review forward. The table below sets out the stages most decision makers recognise, without tying any stage to a fixed statutory deadline.
| Stage | Typical trigger | Core document | Who signs off |
|---|---|---|---|
| Screening update | New adverse media or watchlist hit | Updated customer risk profile | Compliance officer |
| Rating recalculation | Change in product, geography or ownership | Risk matrix worksheet | Compliance officer |
| Escalation | Rating moves into a higher band | Escalation memo | Senior management |
| Notification | Rating reaches the reporting threshold | Notification file | Supervisory authority |
Steps to run the refresh
- The compliance officer pulls the current customer file and lists every event since the last review.
- The compliance officer recalculates the risk score against the entity's own matrix, not against a competitor's template.
- Where the entity has moved a product from pilot to live operation, the compliance officer checks whether that shift changes the risk profile — the same question that arises When a proof of concept becomes production.
- Senior management reviews the recalculated score and either confirms the existing rating or approves escalation.
- The compliance officer files the updated profile and sets the date for the next scheduled refresh.
- Where the rating crosses the reporting threshold, the compliance officer prepares the notification to the supervisory authority.
Who decides and by when
The compliance officer owns the file end to end and proposes the rating. Senior management approves any escalation and any change to the customer relationship. The supervisory authority is the forum only once the notification threshold is reached; below that line, the decision stays inside the entity.
In practice, a routine refresh with no escalation closes within two to four weeks. A refresh triggered by an ownership change or a new jurisdiction typically takes longer, because it depends on documents from outside the entity.
Where the decision forks
If the rating stays in the same band, the compliance officer files the update and the cycle continues unchanged.
If the rating moves up one band, senior management approves enhanced measures before the next transaction is processed.
If the entity sits inside a group where another entity holds a different permission, the refresh should be coordinated with that entity's file. The same coordination question is covered in A group entity holds a different permission authorisation who.
If a change of ownership is underway, the refresh should not close until that question is settled. The same principle applies in When a change of control triggers termination, where a pending change of control is treated as a separate decision point.
What this page does not cover
This page does not set out national statutory deadlines for notification; those depend on the entity's home supervisory authority and are not restated here. It does not cover disputes over inventorship inside the organisation, a separate governance question addressed in When an ex-employee appears as an inventor elsewhere. It also does not cover the cost of running the refresh internally or through outside counsel.
Verified
This overview reflects procedural practice observed across obliged entities in the digital assets sector and is checked against publicly available supervisory guidance. Last checked: June 2025. No statutory article or national implementing provision is cited on this page, because the underlying national record for this jurisdiction is not yet complete.
FAQ
How long does risk assessment refresh take in practice?
A routine refresh with no escalation usually closes within two to four weeks. A refresh triggered by an ownership change, a new jurisdiction or a product launch takes longer, because it depends on documents the entity does not control and on senior management's calendar.
Which documents are needed to start?
The compliance officer needs the existing customer risk profile, the risk matrix used at the last review, and a record of every trigger event since that date — ownership changes, new products, adverse media, or watchlist hits.
What happens if the other side does not respond?
If the customer does not respond to a request for updated information, the compliance officer notes the gap in the file and applies the risk rating that the missing information would justify — usually the higher one. The relationship is restricted until the gap closes, not closed automatically.
Related reading
The refresh sits next to the design of the underlying due diligence file, covered step by step in Customer due diligence design step by step.
Next step
If a live file has already stalled, the practical next move is set out in What to do first in this situation.