| name | bsa-risk-assessment |
| title | BSA/AML Risk Assessment |
| description | Drafts a BSA/AML Risk Assessment for U.S. financial institutions per FinCEN, FFIEC, and OCC standards. Evaluates inherent risks (customer, product, geographic, transaction, third-party), control adequacy, and residual risk. Use when preparing annual BSA compliance assessments, post-acquisition integration reviews, or when business changes trigger reassessment under 31 U.S.C. § 5318(h). |
| author | CaseMark |
| author_url | https://github.com/CaseMark/skills/tree/main/skills/legal/bsa-risk-assessment |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | white-collar |
| language | en |
BSA/AML Risk Assessment
Produces examination-ready BSA Risk Assessments evaluating inherent AML/CFT risks against mitigating controls per FFIEC BSA/AML Examination Manual methodology.
Prerequisites
Gather before drafting:
- Institution profile — entity type, charter/regulator, total assets, branch footprint, international relationships
- Products & services — inventory with volumes for high-risk products (wires, monetary instruments, prepaid, trade finance, crypto on/off ramps)
- Customer data — segments with counts of high-risk categories (cash-intensive businesses, PEPs, NRAs, MSBs, foreign correspondents)
- BSA/AML program docs — policies, CIP/CDD/EDD procedures, monitoring system specs, training records
- Filing history — annual CTR/SAR counts by category
- Independent testing — most recent scope, findings, remediation status
- Regulatory history — outstanding MRAs, MOUs, enforcement actions
Document Sections
1. Executive Summary
Overall risk rating (Low/Moderate/High), key concentrations, control gaps, priority recommendations with owners and target dates.
2. Introduction
- Regulatory basis: 31 U.S.C. § 5318(h); 31 C.F.R. § 1020.210
- Scope: all business lines, products, customers, geographies
- Assessment period and update frequency (typically annual)
- FFIEC risk-based methodology alignment
3. Institution Overview
Table covering: entity type, charter/regulator, total assets, branch count, high-risk products offered, customer segments, annual CTR/SAR filing counts.
4. Inherent Risk Identification
Five risk dimensions, each rated High/Moderate/Low:
- Customer — cash-intensive businesses, MSBs, NBFIs, PEPs, NRAs, nonprofits, foreign correspondents, FATF-listed jurisdiction customers
- Product & Service — flag products enabling anonymity, rapid movement, or cross-border activity (wires, prepaid, private banking, trade finance, digital channels, crypto)
- Geographic — HIDTA/HIFCA areas, FATF grey/black list jurisdictions, FinCEN GTO zones, OFAC sanctioned countries
- Transaction — high-volume cash, structuring patterns, funnel accounts, rapid cycling, shell companies, trade-based ML
- Third-Party — independent agents, outsourced onboarding/processing, fintech partnerships
5. Risk Assessment Matrix
