Internal Risk Assessment in India

It is the entity’s own, organisation-level study of where its money-laundering, terrorist financing and proliferation-financing risks lie, and how well its controls answer them. Under the RBI Internal Risk Assessment Guidance of 10 October 2024, the entity identifies risk factors, scores and weights them, assesses the strength of controls and derives a residual risk. The RBI calls the enterprise-level assessment the bedrock of the risk-based approach. Everything else in the AML programme is built on it.

In substance, yes. The RBI guidance uses the terms “internal risk assessment” and “enterprise-level risk assessment”. The enterprise-wide risk assessment, or EWRA, is the common international term for the same exercise. They all describe a single, entity-wide view of risk, as distinct from the rating of an individual customer. Use whichever term your policy adopts consistently.

The guidance requires the IRA at two levels. The business-level IRA assesses the risk arising from the entity’s business model and must be proportionate to the entity’s size and complexity. The individual-level IRA assesses each customer and each occasional transaction, resulting in a high, medium, or low risk categorisation. The two connect because the individual-level results feed the weighting in the business-level exercise. This two-level structure is the RBI-guided methodology; entities in other sectors apply the same risk-based logic under their own regulator, supervisor or FIU framework.

Yes. For banks, the binding obligation is paragraph 10 of the RBI Commercial Banks KYC Directions, 2025, which requires that the assessment be carried out, documented, reviewed at least annually, and placed before the Board. The RBI IRA Guidance dated 10 October 2024 provides a methodology rather than a binding rule. The duty traces back to the PML Rules and the PMLA, and the risk-based approach implements FATF Recommendation 1. Other sectors carry the same duty under their own regulator or FIU framework.

Residual risk is what remains after the entity’s controls are applied to its inherent risk. The guidance illustrates a residual-risk matrix that reads the strength of control, strong, satisfactory or weak, against the inherent risk level, high, medium or low. Strong control over a high inherent risk yields a medium residual risk, while weak control leaves it high. The enterprise-wide residual risk should be derived using the documented methodology, which may combine weighted scores, matrix logic, override rules and management judgement. The method must be consistent, evidence-based, and explainable to the supervisor.

The guidance provides an indicative list across five groups: customer risk, including type, ownership, occupation, and PEP status; countries and geographical areas; products, services, and transactions; delivery channels; and other factors, such as the National Risk Assessment outcomes, new products, AML staff turnover, and past enforcement actions. It also flags risks related to new technology and wire transfer information. The entity must define its own factors for its book.

The guidance sets rules to keep weighing honestly. No single factor should dominate, profit considerations must not influence the weights, and the method must always allow a relationship to be rated high risk, with the ability to override a score upward and document the reason. The views of the regulator and law enforcement regarding past violations should be taken into account. Where a vendor model assigns the scores, the entity must understand and be able to demonstrate the logic to the supervisor.

In the RBI-guided methodology, proliferation-financing and targeted-financial-sanctions exposure should be considered within the IRA, particularly where the entity faces risks of sanctions breach, non-implementation or evasion. The guidance frames risk throughout as money-laundering, terrorist financing and proliferation-financing risk together. PF risk arises from a breach or non-implementation of targeted financial sanctions and from their evasion. Anchored in the Master Direction on KYC and Section 12A of the WMD Act, the entity conducts a PF risk assessment, incorporates it into the IRA, and implements mitigation measures, with the FATF June 2021 PF guidance as a reference.

For banks, the Commercial Banks KYC Directions, 2025 require the assessment to be reviewed at least annually, with the Board or a Board committee setting the periodicity. Beyond that, the RBI guidance expects a review whenever the business changes or new threats emerge, and the entity should set its own triggers. Named triggers include a new product, a new jurisdiction, the issuance of the National Risk Assessment, adverse regulatory or audit observations, and a change in the entity’s profile. A review can also be brought forward based on the gravity of what is found.

The outcome must be presented to the Board or a committee of the Board with sufficient information for them to take a view, and the results should also reach the relevant business verticals. Senior management is expected to fully support the exercise. The work itself should be done by a cross-functional team, including product owners and internal audit and compliance, rather than by the AML team in a silo. Recording the Board’s consideration is part of the evidence trail.

No. The RBI guidance targets RBI-regulated entities, but every reporting entity under the PMLA must assess its risk under its own regulator, supervisor or FIU framework. See the sector breakdown above for how the obligation differs by sector.

Inherent risk is the risk an entity faces before its controls are applied, driven by its customers, products, geographies and channels. Residual risk is what remains after the controls are applied. The gap between the two indicates how much work the controls are performing and where the entity remains exposed. An entity lowers its residual risk only by reducing inherent risk or by strengthening controls, and it assesses the residual risk against its own risk appetite.

A tool can do much of the heavy lifting, pulling data, applying weights and producing scores, but the entity stays responsible for the result. The RBI guidance is explicit that where a vendor tool assigns the scores, the entity must understand how it weighs the factors and be able to demonstrate to the supervisor that the scores reflect its own understanding of risk. So software supports the assessment and makes the refresh repeatable, but it does not replace the entity’s judgement, the cross-functional input or the Board’s ownership.

Keep the IRA report itself, with the business profile, the methodology, the risk factors with their weights and scores, the inherent and residual risk, and the mitigation plan. Alongside it, keep the data inputs the assessment relied on, the control-effectiveness testing, the internal audit findings, the five-year enforcement history and the Board paper and minutes that record the Board’s consideration. This evidence pack is what an inspector asks for.