Products / RiskReady
The risk assessment your regulator expects, built around your business.
RiskReady is Taft’s enterprise compliance risk assessment, the engagement the industry calls a risk 360. Every regulatory obligation you carry, the inherent risk in your products, customers, geographies and channels, the controls that address it, and the residual risk that is left, in one document a board and an examiner can read.
Who it’s for
For firms whose risk assessment is missing, out of date, or nobody’s.
- A newly licensed business that wants a documented risk assessment in place before its first examination.
- A firm whose assessment is a spreadsheet built for a product set and a customer base it no longer has.
- A group with several entities and no consistent way of measuring the same risk across them.
- A board or audit committee that wants the firm’s compliance risk stated plainly, with the controls that hold it and the places where they do not.
What you get
What you receive.
A risk assessment is not a heat map. It is the reasoning behind the heat map, written so that the next person can follow it and the examiner can test it.
Regulatory inventory
Every obligation that applies to you, by regulator, license, product and jurisdiction, and the ones that do not, with the reason.
Inherent risk assessment
The risk your business carries before any control: products and services, customers, geographies, channels and transactions, rated on a scale you can defend.
Control assessment
The controls that address each risk, whether they exist, whether they are designed well, and whether there is evidence they operate.
Residual risk and heat map
What is left after the controls, on one page, by risk area and by entity.
Prioritized action plan
The residual risks above your appetite and the controls that need work, in order, with owners and dates.
Methodology and board paper
How the assessment was done, in a form the board can approve and the examiner can read, so the next refresh starts from a record rather than a memory.
Options
Three depths.
Scoped to the firm: one risk area, the whole enterprise, or a group with several regulated entities.
RiskReady Focus
- One risk area, such as financial crime, sanctions or conduct
- One entity
- Inventory, inherent risk, controls, residual risk and actions for that area
RiskReady 360
- The enterprise compliance risk assessment
- Every applicable risk area for one entity
- Methodology and board paper included
RiskReady Group
- Several entities, licenses or jurisdictions
- One methodology, entity-level results and a group view
- Group requirements against local ones
How we assess
Obligation, inherent risk, control, residual risk. In that order, every time.
The order matters because each step depends on the one before it. A control without an obligation behind it is noise; an obligation without a control behind it is a finding.
Obligations
What the rules require of a firm with your licenses, products and customers, and what they do not.
Inherent risk
How much risk each product, customer type, geography and channel brings on its own, rated consistently and explained.
Controls
What you do about it, tested against design and against evidence of operation, not against the policy’s description of itself.
Residual risk
What is left, whether it is within your appetite, and what to do where it is not.
When to do it
Before the examiner asks for it.
After licensing
For an SEC-registered investment adviser, the SEC staff’s typical initial examination request includes information about the compliance risks the firm has identified and the written policies and procedures it has adopted to address each of them. A documented risk assessment is one way to have that information ready. The staff say the scope of an examination varies with the firm’s business model, its risks and the reason for the examination. The risk alert is a staff statement with no legal force or effect. Source: SEC Division of Examinations, Risk Alert, Investment Advisers: Assessing Risks, Scoping Examinations, and Requesting Documents (September 6, 2023), https://www.sec.gov/files/risk-alert-ia-risk-and-requesting-documents-090623.pdf
After growth or a new product
New customers, new geographies and new channels change the inherent risk. The assessment has to move with them.
After a finding
A finding on one control is a reason to rate the risk behind it again.
Every year
A risk assessment is a living document. An annual refresh keeps it current and keeps the board’s approval meaningful.
EWRA, BWRA, risk 360
One assessment, several names.
Regimes and firms use different names for this work. Some are industry terms and some come from the rules themselves. Each entry below says which.
Enterprise-wide risk assessment (EWRA)
Used by firms for a firm-level assessment of money laundering, terrorist financing and sanctions risk across products, customers, geographies and channels. The OCC has also used the term: a 2015 consent order required one bank to include an enterprise-wide assessment of AML risk, which the order said was to identify systemic AML risk that a line-of-business assessment may not show. That requirement applied only to that bank under that order; it is not a general rule. What a firm’s assessment must cover, how it is documented and who approves it depend on the regime that applies, as the entries below show. In RiskReady 360 that assessment is one part of the enterprise compliance risk assessment. Source: OCC Consent Order, U.S. Bank National Association, AA-EC-2015-77, Article IV (October 23, 2015), https://occ.gov/static/enforcement-actions/ea2015-113.pdf
Business-wide risk assessment (BWRA)
A regulatory term. The EU Anti-Money Laundering Regulation is a binding regulation that applies to obliged entities from July 10, 2027. Article 10 requires their business-wide risk assessment to be documented, kept up to date and regularly reviewed, drawn up by the compliance officer and approved by the management body in its management function. Supervisors may exempt some obliged entities from an individual documented assessment, but not, among others, credit institutions or financial institutions. Source: Regulation (EU) 2024/1624, Articles 10 and 90 (May 31, 2024), https://eur-lex.europa.eu/eli/reg/2024/1624/oj
Group-wide risk assessment
Also a term from the same EU Regulation. Under Article 16, from July 10, 2027, a parent undertaking performs a group-wide risk assessment that takes into account the business-wide risk assessment of every branch and subsidiary of the group. RiskReady Group gives several entities one methodology, entity-level results and a group view. Source: Regulation (EU) 2024/1624, Article 16 (May 31, 2024), https://eur-lex.europa.eu/eli/reg/2024/1624/oj
Risk assessment under the UK regulations
Regulation 18 of the Money Laundering Regulations 2017, a binding UK statutory instrument, requires a relevant person to take appropriate steps to identify and assess the money laundering and terrorist financing risks to which its business is subject. It must keep an up-to-date written record of those steps, unless its supervisory authority notifies it in writing that a record is not required. Source: The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, SI 2017/692, regulation 18 (legislation.gov.uk, up to date to November 7, 2026), https://www.legislation.gov.uk/uksi/2017/692
BSA/AML risk assessment
A common US industry name. FinCEN’s anti-money laundering program rules are binding and risk-based, but the two cited here do not use the words “risk assessment”. A money services business’s program must be commensurate with the risks posed by its location and size and by the nature and volume of its financial services. A bank’s program must include appropriate risk-based procedures for ongoing customer due diligence. Source: 31 CFR 1022.210(b) (eCFR, up to date as of November 5, 2026), https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/subpart-B/section-1022.210. Source: 31 CFR 1020.210(a)(2)(v) (eCFR, up to date as of November 5, 2026), https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1020/subpart-B/section-1020.210
Sanctions risk assessment
OFAC’s Framework for OFAC Compliance Commitments is guidance, not a rule. It says each sanctions compliance program should incorporate at least five essential components, one of which is risk assessment, and gives as examples an assessment of customers, intermediaries and counterparties, products and services, and geographic locations. Source: OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), https://ofac.treasury.gov/media/16331/download
Risk 360
An industry term for an enterprise-wide compliance risk assessment. RiskReady 360 is Taft’s version.
One row, illustrated
What one row of a risk assessment looks like. The firm and the data are invented.
This example is illustrative. The firm is a fictional US money transmitter whose customers send payments abroad, including through two payout corridors that border a comprehensively sanctioned country. The rating scale is an example scale for this illustration only, written down before anything is rated. No score is multiplied or averaged, and every rating carries its reason.
Example scale
Illustrative only. Low: few risk factors, and the product itself limits exposure. Moderate: some risk factors, and standard controls are expected. Elevated: several risk factors, or one significant one, and specific controls are expected. High: significant risk factors in combination, and specific controls and senior oversight are expected.
Risk
Sanctions exposure in cross-border payouts: a sanctioned person sends or receives funds through the firm.
Inherent risk: High
Rationale: three risk factors combine. Geography: two payout corridors border a comprehensively sanctioned country. Customer: the firm does not onboard the recipients. Channel: payments are initiated online, from anywhere.
Controls
Screening of senders and recipients against OFAC’s sanctions lists before release. Blocking of log-ins from sanctioned jurisdictions by IP address. Enhanced review of payouts above a set amount in the two border corridors.
Control evidence
Screening: the configuration export, the list-update log and a sample of cleared alerts with reviewer notes. Enhanced review: a sample of reviewed payouts with sign-offs. IP blocking: the rule is configured, but no test shows it works, so it earns no credit.
Residual risk: Elevated
Rationale: one step down from High, because screening and enhanced review are evidenced. Not two steps, because without a tested IP block, a sender logging in from a sanctioned jurisdiction is caught only if the name matches.
Limitations
Rated on four quarters of the firm’s own transaction data. The payout partner’s screening was not reviewed, because the firm has no access to its records. Screening thresholds were taken as configured, not independently tested.
Board decision
Illustrative. The board records that Elevated is above its stated appetite for sanctions risk. It approves a test of the IP block, with a named owner and date, and asks for the row to be rated again once the test is complete. The original rating stays on the record, and the new rating is added beside it with its own date.
How it runs
How it runs.
Scope
Entities, licenses, products, customers, geographies and channels, agreed before anything is assessed.
Gather
Policies, procedures, control inventories, testing results, data on customers and transactions, previous assessments and regulatory correspondence, through a secure channel.
Assess
Obligations mapped, inherent risk rated, controls tested against design and evidence, residual risk calculated on a method we write down.
Challenge
Senior Taft practitioners test the ratings against how the business actually operates and against what examiners are asking firms like yours.
Report
The assessment, the heat map, the action plan and the board paper, presented to management and, if you want, to the board.
Questions
Asked before, answered plainly.
- Is RiskReady a risk 360?
- Yes. Risk 360 is the industry term for an enterprise-wide compliance risk assessment, and RiskReady is Taft’s version of it: obligations, inherent risk, controls and residual risk, across every applicable risk area, in one document.
- How is it different from the Compliance X-Ray?
- The X-Ray tests whether your framework holds together, from obligation to policy to control to evidence. RiskReady measures the risk itself and whether the controls bring it within your appetite. Firms often do the X-Ray first and RiskReady second; either can stand alone.
- Do regulators require a risk assessment?
- It depends on the regime. In the United Kingdom, regulation 18 of the Money Laundering Regulations 2017 requires a relevant person to assess its money laundering and terrorist financing risks and keep an up-to-date written record of the steps it took, unless its supervisory authority notifies it in writing that no record is required. Source: SI 2017/692, regulation 18, https://www.legislation.gov.uk/uksi/2017/692. From July 10, 2027, the EU Anti-Money Laundering Regulation requires obliged entities to document a business-wide risk assessment, and the exemption a supervisor can grant does not extend to credit or financial institutions. Source: https://eur-lex.europa.eu/eli/reg/2024/1624/oj. FinCEN’s US anti-money laundering program rules are risk-based, but the program rules for money services businesses and banks do not use the words “risk assessment”. Source: https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/subpart-B/section-1022.210. Source: https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1020/subpart-B/section-1020.210. OFAC’s guidance, which is not a rule, names risk assessment as one of five essential components of a sanctions compliance program. Source: https://ofac.treasury.gov/media/16331/download
- Can you refresh an assessment we already have?
- Yes. If the method is sound we keep it and update the inputs. If it is not, we say so and rebuild it, keeping whatever history is worth keeping.
RiskReady is an assessment by compliance practitioners. It is not legal advice, not an audit, and it does not replace independent testing required by your regulator.