Guidelines on Institutional Risk Assessments

Summary

This is guidance jointly issued by the BVI Financial Services Commission (FSC) and the Financial Investigation Agency (FIA) explaining how regulated entities should conduct an Institutional Risk Assessment (IRA) of money laundering, terrorist financing and proliferation financing (ML/TF/PF) risk, as required under Section 12 of the Anti-Money Laundering and Terrorist Financing Code of Practice (AMLTFCOP). It sets out the risk factors to consider, governance expectations for the Board and senior management, and includes a self-assessment questionnaire (Appendix 1) that licensees can use to test the adequacy of their existing IRA process.

• Who it applies to: All FIs and DNFBPs supervised by the FSC or FIA and subject to the AML Regulations, collectively termed 'licensees' in the Guidelines.
• Core requirement: Licensees must conduct an IRA of their overall business covering product/service, customer, country/geographic and delivery channel risk.
• Documentation and governance: The IRA must be documented, with a record of the approval process, and formally approved by senior management and the Board of Directors, which must also set a Risk Tolerance Statement.
• Review cycle: The IRA must be reviewed and updated on an ongoing basis, at least annually, and whenever risk inputs or factors change.
• New products/services: An IRA must be conducted before launching new products, business practices, delivery mechanisms or technological developments.
• Availability to regulators: The IRA must be made available to the FSC or FIA upon request.
• Training: Licensees are expected to provide staff training on institutional risk assessments.

The Guidelines are advisory in nature but are explicitly tied to a binding AMLTFCOP obligation, so failure to conduct or maintain an adequate IRA may expose licensees to supervisory findings. The appended questionnaire can be used by compliance officers, MLROs and internal audit to benchmark their IRA process against the FSC/FIA's expectations.

Key obligations

• Conduct an institutional risk assessment (IRA) of overall ML/TF/PF risk as required by Section 12 of the AMLTFCOP
• Document the IRA and maintain a record of its approval process
• Obtain formal approval of the IRA and any changes from senior management and the Board of Directors
• Have the Board of Directors set out a Risk Tolerance Statement
• Review and update the IRA on an ongoing basis, at least annually
• Update the IRA whenever risk inputs or factors change
• Conduct an IRA prior to launching new products, services, business practices, delivery mechanisms or technology
• Make the IRA available to the FSC or FIA upon request
• Provide staff training in institutional risk assessments
• Assess product/service, customer, country/geographic and delivery channel risk, including reliance on third parties and use of technology

Applies to

banks, insurance entities, trust and company services providers (TCSPs), investment business licensees, financing business, money service businesses (MSBs), insolvency services providers, virtual asset service providers (VASPs), legal practitioners, notaries public, accountants, real estate agents, dealers in precious metals and stones (DPMS), high value goods dealers (HVGD), vehicle dealers, persons engaged in the business of buying and selling boats

Deadlines

• at least annually: IRA must be reviewed and updated on an ongoing basis but at least once a year
• prior to launch of new products, services, business practices, delivery mechanisms or technology: An IRA must be conducted before offering new products/services or adopting new delivery mechanisms or technology
• within 12 months: Appendix 1 questionnaire references testing/screening of third-party introduced clients and internal spot checks having been carried out within the last 12 months