Controls struggle to keep pace

Where this pressure most often appears in the customer lifecycle

Onboarding

Ongoing monitoringPrimary

Exit & de-risking

Right when it was built is not the same as right now

In June 2026, the Wolfsberg Group published its first update to its risk-based approach guidance since 2006. It puts the problem plainly: a focus on everything is a focus on nothing. The FCA’s own multi-firm review of risk assessment processes, published in November 2025, found something similar in practice: most firms have a business-wide risk assessment, but few can explain how they manage the risks it identifies, and very few have documented what they did in response to their own findings.

A separate FCA survey of corporate finance firms, updated in December 2025, put numbers on the gap: 11% of the 270 firms that responded had no documented business-wide risk assessment at all, 27% didn’t use a customer risk assessment form, and 10% couldn’t produce evidence of the due diligence they’d done.

None of this is a pure documentation gap. Products change, markets open, and the threat landscape shifts, but nobody owns checking whether an assessment that was right when it was built is still effective now. That gap in ownership means the firm’s attention, resourcing and monitoring keep pointing at where the risk used to sit, not where it actually is now. That’s exactly where new and evolving risk goes unnoticed: the account that shouldn’t have opened, the payment that shouldn’t have cleared, the sanctioned individual who should have been screened out but wasn’t.

The EU is also widening what a control framework has to cover. From 10 July 2027, the AMLR applies to all crypto-asset service providers, high-value goods traders and crowdfunding platforms, among others, sets an EU-wide €10,000 cap on cash payments, and requires obliged entities to verify whether customers and beneficial owners are subject to targeted financial sanctions. Firms operating in the EU will need to reflect these changes in risk assessments built before the rules existed.

A snapshot doesn’t update itself

A risk assessment is a judgement made at a point in time about where attention should go, calibrated against the threats and typologies known when it was built. That judgement calibrates everything downstream: which controls get resourced, which alerts get priority, where the second line looks first. But threats don’t hold still for it. New typologies, new products and new channels emerge faster than the assessment cycle can absorb them, so the judgement goes stale long before anyone revisits it. The calibration doesn’t correct itself: it keeps directing attention to where risk used to be concentrated, not where it is now.

The usual response isn’t to recalibrate, it’s to add. A new control gets introduced for a risk nobody has re-tested, while the old ones stay in place because removing them feels riskier than leaving them there. The framework grows heavier without becoming more accurate: the “focus on everything” Wolfsberg warns against, built up one just-in-case control at a time instead of a proportionate, risk-based choice about where attention should go.

A control added on that basis can pass every internal test and still miss what’s actually happening, because nobody has gone back to ask whether the starting assumption behind it still holds.

How we support you

Before any assessment gets rebuilt, we start with our key core discipline: a genuine read of inherent risk across the lenses that drive it, customer, product, geography, delivery channel and transaction. That reading is then tested against how effectively the existing controls are designed and operating; to arrive at a residual risk the business can defend against its own stated appetite.

Geography is often the weakest input in practice. We draw on Compass, our own country risk platform, for a transparent, evidenced view of jurisdictional exposure across the full range of financial crime risk types it’s built to assess. Regulatory and typology inputs don’t stay still, so we keep them current through RegSight, our own regulatory horizon-scanning and obligations register platform. That way, an assessment reflects what’s changed, not just what was known when it was last refreshed.

Typical engagements include:

Re-baselining the business-wide risk assessment against current threats and regulation, and calibrating controls to be proportionate to both

Testing control design and effectiveness and whether identified risks are actually managed, not just documented

Building an ownership model that puts the assessment on a fixed review cycle, not one triggered by a missed control or a regulator’s review

Realigning control coverage to where risk is genuinely concentrated now

Producing evidence a reviewer can follow from finding to action, not just from finding to sign-off

See our full list of services

Where we’ve done this before

An international insurance group

Why we were brought on: with the UK’s failure to prevent fraud offence coming into force, the group wanted an independent view of whether its existing controls would meet the new offence’s requirements.

What we did: an independent readiness assessment tested existing fraud controls directly against what the new legislation requires as a defence.

Outcome: the group entered the new regime with a documented, evidenced position on its readiness.

A global bank

Why we were brought on: the bank’s sanctions obligations were expanding across multiple jurisdictions faster than its existing obligations register and horizon-scanning process could absorb.

What we did: we rebaselined the obligations register and sanctions horizon-scanning process, then extended the work across further jurisdictions as the bank’s footprint grew.

Outcome: a relationship recommissioned across five separate phases over two years, itself the evidence that keeping pace with sanctions obligations is an ongoing discipline.

A UK asset manager

Why we were brought on: the firm’s customer and business-wide risk assessments needed to move from a periodic exercise to something the business could keep current on an ongoing basis.

What we did: we rebuilt the CRA and BWRA methodology, then extended into the supporting tooling itself, adding bulk-upload capability, coverage for non-customer risk assessments, and forecasting capability.

Outcome: the firm can now update and forecast its own risk picture directly.

43,000to3.6m

customers, 2017 to 2023

£28,959,426

FCA fine, October 2024

54,000+

high-risk accounts opened in breach of an existing FCA requirement

A recent industry example shows the cost of a risk assessment that fails to keep pace with the business. In October 2024, the FCA fined a UK digital bank £28,959,426 after its customer base grew from 43,000 to 3.6 million between 2017 and 2023 without its financial crime controls keeping pace. Separately, the firm opened more than 54,000 high-risk accounts in breach of an existing FCA requirement. The issue was not growth itself. It was that the firm had not reassessed whether the controls designed for a business of 43,000 customers were still effective for one serving 3.6 million.