New customers. New markets. Significantly more volume. Same risk assessment?

A business-wide financial crime risk assessment sets out where your business could be exposed to financial crime and informs how you manage that exposure. It should help you decide where controls, expertise and resources are needed.

If the business has changed substantially but the assessment barely has, challenge it. A new approval date on the front page tells you very little about the thinking underneath.

The FCA’s Financial Crime Guide links risk assessment to customers, products, locations, transactions and distribution channels. It also calls for regular review. SYSC 6.3.7G specifically addresses money-laundering risk arising from new products, new customers and changes in business profile.

Growth often creates pressure to grease the wheels of onboarding.

Standardisation can be valuable, but not where it removes meaningful differentiation between customer risk profiles. Remember operational excellence is about more than fast – it is about quality too.

Customer due diligence (CDD) is about establishing who you are dealing with, including relevant beneficial owners, and understanding the relationship. Enhanced due diligence (EDD) adds further scrutiny where required, including higher-risk situations.

Standardisation can help you scale, but the problem starts when materially different risks are absorbed by the same process. A high-risk label achieves very little if it changes nothing about the work and scrutiny that follows.

The FCA's 2026 CDD work found stronger firms tailoring CDD to customer risk, while weaker examples did not demonstrate clearly enough how treatment differed between lower- and higher-risk customers or adequately evidence EDD.

The customer base keeps growing, along with the overdue review queue.

Customer due diligence doesn’t finish at onboarding. Reviews help firms keep customer information current and reassess risk as circumstances change. When those reviews remain overdue, you may be making decisions using an increasingly outdated picture of who you are dealing with.

A persistent backlog therefore deserves more than a standing item on the ops report. It can be a sign that review processes, capacity or specialist capability have not kept pace with the growth of the business.

The FCA’s Financial Crime Guide describes ongoing monitoring as risk-sensitive and includes keeping customer information up to date. Its 2026 CDD review identified unclear review arrangements and firms failing to carry out reviews required by their own policies.

The monitoring system is triggering alerts and cases are closing. That proves activity – but what is giving you confidence in the coverage?

Transaction monitoring looks for activity that may warrant investigation. Its rules, thresholds and supporting data need to make sense for the business using it. FCG 3.2.5G explicitly challenges firms to review monitoring effectiveness and understand the rationale behind their rules.

Test it. Pick something material that has changed - a product, customer group or transaction pattern. Ask what testing followed and what it showed.

The FCA's high-growth review found stronger firms investing in scalable technology and enhancing transaction monitoring as they grew. FCA sanctions work similarly emphasises configuration, calibration, data coverage, testing and alert management rather than assuming an installed system remains effective indefinitely.

Scaling firms often rely more heavily on external support - vendors, group systems, agents and outsourced providers. The control may be outsourced; accountability is not.

You still need enough understanding to judge its suitability, challenge its performance and act when something changes.

The UK National Risk Assessment specifically warns that AML outsourcing can create vulnerabilities for EMIs and PSPs when third parties do not properly understand the firm's products or risks, and states that the principal firm remains responsible for compliance. FCA sanctions work has similarly identified over-reliance on screening vendors and historic vendor settings without adequate reassessment or oversight.

You don’t need to recreate your supplier’s business in-house, but you do need an informed owner of the relationship.

Alert numbers, case volumes and onboarding turnaround times can be MI. On their own, however, they may say little about control effectiveness - would they tell you if the team were getting faster at making the wrong decisions?

Management information (MI) is the reporting leaders use to understand performance and make decisions. For financial crime, FCG 2.2.2G points to reporting on risk exposure and control effectiveness, alongside operational information.

FCA financial-crime guidance identifies useful MI as including emerging risks, changes in risk assessment, control effectiveness, higher-risk relationships and relevant alert or reporting information. The FCA's sanctions review similarly points to MI combining quantitative and qualitative information about risk, controls, outcomes and trends.

Complement volume figures with adequate evidence of quality. What are file checks finding? Which problems keep returning? Where are important actions overdue? What decisions does leadership need to make?

‘Sarah’ knows the monitoring rules. ‘Sarah’ handles the awkward cases. ‘Sarah’ remembers why the exception exists.

‘Sarah’ is excellent, but she would also quite like a holiday at some point.

Look inside your operation - perhaps one person understands the monitoring rules. One analyst knows how a particular high-risk customer type is handled. One senior manager is the route for almost every difficult decision.

The FCA's 2026 high-growth review specifically identified key-person reliance, insufficient contingency planning, succession and knowledge transfer as weaknesses in some growing firms.

“That’s what the procedure says. But here’s how we actually do it.”

Back in the day in my first role we had something called “The Red Book” – a printed file full of every operational process and work instruction. Problem is, the second a new page was printed, it was out of date with reality – the process had already evolved.

Rapidly changing firms often have a similar issue - people find ways to get the work done while the documentation struggles to keep up. Sometimes they’ve found a better way, and sometimes they just think they have - when in reality an important control has been missed, or worse, entirely wiped out.

Over time, the documented framework and the operational process can become two very different things.

Policies set the boundaries and expectations. Procedures explain how people put them into practice. But when the two drift apart, training, supervision, accountability and control become harder.

The FCA’s recent high-growth and customer due diligence reviews picked up related issues: frameworks that hadn’t evolved with the business, procedures lacking practical detail and weak document version control.

“Go to the Gemba” [as the Japanese improvement gurus would say]. - the place where the work actually happens. Walk a real case through the written procedure in your organisation today, sit with the person doing the work and see whether things line up.

From my Ops Excellence upbringing I specifically remember learning about Gauge R&R – mainly because the tutor shouted the "R&R" bit in a pirate’s accent… anyway, I digress. It talked about two different tests: ‘repeatability' and 'reproducibility’, and there’s a useful parallel with casework here:

Growth can consume assurance capacity just as quickly as operational capacity.

Quality assurance checks whether work meets the required standard. Independent assurance adds challenge from people sufficiently separate from the activity being examined. Both help you test the difference between what should happen and what actually does.

The FCA’s 2026 CDD review found stronger firms carrying out regular reviews and independent testing, then acting on the findings. In weaker examples, staff performed second-line assurance on customers they had onboarded - effectively marking their own homework.

New products. New markets. Automation. A new onboarding platform. A new data source. An acquisition. A new outsourced provider.

Financial crime governance is about how responsibility, challenge and decisions shape the way the business manages risk – and it needs a meaningful place in your change decisions.

The above examples also change financial-crime exposure. SYSC 6.3.7G addresses money-laundering risk in product development, customer acquisition and changes to business profile. FCG 2.2.4G also identifies considering financial crime risk during product design as good practice.

Where a change creates new exposure, the plan should include the controls, expertise and capacity to manage it. Leadership needs that information while there are still choices to make. Impact-assess the change and feed it into your control plan.