From Compliance to Resilience: Integrating Additional Risk Factors into AML Business Risk Assessments

Risk-based approaches constitute the cornerstone of contemporary anti-money laundering (AML) regulatory frameworks, requiring institutions to conduct Business Risk Assessments (BRAs). While the customer risk assessment component is well-defined across key regulatory dimensions, the “additional factors” capturing institution-specific risks remain unclear and underexplored, leaving a methodological gap in AML governance. This study examines this unaddressed issue by proposing and empirically validating a structured approach for identifying and evaluating institution-specific BRA factors. A PRISMA-guided literature review confirms the lack of standardized approaches for integrating additional factors into AML risk modelling. Empirical data from five European financial institutions were used to model 291 threats and 122 vulnerabilities via Partial Least Squares Structural Equation Modelling (PLS-SEM). The findings demonstrate that six dimensions, governance, operational, ICT, ESG, human resources, and regulatory compliance, significantly influence AML vulnerability, explaining 80.9% of variance (R² = 0.809) with p < 0.001. Governance quality and ICT risk management emerge as the most critical drivers, underscoring the importance of institutional controls and technological resilience in mitigating AML risk.