banner image
Accounting Alert

Guidelines for the Conduct of Institutional Risk Assessment (IRA)

Background

The lnsurance Commission, as a “supervising authority”, is mandated to assist the Anti-Money Laundering Council (AMLC) in supervising the implementation of the Anti-Money Laundering Act (AMLA), as amended, and the Terrorist Financing Prevention and Suppression Act (TFPSA). In line with this, lC Circular Letter 2018-48, as amended, requires the conduct of institutional risk assessments at least once every two (2) years, or as often as the Board or senior management may direct, depending on the level of risks identified in the previous assessment or other relevant anti-money laundering and combating the financing of terrorism (AML/CFT) developments that may have an impact on the IC regulated entities’ (ICREs) operations.

The Commission through Circular No. 2024-16, issues the guidelines to ensure that the AML/CTF institutional risk assessment by all ICREs is conducted comprehensively and uniformly.
 
Key Guidelines

The institutional risk assessment of ICRES involved defining the methodologies for AML/CFT and TFS risk assessments, specifying scope, and considering key elements to determine residual risk. It identifies sources of money laundering, terrorism financing and proliferation financing, and sanctions risks, assesses vulnerabilities in business operations and evaluates existing controls.  ICREs are required to develop tailored policies, controls, and procedures to effectively manage and mitigate identified risks, thereby implementing a risk-focused strategy. The strategy shall follow the IRA process as prescribed in the guidelines.

  • Planning and Scoping – ICREs should define the objectives and scope of the assessment. A project plan should be prepared to identify the units and personnel who will be involved in the IRA, as well as the milestones and timeline.
  • IRA methodology - The risk assessment methodology should be tailored to the nature and complexity of the ICRE's activities and operations and will enable to capture and analyze the actual risk profile to achieve defined objectives of the assessment.
  • Risk Assessment Process
    • Identification – identify known or suspected threats and vulnerabilities (inherent risk and risk factor) relevant to ICRE.
    • Analysis – analyze the likelihood and consequence of identified risks, assess the quality of risk management, and determine the residual risk.
    • Evaluation – evaluate risk, vis-à-vis established risk appetite, and formulate prioritized action plans.
  • Reporting – The IRA report containing the assessment results and recommendations must be submitted to the BOD for approval. Findings and any action plans should be communicated to the concerned personnel to foster shared understanding and effective implementation.
  • Monitoring - The IRA is expected to be up to-date. IRA shall be conducted, at least once every two years, or as often as the BOD or senior management may direct, depending on relevant factors/developments

Please see attached circular for further guidance.

Copy text of article
IC Circular Letter No. 2024-16

IC Circular Letter No. 2024-16

Download PDF [7400 kb]