Find the latest EU and national risk assessments, then map Art. 10(1) sources into your business-wide risk assessment.
AMLR Art. 10 requires a documented business-wide risk assessment (BWRA) using at least six information sources. The same Annexes feed relationship-level CDD under Art. 20 — but serve different purposes. This guide maps Art. 10(1) sources to documents and Annex factors you must weigh.
BWRA ≠ CDD assessment. Art. 10 is entity-level (inherent risk across your business). Art. 20 applies the same taxonomy to each customer or transaction. Your BWRA should drive control intensity; CDD implements it per relationship.
Art. 10(1) is not a checklist — you must actually read the EU supranational assessment, your Member State NRA, and relevant FATF / supervisor publications, then map findings into your BWRA. Pick your country below.
Registry curated 25 June 2026 · verify links before compliance sign-off
Latest published: Supranational risk assessment — Commission report (3rd edition) (27 October 2022)
The Commission SNRA is due every two years. The 2022 edition remains the latest published report as of June 2026 — a 2024 update was expected but has not yet appeared on EUR-Lex. Check the Commission AML policy page for new releases.
European Commission · 27 October 2022
Latest published EU-wide ML/TF risk mapping for 43 products and services. Crypto-assets and online gambling flagged as higher risk vs 2019.
European Commission · 27 October 2022
Sector-by-sector threat/vulnerability analysis accompanying COM(2022) 554 — use this for product and channel risk in your BWRA.
European Commission · 24 July 2019
Previous SNRA cycle — still referenced by some national and sector assessments.
European Commission · 26 June 2017
First Commission SNRA under AMLD4 Art. 6.
AMLD6 Art. 8 requires each Member State to maintain an NRA (review at least every 4 years) and publish a non-classified summary. Sector-specific NRAs count too.
Select a country to see curated NRA links where available. For any Member State, the Commission NCA register lists FIUs and supervisors who publish typologies (Art. 10(1)(e)).
EBA · 28 July 2025
Biennial EBA view fed into the Commission SNRA — FinTech, CASPs, RegTech and stablecoin TF risks highlighted (data Jan 2022–Dec 2024).
EBA · 1 December 2023
Prior cycle — useful where supervisors still reference 2023 thematic findings.
FATF · 1 June 2025
Living list for Annex III geographic risk — AMLR Art. 10(1)(a) explicitly references FATF increased monitoring.
FATF · 1 June 2025
Black list / call for action jurisdictions — map to geographic EDD in BWRA.
FATF · 1 January 2024
Follow-up MER reports for correspondent-banking and third-country exposure.
AMLA · 1 January 2025
Growing set of EU-level guidance once AMLA is fully operational — monitor alongside Art. 10(4) consultation.
Missing a link? NRAs move between ministries and FIUs. Search your coordinator site for “national risk assessment”, “NRA”, “ANR”, or “Nationaal Risico Assessment”. Updates feed tracks registry changes.
AMLA mandate
Business-wide risk assessment — minimum contentMinimum requirements for the content of the business-wide risk assessment and the additional information sources to take into account when carrying it out.
Consultation deadline 15 July 2026 · AMLA consultation
Each source below must feed your BWRA. Use the document registry above for the latest EU SNRA and national NRA. AMLA's Art. 10(4) guidelines (in consultation) will add minimum content and further sources.
Art. 10(1)(a)
Mandatory risk taxonomy — customer, product, channel, and geography variables plus indicative lower and higher risk factors.
BWRA input
Build your inherent risk scoring around Annex I; use Annex II/III to justify SDD/EDD posture at entity level before relationship-level CDD under Art. 20.
Art. 10(1)(b)
Commission assessment of ML/TF risks affecting the Union's financial system and linked sectors.
BWRA input
Extract Union-wide threat trends (e.g. crypto, trade-based ML, proliferation financing) and map to your products, customers, and geographies.
Art. 10(1)(c)
Member State NRAs and any sector-specific assessments published nationally.
BWRA input
Overlay country and sector risk on your entity assessment — supervisors expect consistency with the NRA for your MS and sector.
Art. 10(1)(d)
FATF mutual evaluations, typologies, and relevant Commission or AMLA publications.
BWRA input
Use FATF MER follow-up and typology reports for geographic and product risk; track AMLA thematic work and Commission reports for emerging EU priorities.
Art. 10(1)(e)
Supervisory guidance, FIU typologies, inspection themes, and sector-specific letters.
BWRA input
Incorporate dear-CEO letters, thematic reviews, and public FIU trend reports into your update cycle — document when you last refreshed each input.
Art. 10(1)(f)
Internal portfolio data — not a public document, but a mandatory Art. 10(1) input.
BWRA input
Analyse segment mix, geographies, PEP exposure, STR rates, product/channel concentration, and new customer cohorts. NFS entities often have limited history — document data gaps explicitly.
Internal data source — document what customer-base analysis you used and when it was last refreshed.
Before launching any of the following, Art. 10(1) requires you to identify and assess related ML/TF risks and mitigate them — update the BWRA, not only CDD procedures.
New products or services
Assess ML/TF risk before launch and define mitigating controls in the BWRA update.
New business practices
Changes to how you deliver existing services may alter channel or customer risk.
New delivery channels
Non-face-to-face or third-party channels — see Annex I channel variables.
New or developing technologies
Including AI in onboarding, monitoring, or fraud — parallel FRIA under AI Act may apply.
New customer segment
Existing product offered to a different client profile requires focused assessment.
New geographical area
Cross-border expansion triggers geography variables and Art. 32 third-country guidance.
Filter by sector to see factors especially relevant to your obliged-entity category. Universal Annex I variables always apply.
Customer's and beneficial owner's business or professional activity
BWRA: Sector exposure in your customer portfolio
CDD (Art. 20): Individual customer classification
Customer's and beneficial owner's reputation
BWRA: Aggregate reputational risk themes
CDD (Art. 20): Adverse media / PEP checks per customer
Jurisdictions where customer and BO are based / do business
BWRA: Geographic concentration in BWRA
CDD (Art. 20): Country risk on each relationship
Purpose of account or relationship
BWRA: Product-line inherent risk
CDD (Art. 20): Transaction purpose per customer
Transparency or opaqueness of product, service or transaction
BWRA: Complex structures in your offering
CDD (Art. 20): Opaque ownership triggers EDD
Non-face-to-face business relationship extent
BWRA: Channel mix in entity risk profile
CDD (Art. 20): Remote onboarding controls per EBA/AMLA standards
Risk level presented by insurance policy beneficiary
BWRA: Life/investment insurance product risk
CDD (Art. 20): Beneficiary due diligence
Listed companies with transparent beneficial ownership disclosure
BWRA: Lower inherent customer segment
CDD (Art. 20): Potential SDD factors
Customers in Member States
BWRA: Lower geographic inherent risk baseline
CDD (Art. 20): Geographic SDD indicator
Third countries with effective AML/CFT (FATF-consistent)
BWRA: Approved correspondent / market jurisdictions
CDD (Art. 20): Lower country risk scoring
Business relationship or transaction in unusual circumstances
BWRA: Flag unusual deal types in your sector
CDD (Art. 20): Relationship-level EDD trigger
Personal asset-holding vehicles
BWRA: Structure-heavy client base
CDD (Art. 20): EDD on beneficial ownership
Unusual or excessively complex ownership structure
BWRA: Entity-structure risk in BWRA
CDD (Art. 20): EDD and UBO verification
Cash-intensive businesses
BWRA: Cash exposure in sector profile
CDD (Art. 20): Enhanced monitoring
Third-country nationals seeking residence via investment
BWRA: Core sector risk driver
CDD (Art. 20): EDD on source of wealth and purpose
Entity with no real economic activity in jurisdiction of creation
BWRA: Shell-structure exposure
CDD (Art. 20): EDD and purpose of arrangement
Products or transactions favouring anonymity
BWRA: Product inherent risk
CDD (Art. 20): Enhanced CDD and monitoring
New products, practices, delivery mechanisms or technologies
BWRA: Innovation pipeline in pre-launch assessment
CDD (Art. 20): Art. 10(1) second paragraph trigger
Precious metals/stones, cultural artefacts, arms, tobacco, ivory
BWRA: Trade-based ML and TF typologies in sector BWRA
CDD (Art. 20): Sector-specific EDD
FATF increased monitoring (grey list) jurisdictions
BWRA: Corridor and market exposure
CDD (Art. 20): Geographic EDD
Sanctioned jurisdictions or TF-supporting states
BWRA: TFS evasion risk (explicit in Art. 10(1))
CDD (Art. 20): Screening and prohibition
Jurisdictions enabling financial secrecy
BWRA: Offshore and secrecy exposure in BWRA
CDD (Art. 20): EDD and BO transparency
Elements obliged entities should take into account — nature of business, risks, complexity and size — when deciding the extent of their internal policies, procedures and controls.
Minimum requirements for the content of the business-wide risk assessment and the additional information sources to take into account when carrying it out.
Risk variables and risk factors obliged entities must weigh when entering business relationships or carrying out occasional transactions.
ML/TF risks, trends and methods involving geographical areas outside the Union to which obliged entities are exposed.
Guidelines on ML/TF risk factors (incl. CDD, SDD/EDD, business-wide RA)
The core EBA risk-based approach guideline — risk factors for customers, geography, products and channels; how to adjust CDD (including simplified and enhanced) and apply mutatis mutandis to business-…
Art. 10(2) requires documentation, regular review, compliance-officer preparation, and management-body approval. Art. 10(3) allows supervisors to waive individual documented BWRAs for some non-financial sectors where sector risk is clear — verify with your competent authority. This guide is orientation only, not legal advice.