BWRA and SIRA: towards a coherent risk assessment process
From mandatory risk assessment to a management tool
From 10 July 2027, the European Anti-Money Laundering Regulation (AMLR) will apply. This will introduce the Business-Wide Risk Assessment (BWRA) for financial institutions.
The BWRA will replace the current risk assessment under the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft). However, the broader Dutch Systematic Integrity Risk Analysis (SIRA) will not automatically become obsolete.
For most institutions, introductng the BWRA does not necessarily mean developing an entirely new, standalone risk assessment. Existing risk assessments can often provide a solid foundation. Institutions will, however, need to assess whether their current approach meets the new European requirements and identify where adjustments are necessary.
The challenge therefore lies less in developing a new risk assessment and more in creating a single, coherent risk assessment process. A process in which risks are identified, assessed and managed, and the results are actually used to guide the organisation.
The key question is therefore not: How do we build a new BWRA? Rather, it is: How do we adapt our existing risk assessment framework to meet the AMLR requirements while strengthening the effectiveness of our risk management?
SIRA, the Wwft risk assessment and BWRA: different scopes, the same foundation
All three risk assessments are based on the same fundamental priciple: identifying and assessing the risks to which an institution is exposed and determining how these risks should be managed.
The main difference lies in their scope:
The SIRA is the broader Dutch assessment of integrity risks. The current Wwft risk assessment focuses specifically on money laundering and terrorist financing. With the introduction of AMLR, the Wwft will be repealed and the riskassessments requirements replaces by the BWRA.
Under Article 10 AMLR, the BWRA will provide an EU-wide framework for assessing risks relating to money laundering (ML), terrorist financing (TF) and the non-implementation and evasion of targeted financial sanctions (TFS).
| Subject | SIRA | Current Wwft risk assessment | BWRA |
|---|---|---|---|
| Regulatory framework | Dutch | Dutch | European |
| Scope | Broader integrity risks | Money laundering and terrorist financing (ML/TF) | Money laundering, terrorist financing and targeted financial sanctions (ML/TF + TFS) |
| Methodology | No prescribed methodology | No prescribed methodology | No prescribed methodology |
| Approach | Risk-based | Risk-based | Risk-based |
| Governance | Primarily based on DNB’s Guidelines and Good Practices | Governance requirements exist, but are less explicitly defined for the risk assessment itself | Clearly defined responsibilities for the management body, compliance function and business units |
What does this mean in practice?
The BWRA does not replace the broader SIRA, at least not in terms of its coverage of wider integrity risks.
At the same time, there is little justification for maintaining three largely overlapping assessments as entirely separate exercises. The challenge is to bring the different requirements together within one coherent risk assessment framework.
The risk profile as the starting point, rather than existing scenarios
In April 2026, AMLA (the Authority for Anti-Money Laundering and Countering the Financing of Terrorism) published draft guidelines on the BWRA. AMLA does not prescribe a mandatory risk matrix, scoring methodology or standard template. However, its draft guidelines identify four minimum components:
Business activities and risk profile → Inherent risks → Quality of controls → Residual risk.
This structure will be familiar to Dutch institutions. Existing SIRAs and Wwft risk assessments generally follow a similar approach, assessing inherent risks, the design and operating effectiveness of controls, and the resulting residual risks.
The starting point should be the institution’s business activities and the vulnerabilities arising from them. These include risks associated with customers, products and services, transactions, distribution channels and geographical exposure. The Ducth Central Bank (DNB) has also placed greater emphasis on methodological flexibility in its Good Practices SIRA 2025. The institution’s specific risk profile should determine the scope and content of the assessment, with the scenarios tailored to its actual activities and exposures.
In our advisory work, we see considerable scope for improvement in this area. An existing set of scenarios too often drives the analysis, rather than the institution’s actual risk profile. As a result, relevant developments may not be adequately taken into account, while the risk analysis becomes unnecessarily extensive and difficult to manage.
For example, if an institution introduces a new product but only reassesses its existing risk scenarios, the specific risks associated with that product may be overlooked.
The starting point should therefore always be to ensure that the risk analysis reflects the institution’s current business model and actual risk exposure.
Greater emphasis on evidence and the effectiveness of controls
A key element of AMLA’s draft guidelines concerns the assessment of the quality and effectiveness of controls. Simply listing the controls associated with an identified risk, is not sufficient.
Institutions must be able to demonstrate which controls mitigate which risks, to what extent they do so and whether those controls are effective in practice.
AMLA distinguishes between two dimensions:
- Design effectiveness: is the control appropriately designed to mitigate the identified risk?
- Implementation effectiveness: has the control been properly implemented, and does it operate effectively in practice?
This requires an evidence-based assessment, supported by information from sources such as compliance monitoring, control testing, internal audit findings and supervisory observations.
The results should provide a sound basis for determining the level of residual risk.
The assessment of inherent risks must also be adequately supported by relevant facts and data.
For example, a conclusion that an institution’s geographical risk exposure is low, should be substantiated by reference to it’s customer portfolio, geographical exposure, transaction data and relevant external iinformation.
This does not mean that the risk assessment must be entirely quantitative.
What matters is that an institution can explain and substantiate why its chosen methodology and conclusions are appropriate for its specifcrisk profile..
Assigning governance and management responsibilities more effectively
The AMLR intorduces more explicit governance responsibilities in relation to the BWRA.
These may differ from existing SIRA processes, where the first line of defence often plays a leading role in conductng the risk assessment, while Compliance primarily provides oversight, review and challenge.
Under the AMLR, responsibilities for the BWRA are more clearly allocated. Article 10 AMLR specifies that the BWRA must be prepared by the compliance officer and approved by the management body in its management function.
However, this does not mean that the compliance function should conduct the assessment in isolation.
Active business involvement remains essential for an effective BWRA. Risks can only be properly identified and assessed when the process draws on a thorough understanding of the institution’s business activities..
The AMLR therefore primarily shifts formal responsibility for preparing of the BWRA towards the compliance function, while the business remains responsible for identifying, understanding and managing the risks arising from its activities.
Institutions will consequently need to reassess how ownership, responsibilities, contributions from the different lines of defence, independent review and decision-making are organised.
The challenge is to strengthen governance without reducing business ownership and engagementin the risk assessment process.
From a periodic document to an active management tool
Perhaps an even more important question is: how effective is the current SIRA in paractise?
In our advisory work, we still see SIRA’s that primarily as standalone documents or periodic compliance exercises. Risk scenarios are assessed, scores are assigned, the document is approved and a year later the process starts again.
DNB’s Good Practices SIRA 2025, emphasises a different approach: a dynamic process in which risks are continuously reassessed, controls are tested and the outcomes actively inform risk management and decision-making..
The AMLR also appears to follow a simular direction.
Article 10 AMLR requires the BWRA to be documented, kept up to date and reviewed regularly, but does not prescribe a fixed annual review cycle.The BWRA must also be reviewed when internal or external developments materially affect the institution’s risks.
The emphasis is therefore not on completing an assessment according to a predetermined annual timetable, but on ensuring it remains current and relevant.
A mature risk assessment process involves a continuous feedback loop: Business activities and risk exposure → Risk assessment → Risk appetite → Policies and controls → Customer due diligence and monitoring → Control testing → Management information → Improvement measures → Updating the risk assessment.
This creates an ongoing risk management cycle, rather than a document that is updated once a year.
From this perspective, the key question is not how frequently a BWRA or SIRA should be performed. Instead, institution should considder how they ensure that emerging risks, incidents, monitoring findings, changes in business activities and external developments are reflected in their risk assessments in a timely manner.
Ultimately, this is the approach that both the AMLR and the DNB Good Practices appear to encourage.
What can institutions do now?
For an institution with a mature SIRA and Wwft risk assessment process, introducing the BWRA does not necessarily require a complete redesign.
However, it is more than a rebranding exercise.
A practical first step is to conduct a readiness assessment adressing a limited number of key questions:
Scope: Does the existing assessment adequately cover ML, TF and TFS risks?
Risk profile: Is the assessment demonstrably based on the institution’s business model, relevant developments and actual vulnerabilities?
Methodology: Is the methodology appropriate, proportionate and sufficiently transparent to be explained and challenged?
Risk substantiation: Are risk assessments supported by sufficient and reliable data and information?
Control effectiveness: Are controls demonstrably linked to the risks they mitigate, and are both their design and operating effectiveness assessed?
Governance: Are governance arrangements, ownership and responsibilities aligned with the AMLR requirements?
Practical application: Do the outcomes of the risk assessment effectively inform policies, customer due diligence, transaction monitoring, risk appetite and management information?
Conclusion: Towards a single, integrated view of risk
For institutions with a mature risk assessment process, the introduction of the BWRA need not mean a complete overhaul. However, the AMLR does require them to take a critical look at the scope of their existing assessments, how risks are substantiated, the effectiveness of control measures, governance and how the findings are actually used.
The BWRA will replace the Wwft risk assessment, while the SIRA will remain relevant for broader integrity risks. The challenge ahead of 10 July 2027 is therefore not to produce an additional document, but to develop a coherent risk assessment process in which the different requirements fit together logically.
Institutions would be well advised to assess now how closely their existing approach aligns with the new requirements and where changes are needed. Ultimately, the issue is not the risk assessment as a document, but whether an institution understands and manages its risks, and can demonstrate that it is taking action to address them.