BWRA and SIRA: towards a coherent risk assessment processFrom mandatory risk assessment to a management tool
From 10 July 2027, the European Anti-Money Laundering Regulation (AMLR) will apply. This will introduce the Business-Wide Risk Assessment (BWRA) for financial institutions.
The BWRA will replace the current risk assessment under the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft). However, the broader Dutch Systematic Integrity Risk Analysis (SIRA) will not automatically become obsolete.
For most institutions, introductng the BWRA does not necessarily mean developing an entirely new, standalone risk assessment. Existing risk assessments can often provide a solid foundation. Institutions will, however, need to assess whether their current approach meets the new European requirements and identify where adjustments are necessary.
The challenge therefore lies less in developing a new risk assessment and more in creating a single, coherent risk assessment process. A process in which risks are identified, assessed and managed, and the results are actually used to guide the organisation.
The relevant question is therefore not so much todevelop another risk assessment, but to establish a single, integrated risk assessment proces. : One that identifies, assesses and manages risks, while ensuring that the outcomes actively inform risk management and business decision-making.
The key question is therefore not: How do we build a new BWRA? Rather, it is: How do we adapt our existing risk assessment framework to meet the AMLR requirements while strengthening the effectiveness of our risk management?
SIRA, the Wwft risk assessment and BWRA: different scopes, the same foundation
All three risk assessments are based on the same fundamental priciple: identifying and assessing the risks to which an institution is exposed and determining how these risks should be managed.
The main difference lies in their scope:
The SIRA is the broader Dutch assessment of integrity risks. The current Wwft risk assessment focuses specifically on money laundering and terrorist financing. With the introduction of AMLR, the Wwft will be repealed and the riskassessments requirements replaces by the BWRA.
Under Article 10 AMLR, the BWRA will provide an EU-wide framework for assessing risks relating to money laundering (ML), terrorist financing (TF) and the non-implementation and evasion of targeted financial sanctions (TFS).
| SIRA | Current Wwft risk assessment | BWRA | |
| Regulatory framework | Dutch | Dutch | European |
| Scope | Broader integrity risks | ML/TF | ML/TF + TFS |
| Methodology | No prescribed methodology | No prescribed methodology | No prescribed methodology |
| Approach | Risk-based | Risk-based | Risk-based |
| Governance | Primarily based on DNB guidelines/Good Practices | Governance requirements exist but are less explicitly defined for the risk assessment itself | Clearly defined responsibilities for the management body, compliance function and business units |
What does this mean in practice?
The BWRA does not replace the broader SIRA, at least not in terms of its coverage of wider integrity risks.
At the same time, there is little justification for maintaining three largely overlapping assessments as entirely separate exercises. The challenge is to bring the different requirements together within one coherent risk assessment framework.
The risk profile as the starting point, rather than existing scenarios
In April 2026, AMLA (the Authority for Anti-Money Laundering and Countering the Financing of Terrorism) published draft guidelines on the BWRA. AMLA does not prescribe a mandatory risk matrix, scoring methodology or standard template. However, its draft guidelines identify four minimum components:
Business activities and risk profile → Inherent risks → Quality of controls → Residual risk.
This structure will be familiar to Dutch institutions. Existing SIRAs and Wwft risk assessments generally follow a similar approach, assessing inherent risks, the design and operating effectiveness of controls, and the resulting residual risks.
The starting point should be the institution’s business activities and the vulnerabilities arising from them. These include risks associated with customers, products and services, transactions, distribution channels and geographical exposure. The Ducth Central Bank (DNB) has also placed greater emphasis on methodological flexibility in its Good Practices SIRA 2025.
The institution’s specific risk profile should determine the scope and content of the assessment, with the scenarios tailored to its actual activities and exposures..
In our advisory work, we regularly see opportunities for improvement in this area.. Too often, institutions allow an existing set of risk scenarios to determine the assessment, rather than starting fomr their actual risk profile. As a result, relevant developments may not be adequately reflected, while the assessment itself becomes unnecessarily extensive and difficult to manage.
For example, if an institution introduces a new product but only reassesses its existing risk scenarios, the specific risks associated with that new product may remain unidentified.
The underlying principle should therefore always be that the risk assessment reflects the institution’s current business model and actual risk exposure.
Greater emphasis on evidence and the effectiveness of controls
A key element of AMLA’s draft guidelines concerns the assessment of the quality and effectiveness of controls. Simply listing the controls associated with an identified risk, is not sufficient.
Institutions must be able to demonstrate which controls mitigate which risks, to what extent they do so and whether those controls are effective in practice.
AMLA distinguishes between two dimensions:
• Design effectiveness: is the control appropriately designed to mitigate the identified risk?
• Implementation effectiveness: has the control been properly implemented, and does it operate effectively in practice?
This requires an evidence-based assessment, supported by information from sources such as compliance monitoring, control testing, internal audit findings and supervisory observations.
The results should provide a sound basis for determining the level of residual risk..
The assessment of inherent risks must also be adequately supported by relevant facts and data.
For example, a conclusion that an institution’s geographical risk exposure is low, should be substantiated by reference to it’s customer portfolio, geographical exposure, transaction data and relevant external iinformation.
This does not mean that the risk assessment must be entirely quantitative.
What matters is that an institution can explain and substantiate why its chosen methodology and conclusions are appropriate for its specifcrisk profile..
Assigning governance and management responsibilities more effectively
The AMLR intorduces more explicit governance responsibilities in relation to the BWRA.
These may differ from existing SIRA processes, where the first line of defence often plays a leading role in conductng the risk assessment, while Compliance primarily provides oversight, review and challenge.
Under the AMLR, responsibilities for the BWRA are more clearly allocated. Article 10 AMLR specifies that the BWRA must be prepared by the compliance officer and approved by the management body in its management function.
However, this does not mean that the compliance function should conduct the assessment in isolation.
Active business involvement remains essential for an effective BWRA. Risks can only be properly identified and assessed when the process draws on a thorough understanding of the institution’s business activities..
The AMLR therefore primarily shifts formal responsibility for preparing of the BWRA towards the compliance function, while the business remains responsible for identifying, understanding and managing the risks arising from its activities.
Institutions will consequently need to reassess how ownership, responsibilities, contributions from the different lines of defence, independent review and decision-making are organised.
The challenge is to strengthen governance without reducing business ownership and engagementin the risk assessment process.
From a periodic document to an active management tool
Perhaps an even more important question is: how effective is the current SIRA in paractise?
In our advisory work, we still see SIRA’s that primarily as standalone documents or periodic compliance exercises. Risk scenarios are assessed, scores are assigned, the document is approved and a year later the process starts again.
DNB’s Good Practices SIRA 2025, emphasises a different approach: a dynamic process in which risks are continuously reassessed, controls are tested and the outcomes actively inform risk management and decision-making..
The AMLR also appears to follow a simular direction.
Article 10 AMLR requires the BWRA to be documented, kept up to date and reviewed regularly, but does not prescribe a fixed annual review cycle.The BWRA must also be reviewed when internal or external developments materially affect the institution’s risks.
The emphasis is therefore not on completing an assessment according to a predetermined annual timetable, but on ensuring it remains current and relevant.
A mature risk assessment process involves a continuous feedback loop: Business activities and risk exposure → Risk assessment → Risk appetite → Policies and controls → Customer due diligence and monitoring → Control testing → Management information → Improvement measures → Updating the risk assessment.
This creates an ongoing risk management cycle, rather than a document that is updated once a year.
From this perspective, the key question is not how frequently a BWRA or SIRA should be performed. Instead, institution should considder how they ensure that emerging risks, incidents, monitoring findings, changes in business activities and external developments are reflected in their risk assessments in a timely manner.
Ultimately, this is the approach that both the AMLR and the DNB Good Practices appear to encourage.
What can institutions do now?
For an institution with a mature SIRA and Wwft risk assessment process, introducing the BWRA does not necessarily require a complete redesign.
However, it is more than a rebranding exercise.
A practical first step is to conduct a readiness assessment adressing a limited number of key questions:
Scope: Does the existing assessment adequately cover ML, TF and TFS risks?
Risk profile: Is the assessment demonstrably based on the institution’s business model, relevant developments and actual vulnerabilities?
Methodology: Is the methodology appropriate, proportionate and sufficiently transparent to be explained and challenged?
Risk substantiation: Are risk assessments supported by sufficient and reliable data and information?
Control effectiveness: Are controls demonstrably linked to the risks they mitigate, and are both their design and operating effectiveness assessed?
Governance: Are governance arrangements, ownership and responsibilities aligned with the AMLR requirements?
Practical application: Do the outcomes of the risk assessment effectively inform policies, customer due diligence, transaction monitoring, risk appetite and management information?
Conclusion: Towards a single, integrated view of risk
For institutions with mature risk assessment processes, the introduction of the BWRA does not necessarily mean starting from scratch.
However, the AMLR does require institutions to critically assess the scope of their existing risk assessments, the evidence supporting their risk evaluations, the effectiveness of their controls, their governance arrangements and the the extent to which assessment outcomes are actually used in managing risks.
The BWRA will replace the current Wwft risk assessment, while the SIRA will remain relevant for the assessment of broader integrity risks.
The challenge ahead of 10 July 2027 is therefore not to produce another regulatroy document, but to develop a single, integrated risk assessment process that brings the different requirements together in a coherent and effective manner.
Financial institutions should start assessing how well their existing approaches align with the new requirements and where improvements are needed. Ultimately, the value of a risk assessment lies not in the document itself, but in whether an institution understands its risks, manages them effectively and can demonstrate how those risks inform its decisions.