On this page
An AML risk assessment in Mauritius is the starting point of every anti-money laundering programme. Before a company can decide how much checking a client needs, it has to understand where its own business is exposed. The assessment records that analysis in writing, ties it to the controls you actually run, and gives a regulator something concrete to read.
This page explains how to build a business-wide assessment, how it feeds a customer risk rating in Mauritius, and how to keep the file in a state that survives an inspection. It is general information. How detailed your assessment must be depends on your activity, your regulator and your size, so the final shape should be confirmed with an adviser.
What a business risk assessment is, and who needs one
The business risk assessment looks at the company as a whole: what it sells, to whom, through which channels and in which countries. It is different from the check made on one client at onboarding, although the two are linked. The business-wide view sets the baseline; the individual rating adjusts it for a given relationship.
Entities that fall under the AML/CFT framework are expected to identify, assess and understand their risks, and to keep that analysis current. Whether your company is in that perimeter turns on its activity and licence. A regulated business, a financial or professional services firm, and an entity whose registered agent or provider carries AML duties are the typical cases. The legislation is summarised in AML/CFT legislation explained for business owners, and the supervisory material is covered separately in reading the AML/CFT guidelines and handbook.
For an Authorised Company, the registered agent's statutory functions include AML/CFT measures and the keeping of records, according to the Financial Services Act. That does not remove the question from the company's own agenda: the directors still need to understand what the agent is doing on their behalf and what information it will ask them for.
The building blocks of a risk assessment
A usable assessment is built from a small number of risk families. Each one is examined for your business specifically, not copied from a template.
Customer risk
Who are your clients? Individuals or companies, local or foreign, regulated or unregulated, with simple or layered ownership. A client whose ownership chain ends in a trust or a nominee arrangement carries a different profile from a salaried resident. Ownership questions link directly to the beneficial ownership register and to who counts as a beneficial owner.
Geographic risk
Where are clients, owners, counterparties and funds located? Exposure to jurisdictions under heightened international scrutiny, or to places with weak supervision, raises the rating. The effect of public lists on a country and its companies is discussed in Mauritius and the FATF grey list.
Product, service and transaction risk
Some services are easier to abuse than others: anything that moves funds quickly, holds client money, creates complex structures or hides a link between a person and an asset. Describe each service you offer and ask how it could be used to disguise the origin of money.
Delivery channel risk
Do you meet clients face to face or onboard them remotely? Do you rely on introducers or intermediaries? Non-face-to-face relationships and reliance on third parties both weaken your direct knowledge of the client and deserve a note.
Other factors
Add anything specific to your line of business: cash intensity, use of virtual assets, sectors prone to corruption, politically exposed persons among the client base, or exposure to sanctions. See politically exposed persons and sanctions screening for how those two topics are handled in practice.
How to build the assessment, step by step
- Describe the business
Services, client types, countries, channels and any outsourced functions.
- Identify the risks
List how each service, client group and channel could be misused.
- Rate inherent risk
Judge likelihood and impact before any control is applied.
- Map the controls
Record the policies, checks and monitoring that reduce each risk.
- Rate residual risk
What remains after controls, and whether it is acceptable.
- Approve and schedule review
Board sign-off, an owner, and a trigger for updating the file.
Rate inherent risk before controls
Inherent risk is the exposure if you did nothing. Use a plain scale such as low, medium and high, and define each level in a sentence so that two readers reach the same rating. The point is consistency, not mathematical precision.
Map controls honestly
For each risk, write down the control that addresses it: the onboarding checks, the screening tools, the approval levels, the training, the monitoring. A control that exists only on paper should not be credited. The assessment is weakest when it claims a control that nobody can evidence. Training and independent testing are covered in AML/CFT training and independent audit.
Conclude on residual risk
Residual risk is what is left after controls. If it is higher than the board is willing to accept, the answer is either to strengthen a control or to stop offering that service or serving that client type. Document the decision either way.
From business risk to a customer risk rating
The customer risk rating applies the same logic to one relationship. In Mauritius, as elsewhere, the rating then drives how deep the due diligence goes and how often the file is refreshed.
| Factor | Lower-risk indicator | Higher-risk indicator |
|---|---|---|
| Client type | Listed or regulated entity, transparent ownership | Layered or opaque ownership, nominee arrangements |
| Location | Well-supervised jurisdiction | Jurisdiction under heightened scrutiny |
| Activity | Simple, easily explained business | Cash-heavy, complex or unusual flows |
| Source of funds | Clear, documented, consistent with profile | Vague, inconsistent or hard to verify |
| Status | Not a politically exposed person | Politically exposed person or close associate |
| Channel | Met in person, verified directly | Remote onboarding or reliance on an introducer |
| Behaviour | Transactions match the stated purpose | Unexplained changes, urgency, reluctance to provide information |
Combine the factors into a rating and record the reasoning, not only the result. A scoring grid is fine, but allow a documented override: an experienced compliance officer may raise a rating that the grid left low. Lowering a rating by override needs a stronger justification than raising it.
Is the client a politically exposed person, or linked to a high-risk jurisdiction?
Is the ownership structure complex or the source of funds unclear?
Higher ratings pull in extra work: deeper KYC for corporate clients, evidence of source of funds and source of wealth, closer monitoring and escalation to the compliance officer. The person who owns this process is usually the money laundering reporting officer, who also decides whether unusual activity must be reported through a suspicious transaction report.
How to document the assessment
Documentation is where many assessments fail. The analysis may be sound, but if it cannot be shown, it will not count.
- State the date, the version and the author of the assessment
- Describe the business model, services, client types, countries and channels
- Explain the method and the meaning of each rating level
- Record inherent risk, controls and residual risk for each risk family
- Reference the sources used, such as national and sector risk findings
- Record board or senior management approval in the minutes
- Name the owner and the next review trigger
- Keep earlier versions so that changes can be explained
Approval belongs in the company's own records. A resolution or minute that adopts the assessment is evidence that the directors engaged with it; see board resolutions and how to write board minutes. Retention of the file itself follows the general rules in company records: what to keep and for how long.
Keeping the assessment alive
A risk assessment is not a one-off exercise. Review it on a regular cycle that you define and justify, and also whenever something material changes:
- a new service, product or delivery channel;
- a new client segment or a move into a new country;
- a change in ownership or in the person responsible for compliance;
- new legislation, guidance or national findings;
- an incident, a regulatory comment or a lesson from a reported suspicion.
Individual customer ratings follow the same logic. Higher-rated clients are refreshed more often than standard ones, and any trigger event, such as an unexplained transaction, prompts an immediate reassessment.
The assessment should also feed the rest of your calendar. Add its review to the compliance calendar so that it is not forgotten, and consider it alongside the yearly routine in the annual compliance checklist.
Common weaknesses to avoid
- A copied template. An assessment that could belong to any company shows that the business was never analysed.
- Ratings without reasons. A grid score with no explanation cannot be defended.
- Controls that are not run. Listing screening or monitoring that does not take place is worse than not listing it.
- No link to onboarding. If the customer rating does not change what staff actually do, it is decoration.
- No approval and no date. An undated, unsigned file is hard to treat as current.
- Ignoring outsourced functions. Delegating a task to a provider does not delegate responsibility for the result.
Consequences of weak compliance are summarised in penalties for failing anti-money laundering duties.
FAQ
Is a business risk assessment the same as customer due diligence?
No. The business risk assessment analyses the exposure of the whole company. Customer due diligence is the work done on one client. The first sets the framework that tells you how much of the second each client needs, and the customer risk rating is the bridge between them.
Who should approve the assessment?
Senior management or the board, because the assessment decides how much risk the company is willing to run. The compliance officer normally prepares it and proposes ratings, but approval by the directors, recorded in minutes, shows that responsibility is not left to one person.
Does a small company with one director need one?
It depends on whether the company falls within the AML/CFT perimeter and on its regulator's expectations. Where it does, the assessment can be proportionate and short, but it must still be specific to the business and written down. A company that is outside that perimeter may still be asked for similar information by its bank or its corporate service provider, so confirm your position with an adviser.
How often should the assessment be updated?
There is no single answer that fits every business. Set a regular review cycle that matches your risk profile, document it, and add event-driven updates whenever your services, clients, countries or the applicable rules change. Check the current expectation of your supervisor.
Can I rely on my service provider's assessment?
You can use a provider's work as input, but you cannot simply adopt it. The assessment must describe your own business, and responsibility stays with the company even when tasks are outsourced. See how to choose a corporate services provider for questions to ask about the provider's own controls.
What happens if the customer rating changes?
Record the new rating and the reason, apply the due diligence level that goes with it, and update the date of the next review. A rating raised because of a suspicion may also require escalation to the compliance officer.
Is there an official template?
Supervisors publish guidance on what an assessment should cover, but the content has to reflect your own business. Treat any model as a structure to fill in, not a document to copy, and read the relevant supervisory material before finalising yours.
If you would like a specialist to review your current approach, you can send a request through the contact form.