# AMLR Art. 10 — Business-wide risk assessment - **Part of:** [[AMLR]] - **FATF keying:** [[FATF R.1 - Assessing risks and applying a risk-based approach|FATF R.1]] - **Swiss provisions:** [[GwV-FINMA Art. 25 - Further duties of AML compliance|GwV-FINMA Art. 25]] - **Detailed citation:** GwV-FINMA Art. 25 Abs. 2 (institution-wide risk analysis, board-approved) ## What it requires Obliged entities must take risk-proportionate measures to identify and assess their ML/TF and sanctions-evasion risk, taking into account the Annex I-III risk variables and factors, EU-level and national risk assessments, relevant international and EU publications, competent-authority information and the customer base, and must assess risk before launching new products, channels, technologies, customer segments or geographic markets. The assessment must be documented, kept up to date and reviewed on relevant events, drawn up by the compliance officer, approved by the management body, and made available to supervisors on request. ## Swiss position GwV-FINMA Art. 25 Abs. 2 requires the Geldwäschereifachstelle, or another independent unit, to prepare an institution-wide risk analysis taking particular account of client domicile or residence, client segment, and the products and services offered; the analysis must be approved by the board of directors or the oberstes Geschäftsführungsorgan and updated periodically. This sits in Title 1 of the ordinance (Art. 1-34), so it binds all FINMA-supervised intermediaries directly, not only a subset. Breach of the duty can call the intermediary's guarantee of irreproachable business conduct into question (GwV-FINMA Art. 9 Abs. 1), and a serious breach can support a professional ban under FINMAG Art. 33 or confiscation of the resulting profit under FINMAG Art. 35. ## Key divergences AMLR Art. 10 binds every obliged entity directly, requires the assessment to be drawn up specifically by the compliance officer and, where a supervisory-function body exists, communicated to it, and lets supervisors waive the individual documented assessment for any obliged entity except credit institutions, financial institutions, crowdfunding service providers and crowdfunding intermediaries, who must always have one. The Swiss duty sits only in FINMA's own ordinance, so it binds FINMA-supervised intermediaries; SRO-supervised intermediaries and, since 1 October 2026, advisers are governed by their SRO's regulations (GwG Art. 25), not by GwV-FINMA Art. 25. Enforcement also differs structurally: AMLD6 requires Member States to provide pecuniary sanctions for AMLR breaches, while Switzerland routes a risk-assessment failure through the intermediary's fit-and-proper guarantee and, for serious cases, a professional ban or profit confiscation under the Financial Market Supervision Act — a licensing-based route rather than a fine. ## Further connections *These links come from an article-by-article comparison of the primary texts. They add to the provisions listed at the top of this note and make no equivalence claim.* - [[FATF R.15 - New technologies|FATF R.15 — New technologies]] — Both require a pre-launch ML/TF risk assessment of new products, delivery channels and technologies, with mitigation measures; AMLR also covers new customer segments and geographies. *(direct)* ## Authoritative text > [!quote]- Regulation (EU) 2024/1624 (AMLR), Article 10 — English text (EUR-Lex, CELEX 32024R1624) > **Article 10** > *Business-wide risk assessment* > 1. Obliged entities shall take appropriate measures, proportionate to the nature of their business, including its risks and complexity, and their size, to identify and assess the risks of money laundering and terrorist financing to which they are exposed, as well as the risks of non-implementation and evasion of targeted financial sanctions, taking into account at least: > (a) the risk variables set out in Annex I and the risk factors set out in Annexes II and III; > (b) the findings of the risk assessment at Union level conducted by the Commission pursuant to Article 7 of Directive (EU) 2024/1640; > (c) the findings of the national risk assessments carried out by the Member States pursuant to Article 8 of Directive (EU) 2024/1640, as well as of any relevant sector-specific risk assessment carried out by the Member States; > (d) relevant information published by international standard setters in the AML/CFT area or, at the level of the Union, relevant publications by the Commission or by AMLA; > (e) information on money laundering and terrorist financing risks provided by competent authorities; > (f) information on the customer base. > Prior to the launch of new products, services or business practices, including the use of new delivery channels and new or developing technologies, in conjunction with new or pre-existing products and services or before starting to provide an existing service or product to a new customer segment or in a new geographical area, obliged entities shall identify and assess, in particular, the related money laundering and terrorist financing risks and take appropriate measures to manage and mitigate those risks. > 2. The business-wide risk assessment drawn up by the obliged entity pursuant to paragraph 1 shall be documented, kept up-to-date and regularly reviewed, including where any internal or external events significantly affect the money laundering and terrorist financing risks associated with the activities, products, transactions, delivery channels, customers or geographical zones of activities of the obliged entity. It shall be made available to supervisors upon request. > The business-wide risk assessment shall be drawn up by the compliance officer and approved by the management body in its management function and, where such body exists, communicated to the management body in its supervisory function. > 3. With the exception of credit institutions, financial institutions, crowdfunding service providers and crowdfunding intermediaries, supervisors may decide that individual documented business-wide risk assessments are not required where the specific risks inherent in the sector are clear and understood. > 4. By 10 July 2026, AMLA shall issue guidelines on the minimum requirements for the content of the business-wide risk assessment drawn up by the obliged entity pursuant to paragraph 1, and on the additional sources of information to be taken into account when carrying out the business-wide risk assessment. ## Sources - AMLR Art. 10 — CELEX 32024R1624 - GwV-FINMA SR 955.033.0, Art. 25, Art. 9 - FINMAG SR 956.1, Art. 33, Art. 35