Reg 18 Risk Assessment Collaboration

As at 26th June we have two Teams of 8 and everyone has logged into their Secure Room. We are in the process of arranging our first Webinar and Conference call for each team when we will agree the way forward and make a start drafting the Reg 18 Risk Assessment.

If you are a member of a Compliance Team in a regulated professional firm in the UK and would like to join a Collaborative Team of 7 others, please email Graham on

Each team will work separately and we will then pool the resultant Risk Assessments periodically so that we all get the benefit of each other's ideas.

For an overview of what needs done see an excellent article by Jonathan Fisher QC entitled “Preparing a Firm's ML and TF Risk Assessment and Independent Audit Function”.

For the mechanics of how this reviewing, updating and e-publishing might work see video at: “1. Digital Framework for AML Manual”.

Kirklands will organise an online Secure Room for each Team, put a starter pack of reference documents into it and provide support.

The Secure Room is something Kirklands uses with our clients to get their instructions on contracts. It is easy to use. The facilities are basic but it does the job of providing an online Secure Room that is available 24/7 and where a group of people can work collaboratively on a project such as this.

What is clear is that like a maths exam “showing your workings” is as important as the answer you arrive at.

The approach you take to creating the initial and subsequent versions of your Reg 18 Risk Assessment, the research you do and the steps you go through to publish this initial version and subsequent updates have to be recorded and produced on request.

Producing a style Reg 18 Risk Assessment to the auditor from your Supervisory Authority without being able to show “workings” or without it being reflected in how your firm works in practice will be tantamount to confessing to a breach which, under the new Enforcement powers introduced by the Regulations, could (OK it is unlikely, but it could) result in you being forced to sell your interest in your firm [See Reg 26(11)].

There is no cost other than your time. It is work someone in your firm is going to have to do as a matter of urgency (see Enforcement powers in new Regulations) and doing it with a group of 7 others will lighten the load.

With a fair wind the firms involved in this collaborative effort will have a serviceable Reg 18 Risk Assessment for their firm within weeks rather than months.


We are particularly pleased to be an approved supplier with the Law Society of Scotland