Definition
A Business-Wide Risk Assessment (BWRA) is a regulated firm’s documented assessment of the money laundering and terrorist financing risks it faces across its whole business — its clients, services, delivery channels and geographies. It is the foundation document of an AML programme: policies, controls and the depth of client due diligence all flow from it.
What it is
The BWRA is the firm-level risk assessment that sits above any individual client file. Rather than asking whether one client is risky, it asks where money laundering and terrorist financing risk enters the business as a whole: the types of clients served, the services offered, how those services are delivered, and the geographies involved. The output is a documented, reasoned picture of risk — and a set of conclusions that the rest of the AML programme has to follow. Where the BWRA identifies higher risk, the firm's policies, controls and client due diligence should visibly respond to it.
Why it matters for Irish firms
Irish designated persons — accountancy practices, solicitors, estate and letting agents, TCSPs — have carried risk-assessment obligations under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 for years, and the BWRA is typically the first document a supervisor asks to see. In practice, many firms are working from a Word document written some years ago and lightly dusted at review time. A BWRA that no longer matches the firm's actual client base or services undermines everything built on top of it, because it is the stated justification for how much due diligence the firm applies and where.
What changes under the AMLR
From 10 July 2027, Regulation (EU) 2024/1624 (AMLR) becomes the directly applicable rulebook, and its risk-assessment and internal-controls provisions replace the CJA 2010-era basis on which most Irish BWRAs were written. A refresh is not optional housekeeping: the AMLR moves the thresholds and rules the BWRA feeds into — CDD on occasional transactions from €10,000, limited CDD on occasional cash transactions of €3,000 or more, the €10,000 cash cap, harmonised beneficial-ownership rules and prescribed compliance roles. A pre-2027 BWRA calibrated to the old regime will be out of date on the day the AMLR applies, which is why a BWRA refresh anchors most AMLR readiness plans.
How CompliDesk helps
CompliDesk Ireland generates a structured, AMLR-aligned BWRA and keeps it connected to the policies and CDD workflows that depend on it — see pricing for what is included.
General information, not legal advice. This definition provides general information about EU and Irish anti-money-laundering requirements. Regulatory detail is still evolving through 2026–27 — verify against primary sources (EUR-Lex, AMLA, and your sector’s Irish supervisor) and seek qualified advice before acting.