The Three Layer Framework: NRA, BRA and CRA

How a Business Risk Assessment Supports a Regulated Firm's Financial Crime Governance

From the National Risk Assessment to the customer file: why the architecture of risk governance only works when each layer is properly constructed, connected and maintained.

Compliance Governance Review  |  In light of the FCA's April 2026 CDD Findings

Regulated firms are not merely expected to have financial crime controls in place. They are expected to demonstrate that those controls are proportionate, evidence-based, and traceable to a coherent governance architecture. At its foundation sits the Business Risk Assessment, and its absence, inadequacy or disconnection from day-to-day compliance activity remains one of the most persistent failures the FCA continues to identify.

In April 2026, the Financial Conduct Authority published findings from its 2025 multi-firm review of Customer Due Diligence, Enhanced Due Diligence, and ongoing monitoring controls. The review covered asset managers, crowdfunders, wholesale banks, CFD providers, and non-bank lenders. The conclusions were pointed: while most firms had basic frameworks in place, too many fell short in tailoring assessments to specific business risks, documenting decisions effectively, and ensuring controls scaled with their growth.

This article sets out the full governance architecture, from international standards to the individual customer file, and explains how each layer must function, and how each depends on the others.

| PART ONE |

The Three Layer Framework: NRA, BRA and CRA

Financial crime risk governance operates across three distinct but interconnected levels. Understanding what each layer is, who produces it, and what it must contain is essential before any firm can claim to operate a genuine risk-based approach.

The National Risk Assessment

The National Risk Assessment is a statutory document produced by HM Treasury and the Home Office, drawing on intelligence from law enforcement, supervisory bodies, and industry. It maps the money laundering and terrorist financing threats facing the United Kingdom, identifying the sectors, products, geographies, and typologies most exposed to criminal exploitation.

The NRA does not exist in isolation. The FATF Recommendations (first adopted in 1990 and substantially revised in 2012, with subsequent amendments) require countries to identify, assess, and understand their money laundering and terrorist financing risks. From this obligation flows the NRA. And from the NRA flows the firm-level obligation.

Critically, when a new NRA is published, Business Risk Assessments must be reviewed and updated to ensure they remain consistent with the revised understanding of national-level threats. A BRA calibrated against a 2020 NRA and left unchanged after a revised assessment is not a compliant document. It is a liability.

| PART TWO |

The Business Risk Assessment

The Business Risk Assessment is the central governance document for any regulated firm's financial crime framework. It is not a summary of operational policies. It is not a high-level narrative describing the firm's business. It is a structured, quantitative analysis of the specific money laundering and terrorist financing risks that the firm faces, calibrated to the firm's actual activities.

Quantitative, Not Qualitative Alone

The FCA's November 2025 multi-firm review of Business-Wide Risk Assessments found that good practice combined both quantitative and qualitative analysis to consider inherent risks, the effectiveness of controls, and residual risk. Poor practice was characterised by overly simplistic assessments that focused on generic risks while failing to explain how each identified risk specifically affected the firm's business.

A well-constructed BRA assigns numerical scores, or at minimum ordinal ratings with defined criteria, to each risk dimension. This quantification enables the firm to articulate its inherent risk exposure before controls, demonstrate how its control environment reduces that risk, and express the residual risk that remains. Without this, a risk appetite statement is meaningless: a board cannot confirm an appetite for a risk it cannot measure.

Annual Review and Risk Appetite

The BRA must be reviewed and formally confirmed at least annually. This is not a bureaucratic requirement. It reflects the reality that the firm's risk profile changes: new products are launched, customer bases shift, typologies evolve, and the regulatory environment develops. An annual review that simply re-endorses last year's document without genuine reassessment is not a review at all.

Crucially, each annual review must be accompanied by a risk appetite statement that genuinely reflects the board's position. A risk appetite statement is a board-level governance document that articulates the nature and quantum of financial crime risk the firm is prepared to accept in pursuing its business objectives. It must be specific, not aspirational. It must state the firm's tolerances for high-risk customers, geographic exposures, and product categories in terms that translate directly into operating parameters for first-line staff.

Parameters to be Risk-Assessed in the BRA

The following dimensions must be assessed as part of a comprehensive Business Risk Assessment, aligning with the parameters required for the Financial Crime Annual Return and the expectations set out in the JMLSG Guidance:

• Delivery channels (face-to-face, digital, intermediary, third-party introducers)

• Third-party reliance for CDD or transaction processing

• Customer types (retail, corporate, high-net-worth, PEPs, non-profit organisations)

• New and emerging products or services under development

• Geographic spread of customers and counterparties

• Appointed representative and introducer networks

• Products and services offered and their inherent risk characteristics

• Ownership structure and beneficial ownership complexity

• Transaction types and volumes (value, frequency, complexity)

• Sector-specific typologies identified in the NRA and FATF guidance

• Jurisdictions in which the firm is active or has exposure

• Results of the compliance monitoring programme and internal audits

• Nature and size of the customer book

• Findings from supervisory visits and thematic reviews

Feeding Back into the BRA

The BRA is not a static document produced once a year and filed away. It must be a living governance tool. The following must feed back into the BRA on an ongoing basis:

• Results from the compliance monitoring programme and periodic reviews

• Findings from any new products or services being considered or launched

• Changes to applicable JMLSG guidance, FCA Handbook provisions, or GFSC/JFSC Handbook requirements

• Outcomes of supervisory engagements or thematic exercises

• Intelligence received about emerging typologies or sector-specific risks

| PART THREE |

The Customer Risk Assessment

If the Business Risk Assessment is the architecture, the Customer Risk Assessment is where that architecture meets the real world. A CRA must exist for every customer relationship and every business relationship the firm maintains. It is not a document produced once at onboarding and forgotten. It is a continuously relevant assessment of the risk a specific customer poses to the firm.

The CRA must assess overall risk based on a confluence of risk factors. No single factor should be determinative, and the firm must demonstrate genuine analytical judgement rather than mechanical scoring.

Linkage to the BRA

This is the connection that the FCA's 2025 reviews consistently found to be missing or poorly constructed. The CRA must not be a standalone document with its own independent logic. Its risk scoring methodology, its weighting of risk factors, and its focus for the risk-based approach must all derive from, and be consistent with, the BRA.

Where the BRA has identified geographic risk as a primary driver, for example because the firm serves customers with connections to jurisdictions on the FATF grey or black lists: that weighting must be reflected in the CRA scoring model. In stronger performing firms, the FCA observed that the high-level risks from the BWRA were translated into specific weightings or sub-factors within the CRA process, creating a practical link between the BWRA and day-to-day compliance functions.

Risk Factors the CRA Must Capture

A CRA must assess risk across a range of dimensions including: the customer's identity and legal status; the nature and purpose of the business relationship; the customer's country of domicile, establishment, and ultimate beneficial ownership; the products and services being used; expected transaction volumes and patterns; source of funds and source of wealth; any adverse intelligence, PEP status, or sanctions exposure; and the delivery channel through which the relationship is conducted.

Periodic Review Requirements

Each CRA must be subject to periodic review, with the frequency calibrated to the customer's risk rating. A high-risk customer must be reviewed more frequently than a standard-risk customer. The FCA found in its 2025 CDD review that many firms lacked sufficient detail on how often periodic reviews should take place, and that those reviews were often not carried out in a timely manner.

Critically, a firm must not rely solely on periodic reviews to identify changes in a customer's risk profile. Ongoing monitoring of customer information and transactional data must feed into the CRA in a timely manner, so that material changes such as altering beneficial ownership, a new adverse media alert or an unusual transaction, are reflected promptly rather than being deferred until the next scheduled review.

Rationale for the Relationship

Every customer relationship must have a clearly documented rationale: why did the customer approach the firm, what products and services does the customer require, and why is the firm's offering appropriate for those needs? Without this foundation, no other element of the compliance framework can function effectively. Transaction monitoring without an understanding of expected activity is guesswork. CDD without an understanding of the relationship's purpose lacks context. Consumer Duty and treating customers fairly obligations are impossible to discharge without knowing why a customer is there in the first place.

| PART FOUR |

CDD, EDD and the Risk-Based Approach

The CRA determines the level of Customer Due Diligence the firm must collect. There are many acronyms used which are often blurred, misunderstood or since depreciated. KYC is one such now depreciated term which had different understandings as to what it entails. CDD is now standardised, EDD must be clearly distinguished where required and in its application. Often not appreciated is that a CRA is part of the CDD. The two are intertwined and combined with the risk approach, EDD may be gathered to mitigate a risk or is obligated because of the CRA rating, yet simplified measures are also available for customer relationships or within more complex customer arrangements.

Standard Customer Due Diligence (CDD)

Customer Due Diligence refers to the baseline measures applied across all customer relationships. It includes: identifying the customer and verifying that identity on the basis of documents, data, or information obtained from a reliable and independent source; identifying the beneficial owner where the customer is not an individual and taking reasonable measures to verify their identity; obtaining information on the purpose and intended nature of the business relationship; and conducting ongoing monitoring of the relationship.

Simplified Customer Due Diligence

Simplified Due Diligence measures may be applied where the CRA establishes that the risk presented by a customer or transaction is lower than standard. Where the CRA permits simplified measures, firms should use them, as they reduce the burden on staff and customers alike, improve the customer experience, and allow compliance resources to be focused where risk is genuinely elevated. Simplified measures may also be appropriate for constituent parts within a larger or complex customer structure to focus on components which present higher risks.  

Enhanced Due Diligence (EDD)

Enhanced Due Diligence is required for all customers presenting a higher risk of money laundering or terrorist financing. This includes, at minimum, Politically Exposed Persons and their associates, customers from or with connections to high-risk third countries, correspondent banking relationships, and any customer whose CRA establishes a high-risk rating.

EDD is not a standardised checklist that can be applied uniformly. It must be tailored to the specific risk factors identified in each customer's CRA. The EDD collected must address the specific risks identified, and it may also be used as a mitigant by gathering additional information to reduce an initially elevated risk rating where the evidence supports doing so. EDD is not a broad brush to overly collect due diligence on understood risk factors because of the convenience that presents. 

How CDD and CRA Interact

The relationship between the CRA and CDD is bidirectional. The CRA determines what CDD must be collected. But the CDD collected, including its content, quality and any gaps, in turn informs the overall risk assessment. If CDD reveals that a customer's stated source of funds cannot be substantiated, that finding must flow back into the CRA. If ongoing monitoring identifies transaction patterns inconsistent with the customer's stated purpose, that intelligence must update the CRA and potentially trigger a review of the CDD held.

Senior management approval must be formally obtained and documented for all high-risk customer relationships. This approval must not be a single, once-at-onboarding sign-off: it must be reviewed at each periodic review cycle and whenever a material change occurs. The FCA has consistently found that approval processes exist on paper but are poorly evidenced in practice.

| PART FIVE |

Governance Challenges: What Goes Wrong in Practice

Even where firms have constructed technically adequate BRAs and CRA frameworks, the practical implementation of financial crime governance presents persistent challenges. The following are among the most common and most consequential.

1.  Auditing CDD Process and Decision-Making

Without a clear and documented audit trail showing what information was collected, when, by whom and what decision was taken on what basis, it is impossible to demonstrate compliance after the fact. The FCA has observed firms with no version control of documentation, making it impossible to show an audit trail of reviews or changes. Every decision in the CDD process must be recorded in a way that a third party, whether internal audit, a supervisor or an enforcement team, can follow and evaluate.

2.  Recording Senior Management Approval for High-Risk Relationships

Approval matrices must be specific and enforced. Firms must record not only that approval was given, but when, by whom (by name and role), on the basis of what information, and for what period. For ongoing high-risk relationships, the terms of approval, including any conditions or additional monitoring requirements, must be documented and tracked.

3.  Methods of Gathering CDD: Avoiding Over-Reliance on Customers

Placing the burden of CDD collection entirely on the customer creates friction, degrades the customer experience, and frequently results in incomplete files. Firms should triangulate across multiple sources: internal data, commercially available verification services, open-source intelligence, Companies House (verification depending), land registry data, and other reliable independent sources. The FCA noted that policies often failed to explain what alternative evidence should be sought when customers cannot provide standard identification documents.

4.  Applying Simplified CDD Where Permitted

Firms that apply a uniform standard of CDD across all customers regardless of risk misallocate compliance resources and create poor customer experiences for low-risk individuals. Where the CRA permits simplified measures, firms should apply them confidently, documenting the basis on which simplified CDD has been applied. This is not a relaxation of standards; it is the risk-based approach working as intended.

5.  Customer Data Storage, Retrieval and System Integration

CDD held in disparate systems such as paper files, scanning folders, relationship management tools and core banking/service provider platforms cannot be retrieved efficiently, cannot be aggregated for MI purposes, and cannot be made available quickly in response to supervisory requests. Every system that holds customer data must be connected. Manual processes for transferring data between systems introduce errors, delay periodic reviews, and produce unreliable management information.

6.  Ongoing Customer Data Feeding into the CRA

A periodic review that occurs annually is by definition backward-looking for the eleven months that precede it. Firms must establish mechanisms by which ongoing information including new adverse media, changes in beneficial ownership and alterations in transaction behaviour, feeds into the CRA in real time or near real time. Event-driven reviews must be triggered automatically by defined criteria, not left to individual judgment. Ultimately decisions must be made as to whether to maintain or terminate customer relationships, from new business applications and throughout the course of that business relationship.

7.  Compliance Monitoring Results Feeding Back into the BRA

The compliance monitoring programme exists partly to test whether controls are functioning as intended. Where it identifies gaps, such as a pattern of incomplete CDD files, inconsistent application of EDD criteria or delays in periodic reviews; findings from compliance assurance programmes must be escalated to the board and addressed starting with the BRA. A BRA that does not reflect the reality of the firm's control environment is a fiction. Any new product or service must also be risk-assessed before launch, and findings incorporated into the BRA.

8.  Regulatory Changes Reflected Across the Governance Framework

Changes to the JMLSG Guidance, FCA Handbook, GFSC or JFSC Handbooks, or the publication of a new NRA or FATF typologies report must trigger a review of the BRA and CRA methodology. Regulatory change is not an event that happens to a firm's policies in isolation. It must flow through the entire governance architecture.

| CONCLUSION |

Bringing It Together

The architecture of financial crime governance is not complex in concept. The NRA describes the landscape. The BRA, two separate documents, one for ML and one for TF, quantitative and annually reviewed, translates that landscape into a firm-specific risk profile. The CRA applies that profile to each customer relationship. CDD is collected accordingly, with EDD tailored to specific high-risk profiles. The results feed back up the chain.

What is complex is execution. Firms that treat the BRA as an annual filing exercise, the CRA as a scoring template applied mechanically at onboarding, and CDD as a documentation exercise disconnected from genuine risk understanding will find themselves at the sharp end of supervisory attention. The FCA's April 2026 findings make clear that the regulator expects more than minimum regulatory compliance. It expects genuine risk understanding, evidenced in writing, maintained over time, and proportionate to the firm's actual risk profile.

Good practice, as the FCA has observed, often goes beyond minimum regulatory requirements. The firms that understand this are the ones building durable, proportionate, and genuinely effective financial crime governance frameworks.

| REGULATORY SOURCES AND REFERENCE FRAMEWORK |

Regulatory Sources and Reference Framework

The governance framework described in this article draws on the following regulatory instruments and guidance. Firms should maintain active awareness of developments across all applicable sources.

This article is for information purposes only and does not constitute professional advice. Firms should take specific legal and compliance advice in relation to their own obligations.

Photo by David Underland on Unsplash