To comply with their obligations set out in Directive (EU) 2015/849, firms should assess:

a) the ML/TF risk to which they are exposed as a result of the nature and complexity of their business (the business-wide risk assessment); and

b) the ML/TF risk to which they are exposed as a result of entering into a business relationship or carrying out an occasional transaction (individual risk assessments) . Each risk assessment should consist of two distinct but related steps:

c) the identification of ML/TF risk factors; and

d) the assessment of ML/TF risk.