The systems and controls that firms should put in place to ensure their individual and business- wide risk assessments remain up to date should include:

a) Setting a date for each calendar year on which the next business-wide risk assessment update will take place, and setting a date on a risk sensitive basis for the individual risk assessment to ensure new or emerging risks are included.

b) Where the firm becomes aware before that date that a new ML/TF risk has emerged, or an existing one has increased, this should be reflected in their individual and business-wide risk assessments as soon as possible; and

c) Carefully recording issues throughout the relevant period that could have a bearing on risk assessments, such as internal suspicious transaction reports, compliance failures and intelligence from front office staff.

d) Where the firm is launching new products, services, or business practices, or significantly changing them, including where it introduces a new delivery channel, or adopts an innovative technology as part of its AML/CFT systems and controls framework, it should assess the ML/TF risk exposure prior to the launch of these products, services or business practices. Where these products, services or business practices have a significant impact on the firm's ML/TF risk exposure, the firm should reflect this assessment in its business-wide risk assessment carried out in accordance with Article 8(2) of Directive (EU) 2015/849 and its policies and procedures.