Enterprise-wide risk assessment (EWRA)

An EWRA assesses the business, not one customer

Customer due diligence assesses one business relationship. The EWRA assesses the business as a whole: which customers, countries, products and channels expose the firm to financial crime, and how far its controls reduce that exposure. Its findings set the frame for customer due diligence, transaction monitoring and screening.

Most EWRAs follow the same sequence.

• Inherent risk. The exposure before controls, assessed factor by factor.
• Controls. How well the firm’s policies, systems and people mitigate that exposure.
• Residual risk. The exposure that remains, which senior management accepts or acts on.

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) consulted in 2026 on draft guidelines for the assessment under the EU’s new AML regulation. The draft sets out four components: an overview of the business, inherent risk, the effectiveness of controls and residual risk.

The names differ by framework. EU law and the European Banking Authority (EBA) say business-wide risk assessment; the Wolfsberg Group and many firms say enterprise-wide risk assessment. Both describe the same exercise.

What the rules require

Each framework asks for the same core: identify and assess the risks, document the assessment, keep it up to date and make it available to the supervisor.

The four risk factors

FATF, the EU and the UK name the same four factors. The AMLR adds the risk of breaching, not implementing or evading targeted financial sanctions.

What correspondent banks ask

A correspondent bank asks its respondents about their EWRA. The standard form is section 6, “AML, CTF & Sanctions Risk Assessment”, of the Wolfsberg Group’s Correspondent Banking Due Diligence Questionnaire (CBDDQ), version 1.4.

Some institutions publish their completed CBDDQ on their website. Of the 1,532 researched institutions whose website answered when Elucidate’s crawler checked it (1 November 2026), 149 had a completed CBDDQ there, or 9.7%.

What else correspondents assess, and the rules behind it: correspondent banking due diligence.

Country risk starts from public lists

The geographic factor draws on lists that name countries: the FATF’s, the EU’s high-risk third countries, and the countries under sanctions. The table counts the institutions in Elucidate’s directory in the countries each list names, as at 24 October 2026. Counts are all institutions in those countries, with or without a BIC.

Each list has its own publisher, date and legal effect, and a country list describes the country, not each institution in it. The EU list follows FATF decisions with a delay, so the two can differ. The sanctions grading is Elucidate’s: a comprehensive embargo prohibits dealings with the country by default, broad sanctions reach the financial sector itself, and targeted listings name individual people and companies. The OFAC lists are as at 21 October 2026 and the EU list as at 23 October 2026.

Listings also name institutions. Of the 36,546 institutions that hold a BIC, 209 appear on the OFAC or EU sanctions lists; 60% of them are in Russia. Sanctions listings are matched on the BIC and on the LEI mapped to it, so they cover institutions that hold a BIC only. Institutions that do not hold a BIC are not screened. The directory does not apply ownership rules, such as OFAC’s 50 Percent Rule.

• Institutions on the OFAC and EU sanctions lists, with programmes and the date each was first listed
• Country pages show every list that names the country, for example Iran, Russia and Vietnam

Financial institutions as customers

For a bank or a payment firm, the customer factor includes other financial institutions: respondent banks, payment and e-money institutions, money service businesses. The first questions are who the institution is, who supervises it and what it is authorised to do.

Elucidate’s directory lists 80,347 institutions in 231 countries: every institution in Swift’s BIC directory, as at 24 October 2026, and the firms on 22 tracked registers, retrieved 24 September–5 November 2026.

• Supervision. Of the 44,705 institutions on a tracked register, 40,577 (91%) are registered with an anti-money-laundering supervisor without a prudential licence. Another 4,393 institutions are prudentially supervised, through a licence on a tracked register or the ECB or FSB bank lists.
• Size. Through branches and subsidiaries, the 29 global systemically important banks (G-SIBs) on the Financial Stability Board’s 2025 list account for 1,914 institutions that hold a BIC. In the euro area, the ECB directly supervises 805 institutions that hold a BIC as significant institutions (23 October 2026).
• Identity. Of the institutions that hold a BIC, 55% have an LEI mapped, which links the BIC to a legal entity and the parents it reports.

• Global systemically important banks and their BICs
• Banks supervised by the ECB
• How to check a payment firm’s licence or registration

Products and channels

Instant credit transfers settle within seconds, which changes how screening and fraud checks run. Regulation (EU) 2024/886 on instant credit transfers in euro changed those controls: payment service providers check their own users against EU targeted financial restrictive measures at least once every calendar day, and Verification of Payee has been required for euro credit transfers since 9 October 2025.

Of the 1,900 institutions reachable for SEPA Credit Transfer in the European Payments Council’s registers (9 October 2026), 66% also accept SEPA Instant Credit Transfer. Verification of Payee is offered by 1,220 (21 October 2026).

Correspondents are a delivery channel too. Of the institutions that hold a BIC, 51% are passive participants: their BIC is registered for identification only, and messages reach them through a correspondent (BIC data as at 24 October 2026). Outside the SEPA schemes, 1,163 institutions in 146 countries are Swift GPI members (24 October 2026).

• Institutions in the SEPA schemes
• Swift GPI members

What public data does not show

• Whether an institution’s controls work. The directory identifies institutions and shows which registers and lists name them. It does not assess them. That assessment is what the FinCrime Index is for, and it can be requested for a named counterparty.
• That an institution is not listed or licensed. Records are matched on BICs and LEIs. Absence from a register, a list or the questionnaire crawl is not evidence that the institution has no licence, listing or questionnaire.
• Ownership exposure. A listing names an entity. Entities that listed persons own or control may fall under the same measures without being listed.
• The current position. Each figure on this page has a date. Screen against the official lists, and check a licence on the regulator’s own register.

Sources

• The FATF Recommendations, Recommendation 1 and its Interpretive Note. Financial Action Task Force (FATF).
• Directive (EU) 2015/849, Article 8. EUR-Lex.
• Guidelines on ML/TF risk factors (EBA/GL/2021/02), 1 March 2021. European Banking Authority (EBA).
• Regulation (EU) 2024/1624, Article 10 and Annexes I to III. EUR-Lex.
• Regulatory instruments, including the draft guidelines under Article 10(4) of Regulation (EU) 2024/1624. Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA).
• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulations 18 and 18A. legislation.gov.uk.
• Correspondent Banking Due Diligence Questionnaire (CBDDQ), version 1.4. The Wolfsberg Group.
• Regulation (EU) 2024/886 on instant credit transfers in euro. EUR-Lex.
• High-risk and other monitored jurisdictions. FATF. FATF lists as restated in HM Treasury’s advisory notice of 22 June 2026. Contains public sector information licensed under the Open Government Licence v3.0.
• Commission Delegated Regulation (EU) 2016/1675, consolidated text. EU lists: © European Union, https://eur-lex.europa.eu, 1998–2026.
• How the directory is built: sources, matching and coverage of every figure on this page. Elucidate.

Reviewed 2 November 2026. Rules and lists change: the publisher’s own text is always the authority. The directory figures are refreshed with each build of this page.

Cite this page

Use this reference to cite the guide. Add the date you read it if your citation style asks for one.