Firm-wide AML risk assessment

How the tool works

1. The firm. Name, form of practice, headcount, bar, person responsible at the highest level (art. 9 §1), AMLCO (art. 9 §2), the member who signs off the policies (art. 8 §3), the date of the assessment and the next review.
2. Activities. For each transaction of art. 5 §1 28°, how often it occurs in the practice: never, occasionally or regularly. With none of these activities, the document says the due diligence duties do not apply to the practice, and the review stays planned.
3. Risks. Clients (types, relationships, politically exposed persons), services and transactions, delivery channels and geography, with the factors of Annexes II and III and those of the bars' public templates, each by how often it occurs.
4. Controls. The measures already in place (procedures, scope check, assessment of each client, UBO register access, sanctions screening, training, record keeping, whistleblowing channel, file reviews) and the sources taken into account, including the national risk assessment.
5. The document. Purpose and legal basis, method, activities, risks per category, overall exposure and its reasons, controls in place, mitigation measures and action plan, residual risk, sources, review and signatures. It is shown while you answer and exports as Word or PDF, in the language you choose.

The method

Each factor is rated by how often it occurs, as in the bars' public templates: never, occasionally, regularly. A category is rated higher when a factor occurs regularly, when two factors occur occasionally, or when a major factor (complex structure, nominee shareholders, payments from unknown third parties, a sanctioned country…) occurs occasionally. The overall exposure is high as soon as the firm has clients for whom the law makes enhanced due diligence mandatory (arts. 38, 39 and 41). It is the same logic as the client risk assessment, applied to the whole practice.

The residual risk after controls is not computed: it remains the assessment of the person responsible, which the document records. The European guidelines on that step are not final.

Legal basis

• Law of 18 September 2017: art. 7 (risk-based approach), arts. 16 to 18 (overall assessment), art. 8 (policies and procedures), art. 9 (responsible persons), Annexes I to III (variables and factors).
• OVB Codex, annex 1, art. 4 §2: organisation at firm level above 25 lawyers, staff and trainees.
• The public structure of the Ghent bar's firm-wide analysis template (2023) and the OVB procedure handbook, cited as sources: the text of the document is our own.

Points to check

• The method is a proposal based on the law, to be reviewed and adapted by the person responsible. The firm may add its own factors.
• Updating the overall assessment calls for updating the clients' individual assessments (art. 17).
• The amount threshold you set here is then used in each individual assessment.
• The names you type stay on this device; with a verified e-mail address, the firm's name is pre-filled and the document carries your letterhead.

Verification

The rules were verified on 7 October 2026 against the consolidated text of the law and the bars' public pages. The tool assists the lawyer, who remains responsible for the assessment and how it is applied.