AML Risk Assessments Revisited

The Bank Secrecy Act (BSA) does not explicitly state that money services businesses (MSBs) must conduct an anti-money laundering (AML) risk assessment. However, it does say that an MSB "shall develop, implement, and maintain an effective AML program" and that the program "shall be commensurate with the risks posed by the location and size of, and the nature and volume of the financial services provided" (31 CFR § 1022.210). By that logic, how can an MSB build a program that is commensurate with its risks if it has not evaluated its risks by conducting a risk assessment? How else can an MSB assess its money laundering and terrorist financing risks? Thus, while not a requirement, an AML risk assessment (AML RA) is necessary for an MSB to ensure its AML program is effectively identifying and mitigating its risks.