EWRA (Enterprise-Wide Risk Assessment)

Supervisors now ask financial institutions and regulated businesses for the EWRA first to identify, measure, and manage financial crime risks. No matter whether you are a Singapore bank, an EU obliged entity or a US institution, this guide explains what an EWRA is, what the latest regulatory requirements are, and how to build one that fulfils supervisory review.

What Is an EWRA?

An enterprise-wide risk assessment (EWRA) is a documented assessment of an institution’s exposure to money laundering, terrorist financing, and proliferation financing. It measures the risk associated with customers, geographies, products, services, and delivery channels, then weighs existing control measures to counter it and assesses how much risk remains despite those measures.

The EU Anti-Money Laundering Regulation calls the same exercise a “business-wide risk assessment” (BWRA) under Article 10 of the EU Anti-Money Laundering Regulation (AMLR – Regulation (EU) 2024/1624). The name differs, but the purpose does not, as the main purpose is where financial crime risk sits and how controls are countering it.

Is an EWRA Required for AML Compliance?

FATF’s Recommendation 1 expects financial institutions to have the ability to identify, assess, monitor, manage and nullify ML and TF risks. FATF in October 2020 revised its recommendations and required countries, financial institutions and DNFBPs to assess and mitigate proliferation financing risk. FATF declared this risk as the potential breach and non-implementation or evasion of UN targeted financial sanctions. National EWRA rules are derived from this standard. EWRA is the document that justifies your controls, staffing and risk appetite.

What Do the Main Regulators Require?

Paragraph 4 of MAS Notice 626 requires banks to take adequate and concrete steps to identify, assess and understand ML/TF risk across customers, the countries those customers are from or in, the countries where the bank operates, and its products, services, transactions and delivery channels. Those steps also include documenting the assessment. MAS has issued parallel notices across other licensed sectors, and you have to check the notice for your licence type. To comply with it, banks must measure these inherent risks against their internal screening and monitoring control methodologies to get an idea about their residual risk. They are also required to update this documented assessment at least once every two years.

MAS conducted a series of thematic EWRA inspections in 2020 to measure the effectiveness of EWRA and published supervisory expectations that institutions should benchmark against. Its revised notices were published on 1 July 2025 and reflect PF developments, and the March 2025 industry best practice paper on countering proliferation financing offers methodology examples for PF assessments.

What Is Changing in the EU?

Article 10 AMLR (Regulation (EU) 2024/1624) requires businesses to calculate their exposure to money laundering, terror financing, and sanctions evasion by combining their own customer data with official Annex checklists, EU-wide reports, and national risk assessments. The regulation applies from 10 July 2027. AMLA opened consultation on draft BWRA guidelines on 16 April 2026, and it closed on 15 July 2026. In corporate sectors, parent companies should consolidate entity-level assessments into a combined, unified group-wide risk perspective. Compliance teams should use the current draft guidelines as an indicative roadmap to design their compliance frameworks while awaiting the final, binding guidelines from AMLA.

What Does the US Expect?

The FFIEC manual states there is no requirement to update the BSA/AML risk assessment on a continuous or regular periodic basis. Instead in case of a major event like if there is a major change like merging with another bank or launching a risky new digital app. If a bank’s assessment is missing or lacks information, examiners must build one from available information. An examiner-built assessment is rarely in your favour. Regulators can punish the bank with an incredibly strict, high-risk rating to protect the financial system, which almost always triggers expensive penalties, forced audits, and heavy restrictions on the business.

How Do You Conduct an EWRA?

Conducting an effective EWRA requires following six steps:

The six-step EWRA cycle: inherent risk minus control effectiveness equals residual risk.

1. Set the scope and methodology. Include every legal entity, branch and business line. Fix scales, weights and risk appetite before scoring.
2. Identify inherent risk factors. Risk factors must cover customers, geographies, products, services, transactions and channels. Use national and sector risk assessments as inputs.
3. Rate inherent risk. Make and apply one scoring scale across all units so results can be comparable.
4. Test existing control effectiveness. Evaluate and rate the existing controls including the design and operation of customer due diligence, screening, monitoring, training and governance that are backed with evidence.
5. Calculate residual risk. Inherent risk minus control effectiveness equals residual risk. Compare it to risk appetite and assign extra control measures along with completion dates.
6. Document, approve and refresh. Document the findings and suggestions and get it signed off by a senior executive, retain methodology and evidence, and review periodically or in case of any trigger events.

Where Do EWRAs Most Often Fail?

These failure points follow from the requirements above:

• Inconsistent scoring. Different departments grade the exact same risk using completely different scales, which makes the final corporate total completely wrong and misleading.
• Incomplete perimeter. When a bank buys a new company or launches a new app, they forget to include them in the safety checks, even though these big changes are supposed to trigger an automatic update.
• Static annual exercise. The bank treats the risk check like a once-a-year formality on a calendar and fails to refresh it when massive, game-changing events happen mid-year.
• Unexplained ratings. The risk scores and math numbers are picked out of thin air with no written proof or reasoning, leaving the bank completely unable to defend its choices to government auditors.
• No PF lens. The bank completely ignores the consequences of criminals secretly bypassing international rules or dodging financial sanctions.
• No link to action. The final risk results are just stuffed into a report; they are never used to fix broken security systems, change the company budget, or update corporate rules.

How Do You Choose an EWRA Service Provider?

Judge any EWRA service provider on clear evidence, not on the claims of the provider only. Always check:

• Jurisdictional fluency: can they map to MAS Notice 626, AMLR Article 10 or FFIEC expectations for your licence type?
• Transparent methodology: can you see and defend every weight and score?
• Full-risk coverage: their risk coverage, including ML, TF, PF and sanctions.
• Group roll-up: consistent consolidation of entity results.
• Audit-ready outputs: methodology they use, evidence log and board report.
• Maintenance model: who owns refreshes after delivery?

Ask for a sample deliverable and references from comparable institutions.

EWRA FAQs

How often should an EWRA be updated?
No single global frequency applies. The FFIEC manual sets no required periodic update but expects one when risk changes. The EU AMLR requires the assessment to be kept up to date and reviewed after material events. Align your schedule to the strictest regulatory authority and rules you face.

What is the difference between an EWRA and a customer risk assessment?
An EWRA measures risk for the whole institution; a customer risk assessment rates one relationship. MAS introduced the institution-level requirement in addition to assessing individual customers’ risk. Customer data feeds the EWRA, and EWRA findings should shape customer risk models.

Does an EWRA need to cover proliferation financing?
In FATF-aligned jurisdictions, generally yes. FATF extended Recommendation 1 to PF in 2020, Singapore’s 2025 revisions address PF developments, and the AMLR covers targeted financial sanctions evasion risk. Scope PF as a sanctions-evasion exposure.