When the risk assessment is out of date: what to do first
When your risk assessment is out of date, treat it as a live gap, not paperwork. The first action is to stop using its output for new onboarding and monitoring decisions, record that suspension in writing, and set a fixed date for the refresh. Everything else in this note follows from that single record.
Basis
If your entity operates as a crypto-asset service provider under Regulation (EU) 2023/1114 (MiCA), the risk assessment sits inside the same authorisation file as your governance arrangements, not next to it. Where your activity includes transfers of crypto-assets, the file also carries duties under Regulation (EU) 2023/1113 (TFR), which governs the information that must accompany a transfer.
Neither regulation fixes the national deadline for refreshing an anti-money-laundering risk assessment. That deadline sits in the national law of your registration state, and its exact wording is outside what this page cites. What follows is the procedure that applies regardless of which national clock is running.
What changes once the record is stale
Two things move at the same time. First, the question a supervisor asks changes: not whether the assessment was reasonable when made, but whether it is reasonable now. Second, the exposure moves upstream, toward the authorisation itself, in the same way it does when a When a licence is suspended pending review: what to review starts for an unrelated reason. An outdated assessment rarely triggers a review on its own, but it becomes evidence once a file is already open.
The practical cost is timing, not size. A refresh done in a fixed number of weeks under a written suspension reads as control. The same refresh, done after a supervisor asks for it, reads as remediation.
What to do, in order
- Suspend reliance. The compliance officer instructs front-line staff not to use current risk categories for new onboarding decisions, from that day.
- Log the suspension. The compliance officer records the date, the reason, and the affected categories in the assessment register.
- Map what changed. List every trigger since the last review — new products, new jurisdictions, new counterparties, or structural events such as a When a sublicence appears without consent event that alters who sits behind a client.
- Assign the refresh. The management body names an owner and a completion date, in writing, at the same meeting where the suspension is noted.
- Re-score exposures. The owner re-runs customer and product risk categories against current typologies, not against the categories being replaced.
- Re-file. The compliance officer updates the register and confirms the new rating to the management body before reliance resumes.
Who decides, and on what evidence
The management body owns the refreshed assessment. The compliance function drafts it and keeps the underlying evidence file. Ownership does not shift because the drafting is outsourced; the decision to accept the refresh stays with the management body in every case.
| Decision point | Who decides | Typical timeframe |
|---|---|---|
| Whether reliance is suspended | Compliance officer, immediately | Same day |
| Whether the refresh is adequate | Management body, on review | Fixed at suspension, not open-ended |
| Whether the file satisfies an inspection | Competent authority | At the authority's own schedule |
Branches
If your entity also holds intellectual property tied to the same business line — for instance where an When the opt-out window is closing on a family deadline is running — keep that clock and the risk-assessment refresh separate. They share a calendar, not a decision, and merging them delays both.
If part of your exposure is technical rather than customer-facing — a vendor whose When an SLA credit regime is triggered event has just occurred — treat that event as a fresh input to the assessment, not a reason to wait. The assessment absorbs the event; it does not pause for the event to resolve.
What this page does not cover
This page does not set the national article-level deadline for a periodic anti-money-laundering risk-assessment refresh, and it does not draft the assessment on your behalf. Where several files are open at once — licensing, intellectual property, technology contracts — each has its own clock. Borrowing a deadline from one file for another is a common error, not a shortcut.
Verified
Primary sources: Regulation (EU) 2023/1114 (MiCA), applying from 30 December 2024; Regulation (EU) 2023/1113 (TFR), applying from 30 December 2024. The national deadline for refreshing an anti-money-laundering risk assessment is not part of this file and is not cited here.
FAQ
What is the first step when the risk assessment is out of date?
Stop relying on it. Suspend the current output for new onboarding and monitoring decisions, and record the suspension with a date, before any redrafting starts.
Which deadline is already running?
The deadline that matters first is the one your own management body sets at the moment of suspension. MiCA and TFR do not fix that specific date, and the national anti-money-laundering deadline sits outside this file.
Who decides, and on what evidence?
The management body decides, on the compliance function's mapped list of what changed since the last review — new products, jurisdictions, counterparties, or structural events such as a sublicence appearing without consent.
Related situations
A stale risk assessment often surfaces alongside a question about who owns compliance in the first place: When an outsourced compliance function is questioned.
Next step
If your risk assessment is stale and a supervisor is already asking questions, a partner gives a first answer within minutes during business hours, and a firm price for the file follows within one working day.