According to the ACAMS CAMS Certification Study Guide (6th edition), a financial institution (FI) should update its ML/TF risk assessment when there are changes in its business activities, customer base, or operating environment that may affect its exposure to ML/TF risks1 Some examples of such changes are:
When new products, services or customer types are introduced: New products, services or customer types may introduce new or increased ML/TF risks that the FI may not have previously considered or addressed. For example, offering online banking, prepaid cards, or cross-border remittances may create new opportunities for money launderers or terrorist financiers to exploit the FI's systems and processes. Therefore, the FI should assess the ML/TF risks associated with the new products, services or customer types and implement appropriate controls to mitigate them12 When the institution faces a merger or acquisition: A merger or acquisition may result in the FI inheriting the ML/TF risks of the other entity, as well as the potential liabilities and reputational damage that may arise from any ML/TF issues or violations. Therefore, the FI should conduct a due diligence on the other entity's ML/TF risk assessment, policies, procedures, and controls, and identify any gaps or weaknesses that need to be addressed. The FI should also integrate and harmonize the ML/TF risk assessment and compliance programs of the merged or acquired entity with its own13 References: 1: ACAMS CAMS Certification Study Guide (6th edition), page 32. 2: Money laundering/terrorism financing risk assessment | AUSTRAC4 3: MONEY LAUNDERING & TERRORIST FINANCING (ML/TF) RISK ASSESSMENT METHODOLOGY5, page 4.
Reference: https://www.fatf-gafi.org/media/fatf/content/images/National_ML_TF_Risk_Assessment.pdf