Understanding the Key Differences Between Institutional ML/TF Risk Assessment and Internal Audit for TCSP Licensees
Trust or Company Service Provider (TCSP) licensees in Hong Kong are required to comply with the anti-money laundering and counter-financing of terrorism (AML/CFT) requirements under the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Trust or Company Service Provider Licensees) (as revised in March 2025) issued by the Registrar of Companies. Two critical but often confused components of these obligations are the Institutional Money Laundering/Terrorist Financing (ML/TF) Risk Assessment (IRA) and the independent audit (IA) function.
While both serve essential roles in a robust AML/CFT framework, they are not equivalent. Understanding their differences, how they complement each other, and their distinct regulatory purposes is key to achieving compliance.
What is an Institutional ML/TF Risk Assessment (IRA)?
The IRA is a forward-looking process designed to help a TCSP licensee identify, assess, and understand the ML/TF risks to which its business is exposed. Its primary goal is to form the basis for a risk-based approach, enabling the TCSP licensee to determine how and to what extent it is vulnerable to ML/TF risk, and to implement measures that are commensurate with those risks.
What are the key features of the IRA?
- Approach: No one-size-fits-all methodology. The nature and extent of the assessment must be proportionate to the nature, size, and complexity of the business.
- Frequency: Must be conducted at least every two years, and also upon trigger events that materially impact the TCSP licensee’s business or risk exposure.
- Risk categories to cover: Customer risk, country/jurisdiction risk, product/services risk, transaction or delivery channel risk.
- Output: A risk register, residual risk ratings, and mitigation strategies.
What is the Independent Audit (IA) Function?
The independent audit function provides an objective, retrospective review of the effectiveness of the TCSP licensee’s AML/CFT systems. It is not a forward-looking risk assessment but rather a critical evaluation of existing controls and processes.
What are the regulatory requirements for an IA?
- Independence: The audit function must be independent, with a direct line of communication to senior management, and sufficient expertise and resources.
- Scope of Review: IA should assess the adequacy of the AML/CFT systems, the ML/TF risk assessment framework, the application of the risk-based approach, the effectiveness of suspicious transaction reporting systems, the effectiveness of the compliance function, and the level of staff awareness regarding AML/CFT responsibilities.
- Frequency and Extent: Should be commensurate with the nature, size, complexity, and ML/TF risks of the business. Where appropriate, an external party review should be sought.
Key Differences at a Glance
| IRA | IA | |
| Perspective | Proactive identification & understanding of inherent ML/TF risks | Retrospective testing of the effectiveness of controls & compliance |
| Key Question | Where are we vulnerable, and how much risk do we face? | Are our controls working as designed, and are we following policies? |
| Nature | Forward-looking, strategic, risk-based | Backward-looking, operational, compliance-based |
| Timing/ Frequency | Every 2 years + trigger events | No rigid timeline, suggest annually |
| Who performs | Internal team (usually Money Laundering Reporting Officer (MLRO)/Compliance Officer (CO) + business heads) with possible external input | Independent function (internal audit or external qualified firm) with no operational role (CO & MLRO should not audit themselves) |
| Output | Risk register, residual risk rating, mitigation strategy | Audit report with findings, recommendations & management action plan |
Are they equivalent?
The IRA and IA are not equivalent and cannot substitute for one another. The IRA focuses on identifying and understanding risks before controls are applied, while the IA evaluates whether the controls and systems in place are working effectively. The former is about risk understanding, while the latter is about control effectiveness.
How they complement each other?
Despite their differences, the IRA and IA are highly complementary. The IRA provides the foundational risk understanding that the IA uses to assess whether controls are appropriate and effective. Conversely, findings from the IA—especially material control failures—should trigger an update to the IRA, as they represent important new information about the TCSP licensee’s risk exposure. This creates a continuous improvement loop: risks inform controls, and audit findings refine risk assessments.
Key Compliance Takeways
- Do not treat IRA as a one-off document – update the IRA every 2 years and upon trigger events.
- Ensure the IA function is independent, well-resourced, and has direct access to senior management.
- Ensure the audit scope includes a review of the IRA’s reasonableness and timeliness.
- Keep evidence – both IRA and IA reports ready for regulator’s inspection.
- Document trigger events clearly (e.g., new corporate service, new jurisdiction, and new customer type).
By understanding the distinct roles of IRA and IA—and how they reinforce each other—TCSP licensees can build a more resilient, risk-based, and fully compliant AML/CFT framework.
This article is based on general guidance materials and is for informational purposes only.