No documented firm-wide assessment
Risk is discussed, but the rationale, evidence and firm-wide conclusion are not recorded in one defensible assessment.
Enterprise-wide financial crime risk assessment
Your enterprise-wide risk assessment. Out of spreadsheets, ready for the regulator.
Replace Excel-based EWRAs with structured questionnaires, control scoring, residual risk and regulator-ready reports in one governed process.
Enterprise-wide Risk AssessmentFY 2026 assessmentOVERALL RESIDUAL RISKModerate
In reviewCustomer riskHigh
Product riskModerate
Geographic riskModerate
Channel riskLow
Where assessments break down
Do you make these common mistakes in your risk assessment?
Out-of-date methodology
The framework no longer reflects the business, current financial crime threats or the way risk is actually managed.
No audit trail of reviews and sign-off
Comments, challenges and approvals sit across inboxes and files, leaving no reliable record of who decided what, and when.
Two regulated sectors
UK supervisors are asking harder questions about firm-wide risk.
A documented assessment is not enough on its own. It must reflect the firm, address the relevant risk factors and show how the conclusion was reached.
FCA-regulated firms
The FCA has published good and poor practice from reviews focused on business-wide and customer risk assessments. In a separate 2025 survey, 11% of responding corporate finance firms reported having no documented business-wide risk assessment.
Read the FCA survey findingsTry the financial services demo
No sign-up needed. Sample data only.
SRA-regulated firms
The SRA says a significant proportion of firm-wide risk assessments still fall short of its expectations. Its published supervisory record includes compliance plans, referrals for investigation and fines where no compliant assessment was in place.
AML supervision is moving to the FCA. The Government has decided that the FCA will take over AML/CTF supervision of legal-sector firms. Legislation and the transition timetable are still pending, and the SRA remains responsible until the transfer is complete. The firm-wide risk assessment obligation continues throughout.
Read about the transfer of AML supervision See the SRA supervisory findingsTry the legal practice demo
No sign-up needed. Sample data only.
One product, two dedicated configurations.
EWRA supports financial services and legal practices with sector-specific questions, risk factors and reporting informed by the relevant regulatory guidance. Your firm remains responsible for its own risk-based judgement and regulatory obligations.
A controlled assessment lifecycle
From inherent risk to signed-off report.
Rotunda gives each stage of the EWRA a clear owner, method and record. The result is easier to maintain, explain and challenge.
01 / Map the risk
Five domains, one firm-wide view
Assess customers, products, geography, channels and emerging risks through structured, evidence-backed questionnaires.
- Consistent questions and scoring criteria
- Evidence and rationale captured at source
- Separate sanctions risk assessment module
CCustomers12 factors
PProducts8 factors
GGeography14 factors
ChChannels6 factors
EEmerging risks5 factors
02 / Assess the controls
Make residual risk traceable
Score control design and operating effectiveness against inherent risk. Rotunda applies a consistent calculation and keeps the inputs visible.
- Control effectiveness scoring
- Transparent residual risk calculation
- Clear record of overrides and rationale
INHERENT RISKHigh
−CONTROL EFFECTIVENESSAdequate
=RESIDUAL RISKModerate
03 / Govern the outcome
Review, challenge and report
Move the assessment through defined review and challenge, compare the result year on year, then produce a clear record for senior management and regulators.
- Review and challenge workflow
- Year-on-year comparison and audit trail
- PDF and CSV regulator-ready reports
- ✓Domain owner reviewCompleted 12 Jun
- ✓Second-line challengeCompleted 18 Jun
- 3MLRO approvalIn progress
- 4Board sign-offPending
A proportionate investment
Know the cost of the alternative.
An EWRA should stand up to scrutiny without consuming months of specialist time. Compare the implementation cost, operational drag and potential exposure.
The consultant figure reflects our practitioner experience. Regulatory fines can be unlimited. The Rotunda price is the founding-customer rate for the first 12-month term.
ApproachIndicative cost
External projectConsultant-built EWRA£600k
Potential exposureRegulatory finesUnlimited
Annual ReviewRotunda EWRA£1,500 + VAT
A better way to run your EWRA
Make your next assessment easier to defend.
See how Rotunda turns a fragmented exercise into a controlled, repeatable process.
Book a demo