Article 4 Assessment and classification of the residual risk at entity level

Article 4 is the culminating step in a sequential risk assessment process, bringing together the outputs of Articles 2 and 3 to produce a final residual risk classification for credit and financial institutions.

While Articles 2 and 3 establish how to score inherent risk and controls quality respectively, this article explains how those two scores are combined into a single residual risk score, and how that score is then converted into one of four classifications: low, medium, substantial, or high.

The key mechanic is that good controls can reduce but never worsen an institution's residual risk — if controls quality is better than the inherent risk score, the residual risk simply equals the inherent risk; if controls quality is worse, the residual risk is the average of the two scores.

Important points:

• The residual risk score for credit and financial institutions is derived by combining the inherent risk score from Article 2 and the controls quality score from Article 3 using a specific two-rule formula.
• Strong AML/CFT controls can cap but not reduce the residual risk below the inherent risk score — meaning inherent risk always sets the floor.
• The final residual risk classification falls into one of four categories — low, medium, substantial, or high — determined by fixed numerical score thresholds.