An effective AML/CFT risk assessment program evaluates the combination of risks an institution faces. The fundamental pillars or components that are combined to determine the overall risk profile are the types of customers (Client risk), the geographic locations where it operates or transacts (Country risk), and the services or instruments it offers (Product risk). By analyzing these three core areas together, a financial institution can develop a comprehensive understanding of its inherent money laundering and terrorist financing vulnerabilities and apply commensurate controls.

B. Policy risk is a component of the control environment that mitigates inherent risk, not a primary component of inherent combination risk itself.

C. Institution risk and government risk are too broad; the standard model breaks these down into more specific, measurable components like client, country, and product.

D. Institution risk is not a standard primary category in this combination model; it is the entity being assessed based on the other risk factors.

1. ACAMS. (2023). Certified Anti-Money Laundering Specialist - Risk Management (CAMS-RM) Study Guide. Chapter 2: Risk Assessment. The guide details the methodology for conducting an enterprise-wide AML risk assessment, identifying the core components as customers, geography, and products/services.

2. Financial Action Task Force (FATF). (2013). Guidance for a Risk-Based Approach: The Banking Sector. p. 12, para. 29. This guidance outlines that risk assessments should consider risk factors including customers, countries or geographic areas, and products, services, transactions or delivery channels.