Risk is a function of three factors:
A threat is a person or group of people, object, or activity with the potential to cause harm (to the state, to society, or to the economy).
Vulnerabilities are the legal, technical, cultural, political, geographical, and other features that can be exploited by threats or that may support or facilitate criminal activities. (i.e. outdated or ill-designed regulation on beneficial ownership).
Consequence refers to the impact or harm that money laundering, terrorist financing, or proliferation financing may cause, and it includes the effect of the underlying criminal or terrorist activity on financial systems and institutions as well as on the economy and society more generally. (Legal consequences, financial losses, reputational damage, hampering growth, operational impact).
Ideally, a risk assessment, involves making judgments about threats, vulnerabilities and consequences. The ML/TF risk assessment is product of a methodology, that attempts to identify, analyze and understand ML/TF risks and serves as a first step in addressing them.
