{
  "body_html": "<h2>Risk Assessment</h2>\n<p>Complete a <strong>risk assessment</strong> at least once per year. Also complete one within <strong>30 days</strong> if any of these occur: an ownership change of 25% or more, a significant shift in your customer base, or a <strong>Geographic Targeting Order (GTO)</strong> affecting Advanced Compliance Technology, Inc.'s area.</p>\n<p>Follow these five steps for every assessment:</p>\n<ol>\n<li><strong>Define scope.</strong> List all products, services, customer types, locations, and delivery channels.</li>\n<li><strong>Assess inherent risk.</strong> Rate each area before considering controls. Use transaction volume data, customer risk indicators, and location exposure.</li>\n<li><strong>Evaluate controls.</strong> Review existing policies, procedures, and automated controls. Determine whether each one adequately addresses the identified risk.</li>\n<li><strong>Calculate residual risk.</strong> Identify risk that remains after controls. Flag any area where residual risk is too high.</li>\n<li><strong>Document and recommend.</strong> Record findings, data sources, and proposed changes. Submit to the owner/principal for approval.</li>\n</ol>\n<p>Rate five <strong>risk dimensions</strong> — each gets an inherent risk rating and a residual risk rating:</p>\n<ul>\n<li><strong>Products and services:</strong> Advanced Compliance Technology, Inc. provides check cashing, money transmission, payment instrument sales, foreign currency exchange. Check cashing carries elevated placement-stage risk.</li>\n<li><strong>Customers:</strong> Your customer base is walk-in retail with no account relationship. Flag customers with no fixed address, frequent large transactions near the CTR threshold, or third-party check presenters.</li>\n<li><strong>Geography:</strong> Advanced Compliance Technology, Inc. operates in a HIDTA and HIFCA zone. A new or modified GTO automatically triggers a new assessment.</li>\n<li><strong>Transaction volume:</strong> Review volume trends each quarter. A sustained shift of 20% or more triggers an out-of-cycle assessment.</li>\n<li><strong>Regulatory environment:</strong> Review regulatory changes at each assessment cycle.</li>\n</ul>\n<p>Map each dimension to its controls. Controls include CIP, OFAC screening, monitoring thresholds, SAR/CTR filing, EDD protocols, and staff training. Rate each control as <strong>strong</strong>, <strong>adequate</strong>, or <strong>needs improvement</strong>. Any dimension rated <strong>residual-high</strong> requires a documented remediation plan with a target completion date.</p>\n<p>Before launching any new product, service, channel, or location, complete a <strong>pre-launch risk assessment</strong> using the same five steps.</p>\n<p>Review all <strong>monitoring thresholds</strong> at each annual assessment. Document and approve all threshold changes before they take effect. Test key controls at least once per year.</p>\n<p>Document each completed assessment in a written report. Present the report to the owner/principal for approval before updating the program. Retain completed assessments for a minimum of <strong>five years</strong>.</p>",
  "narration_text": "Complete a risk assessment at least once per year. Also complete one within 30 days if any of these occur: an ownership change of 25% or more, a significant shift in your customer base, or a Geographic Targeting Order (GTO) affecting Advanced Compliance Technology, Inc.'s area.\r\n\r\nFollow these five steps for every assessment:\r\n\r\nDefine scope. List all products, services, customer types, locations, and delivery channels.\r\nAssess inherent risk. Rate each area before considering controls. Use transaction volume data, customer risk indicators, and location exposure.\r\nEvaluate controls. Review existing policies, procedures, and automated controls. Determine whether each one adequately addresses the identified risk.\r\nCalculate residual risk. Identify risk that remains after controls. Flag any area where residual risk is too high.\r\nDocument and recommend. Record findings, data sources, and proposed changes. Submit to the owner/principal for approval.\r\n\r\nRate five risk dimensions — each gets an inherent risk rating and a residual risk rating:\r\n\r\nProducts and services: Advanced Compliance Technology, Inc. provides check cashing, money transmission, payment instrument sales, foreign currency exchange. Check cashing carries elevated placement-stage risk.\r\nCustomers: Your customer base is walk-in retail with no account relationship. Flag customers with no fixed address, frequent large transactions near the CTR threshold, or third-party check presenters.\r\nGeography: Advanced Compliance Technology, Inc. operates in a HIDTA and HIFCA zone. A new or modified GTO automatically triggers a new assessment.\r\nTransaction volume: Review volume trends each quarter. A sustained shift of 20% or more triggers an out-of-cycle assessment.\r\nRegulatory environment: Review regulatory changes at each assessment cycle.\r\n\r\nMap each dimension to its controls. Controls include CIP, OFAC screening, monitoring thresholds, SAR/CTR filing, EDD protocols, and staff training. Rate each control as strong, adequate, or needs improvement. Any dimension rated residual-high requires a documented remediation plan with a target completion date.\r\n\r\nBefore launching any new product, service, channel, or location, complete a pre-launch risk assessment using the same five steps.\r\n\r\nReview all monitoring thresholds at each annual assessment. Document and approve all threshold changes before they take effect. Test key controls at least once per year.\r\n\r\nDocument each completed assessment in a written report. Present the report to the owner/principal for approval before updating the program. Retain completed assessments for a minimum of five years."
}