The AML risk assessment is the foundation of your AML program. It shapes how closely you monitor, how deeply you test, how you staff, and which risks you can reasonably accept. Get that foundation wrong, and everything built on top of it is a very expensive sandcastle.

‍

The FFIEC BSA/AML Examination Manual calls the risk assessment "not a specific legal requirement," yet examiners review it during scoping and planning. Where a bank’s assessment is missing or inadequate, examiners must build their own. The Manual sets an expectation for banks to identify and analyze risk across their products, services, customers, and geographic locations, and to update the assessment as the business changes. It does not prescribe a method or format.

‍

So many institutions default to Excel. The spreadsheet is familiar, flexible, and seemingly inexpensive. In practice, it falls short on both counts that matter: (1) it gives a weaker picture of program health than the data allows, and (2) once you count the people needed to feed it, it’s expensive. Continuous, automated control testing can do better on both, providing a clearer view of risk, at a lower cost.

What the spreadsheet conceals

Spreadsheets aren't inherently the problem. The problem is that a spreadsheet assessment asks people to estimate shifting conditions from a limited set of observations, and every one of those observations is paid for in manual labor.

• Stale data. The data is a point-in-time extract, and control effectiveness rests on sample-based testing. At best, the result is a partial snapshot of program health, and a more current one means repeating the whole (often manual) exercise.
• Errors and false precision. Manual extracts, formulas, overrides, and undocumented judgments invite mistakes, and catching them means more manual review. But even flawless math can mislead. Risk ratings are rankings, not measurements. A "3" is riskier than a "2," but not necessarily 50 percent riskier. Average a few of them, carry the result to two decimals, and you get a number that looks like measurement but is really a tidy summary of opinions. Once that score exists, it becomes the conversation, and the judgments underneath it quietly go unexamined.
• It's disconnected from the program. The workbook rarely links to monitoring coverage, CDD refreshes, or testing, even though the assessment should inform those activities and they should inform it in return. Someone has to close that loop by hand.
• It doesn't scale. A bank overseeing many FinTech programs can end up with many workbooks, methodologies, rating scales, and reconciliations. Producing a portfolio-wide view becomes a project of its own, and the staffing needed grows with every program added.

Inefficiency is a real cost, but it's not the most dangerous one. That honor goes to false assurance: underestimating the risk while overestimating the controls meant to contain it, and too often learning about the gap from an examiner instead of from your own testing. Plenty of capable, well-intentioned compliance teams don't know what they don't know about their risk profile. And they're paying more than they need to for a picture that's less reliable than it looks.

Let the sunlight in

Justice Louis Brandeis wrote that “sunlight is said to be the best of disinfectants.” The same principle applies to risk assessment. For an AML program, sunlight means bringing the underlying evidence into the assessment: testing the full population continuously rather than sampling it periodically. It also shifts the work of gathering that evidence from people to systems, which is where the cost savings begin.

‍

That is the premise behind Cable, Synctera’s automated compliance testing platform. Instead of rating controls primarily through judgment and periodic samples, Cable tests them continuously against 100% of the account and transaction data it receives, each time new data arrives. Each control is mapped to the regulatory requirement it supports, and each test produces an effectiveness score tied to the specific accounts and transactions that passed or failed. Those results then feed the risk assessment, so control ratings reflect tested evidence instead of estimates. Because the same tests can run across every FinTech program, results can roll up to an enterprise view. Control effectiveness becomes a measured result rather than an assertion, without adding analysts for every new program.

‍

Getting there does not require rebuilding a bank's compliance stack. Cable connects to existing data through an API, SFTP, or a data warehouse such as Snowflake or BigQuery, and tests the controls a bank and its FinTech partners already run, from KYC and CIP through transaction monitoring. Auditors can be given read-only access to the same results.

What changes when the data is live

• Sampling gives way to coverage. Automated tests can run across 100% of the accounts and transactions. A sample establishes only that no exception was found in the sample. Full-population testing establishes exactly how many exceptions exist and where they are. TD Bank shows what's at stake when no one measures coverage: 92% of its total transaction volume went unmonitored from 2018 to 2024, amounting to approximately $18.3 trillion of transaction activity, and the result included FinCEN’s $1.3 billion penalty, the largest FinCEN penalty against a depository institution in U.S. Treasury and FinCEN history. Testing every transaction manually would take a level of staffing that few institutions can justify. For a bank with multiple lines of business, the distinction is fundamental, and even more so for a bank with a BaaS line of business.
• Assertions become measurements. An "Effective" control rating in a spreadsheet is an assertion. A control tested against the population produces an exception rate tied to specific accounts and transactions, and the rating can change when the evidence changes. Regulators are drawing the same distinction. When the OCC escalated its action with a consent order against Blue Ridge Bank in 2024, it required the bank to submit supporting information showing that BSA/AML risks are effectively controlled for each existing third-party FinTech relationship and subpartner.
• Testing and risk assessment become one system. Instead of reconciling test results with the risk assessment once a year, teams can feed them directly into the assessment as they come. The connection between risk, testing, and resource allocation becomes visible and automated rather than rebuilt by hand each cycle.
• Results become reproducible. The same test logic can run against every program, every time. Results don't depend on which analyst reviewed the file or which version of the workbook survived.
• The audit trail is built in. When tests run against system data rather than pasted extracts, results trace to their sources. Test logic is documented, and prior versions are preserved rather than overwritten. Auditors can see the evidence without starting a new, labor-intensive evidence-gathering exercise each time.
• The portfolio becomes visible. For banks overseeing multiple programs, a common methodology can roll individual program assessments into a portfolio view: one methodology, one scale, one view of risk and control performance, with no reconciliation team required. That capability is increasingly what regulators expect. The Federal Reserve's 2024 order against Evolve Bank & Trust called for steps to quickly identify and report risk exposures related to its FinTech partners, programs, or services.

This is what sunlight changes: not the existence of risk, but the ability to see it, and the cost of looking.

Sunlight is also a bargain

Better evidence would be worth paying more for, but with Cable, better evidence actually costs less. The proper comparison is not software versus nothing. It is automated testing versus the people you would need in order to obtain comparable coverage manually.

‍

Start with salaries. In the Bureau of Labor Statistics' May 2025 wage estimates, compliance officers earned a mean annual wage of $88,400, a figure that almost certainly understates the cost of people this work actually requires. Experienced BSA testers, QA reviewers, and FinTech-oversight specialists tend to sit toward the upper end of the salary range, and salary is only part of what each hire costs once benefits and overhead are added. 

‍

The economic gap becomes more pronounced as the portfolio grows. Headcount scales with the number of programs and transactions requiring review, while automated testing scales largely with the data.

There are other savings as well:

• Lower recruiting and turnover costs, which consume both money and institutional knowledge.
• Cheaper remediation, because continuous detection can find failures earlier.
• Less labor for audits, exams, and FinTech partner reviews, because the evidence is already assembled.

The better foundation

The spreadsheet risk assessment isn't failing because compliance professionals are careless. It is failing because the problem has changed. An institution should not have to estimate, once a year and from a sample, the effectiveness of controls that can be measured continuously across the population, and it should not have to pay a premium in headcount for the less reliable answer.

‍

Live, full-population testing changes both the quality and the economics of the assessment. Control effectiveness becomes evidence rather than assertion. Testing informs the risk assessment, and the risk assessment informs testing. Your compliance team still owns the methodology and the judgment calls. The system applies them consistently, at a cost that grows with the data rather than the headcount.

‍

The result is not simply a better spreadsheet. It is a different kind of risk assessment: one in which the evidence is visible, current, reproducible, and connected to the decisions it is meant to inform, and one that costs less to maintain than the process it replaces.

‍

Sunlight is the best disinfectant. Applied through automation, it is also the cheaper one.

Want to see what full-population testing would show for your FinTech programs? Talk to our team about running Cable against your own data.

‍‍

This article is for informational purposes only and does not constitute legal, regulatory, or compliance advice. Cable is a Synctera company.