We all remember Shrek's iconic speech: "Ogres are like Onions... Layers! Onions have layers..." 

He wasn't just talking about vegetable structures; he was giving us a valuable lesson in complexity. 

Just like ogres, and onions, AML compliance isn't a simple, surface-level issue. It's layered, nuanced, and requires peeling back those layers to truly understand the core risks and obligations.

🗣 “You know, not everybody likes onions..." Donkey to Shrek

💡 Not everyone likes anti-money laundering Firm Wide Risk Assessments (FWRA) either, but they are vital to an AML programme and to legal and regulatory compliance. 

Governance: The Core of AML Compliance

At the heart of AML compliance is strong governance. 

This includes appointing a Money Laundering Reporting Officer (MLRO) and ensuring senior management takes ownership of compliance efforts. 

Without leadership buy-in, the entire AML structure weakens.

✅ Key Requirement: Regulation 21 of the Money Laundering Regulations 2017 (MLR 2017) mandates that firms establish internal controls and appoint an MLRO where necessary.

Firm-Wide Risk Assessment (FWRA): Understanding Your Exposure

Under Regulation 18(1) of the Money Laundering Regulations 2017 (as amended), a relevant person (such as a firm) must take appropriate steps to identify and assess the risk of money laundering and terrorist financing to which its business is subject. To carry out a Firm Wide Risk Assessment, a firm must take into account:

(a) information made available to them by the supervisory authority under regulations 17(9) and 47 

(b) risk factors including the factors relating to: 

And Just as Shrek and Donkey adapt to changing risks at the Swamp and Castle, firms need a robust and adaptable Firm-Wide Risk Assessment (FWRA). 

This proactive approach allows them to identify, evaluate, and manage diverse risks, ensuring resilience in the face of evolving Anti-Money Laundering conditions.

✅ Key Requirement: Regulation 18 of the MLR 2017 requires firms to conduct a written risk assessment to identify, assess the risk of money laundering and terrorist financing to which their business is subject.

🗣 "Donkeys don’t have layers. We wear our fear right out there on our sleeves." – Donkey

💡 Donkey openly expresses his risk appetite, a critical concept in anti-money laundering (AML) frameworks. 

Shrek, has a high risk tolerance in relation to this quest. 

Donkey, however, demonstrates a low risk appetite, openly displaying his fear and reluctance to cross the bridge over molten lava.

Regulated firms' likewise must identify, and assess risk and consider their risk appetite—determining the level of AML risk they are willing to accept.

From an AML perspective, crossing the bridge represents engaging with higher-risk jurisdictions, clients, or transactions. 

Donkey’s hesitation reflects the cautious stance taken by firms with low risk tolerance, which may:

• Avoid high-risk jurisdictions with weak AML controls.

• Some may decline business relationships with clients with opaque financial backgrounds.

• Reject transactions that fail to pass their "smell test."

Conversely, firms with a higher risk appetite—akin to Shrek’s approach—may be more willing to engage in riskier ventures but must implement stronger mitigation measures such as enhanced due diligence, transaction monitoring, and adverse media screening.

By applying AML principles, Donkey’s reluctance serves as a reminder that understanding and defining risk appetite is essential—whether crossing rickety wooden bridges over molten lava or navigating complex financial crime risks.

Shrek employs risk mitigation, guiding Donkey across the bridge by breaking the journey into smaller, controlled steps. In AML terms, this reflects the application of risk-based controls, such as:

• Enhanced Due Diligence (EDD) when engaging in high-risk scenarios.

• Ongoing monitoring of suspicious activity.

• Mitigating transactional risk through layered defences.

Client Matter Risk Assessments: Case-by-Case Scrutiny

Every client and matter is different—so your AML approach must be flexible. 

A Client Matter Risk Assessment (CMRA) ensures that you’re evaluating risks at an individual and matter level.

✅ Key Requirement: Regulation 28 states that firms must assess the risk of money laundering for each business relationship.

Client Due Diligence (CDD): Knowing Who You’re Dealing With

A solid AML defence starts with knowing your clients. CDD involves verifying a client’s identity, source of funds, source of wealth and business activities to prevent criminals from exploiting regulated services.

✅ Key Requirement: Regulation 27 requires firms to conduct CDD before establishing a business relationship or carrying out a transaction.

🗣 "Sometimes things are more than they appear" - Shrek

💡 This stresses the importance of  considering risk identification, assessment, mitigation and risk appetite, and not just blanket excluding potential clients because they are a Politically Exposed Person, or they have a link to a high risk country without any other red flags or risk indicators or without proper consideration of risks and mitigation and risk appetite. 

Ongoing Due Diligence (ODD): Keeping an Eye on Clients

AML compliance isn’t a one-and-done task. Just like onions (and ogres), risk levels change over time. Ongoing Due Diligence ensures the firm is kept up-to-date with any changes to their client's risk profile or the matter risk profile, throughout the business relationship.

✅ Key Requirement: Regulation 28(11) requires firms to conduct ongoing monitoring of transactions and client relationships.

💡 Shrek and Donkey are consistently reassessing the risk factors throughout the life cycle of the quest. 

Shrek and Donkey's ongoing risk reassessment throughout their quest mirrors the need for firms to dynamically update their AML/CTF risk assessments. 

Specific triggers for reassessment include: government guidance and legal changes, FATF list updates, industry-specific risk shifts, internal firm changes affecting AML risk, and material changes in client, counterparty, and third-party profiles, including beneficial ownership and changes to the matter risk profile. These reassessments are crucial for adapting risk mitigation strategies and that the client and their matter are within the firm's risk appetite.

Enhanced Due Diligence (EDD): Handling High-Risk Clients

Some clients and transactions demand extra scrutiny—like politically exposed persons, high-risk jurisdictions, or unusually complex transactions. EDD adds deeper layers of verification and risk assessment.

✅ Key Requirement: Regulation 33 sets out specific situations where EDD is required, such as dealing with Politically Exposed Persons or High-Risk Third Countries.

Ongoing Enhanced Due Diligence (OEDD): Extra Vigilance for High-Risk Cases

For high-risk clients or matters ongoing monitoring is a necessity. OEDD helps firm identify red flags, suspicious patterns, or changes in behaviour and use risk mitigation.

✅ Key Requirement: Regulation 33(1) requires continuous monitoring of high-risk clients and transactions.

Updating Client Matter Risk Assessments: Adapting to Change

Circumstances change, and so should your risk assessments. 

If a client’s behaviour or transaction pattern shifts, you must review and update their risk profile.

✅ Key Requirement: Firms must regularly update risk assessments based on new information or changes in the business relationship.

Remember how Shrek's swamp was relatively peaceful until Lord Farquaad's eviction order? 

Suddenly, the whole place changed.

That's just like how client risk can shift. 

You might think you know a client, like Shrek thought he knew his swamp, but then, BAM! Something happens. 

Maybe, they start requesting unusual or complex transactions, or requesting Rumpelstiltskin dodgy contracts terms. 

Or their behaviour changes, they start acting like they're hiding something, just like how the Fairy Godmother had an underlying hidden agenda. 

Client Matter Risk Assessments are not static documents. You can't just stick with the old assessment, like Shrek can't just pretend his swamp is still empty. 

Just like Shrek had to reassess his situation when the fairy tale creatures moved in, you've got to reassess your client when their behaviour or transaction patterns change.  

If you don't keep up with the changes, you're going to end up with a swamp full of trouble, or in AML terms, a client full of money laundering risks.

Internal AML Audits: Checking Your Defences

Even the best AML policies need regular testing. 

Internal AML audits help firms identify weaknesses, and improve processes. 

A firm that doesn’t audit its AML framework is flying blind.

✅ Key Requirement: Regulation 21(1)(c) requires firms to maintain an independent audit function where appropriate.

Final Thought: Build a Multi-Layered Defence

AML compliance isn’t about one single measure—it’s about layering multiple defences to create a strong, resilient framework. If one control fails, the others should still hold firm against financial crime risks.

Fairy tales