The National Bank of Belgium (NBB) updated its sectoral assessment of money laundering and terrorist financing (ML/TF) risks in October 2023, covering 19 financial activities and assessing terrorist financing separately for the first time.
For Compliance functions, the assessment provides an important supervisory reference point for understanding the ML/TF risks associated with different activities and business models.
The scores presented in this article are the NBB’s own sectoral scores. They do not replace an institution’s own ML/TF risk assessment. The actual risk profile depends on the institution’s specific business model, customers, products, geographical exposure and controls, as well as on its ability to justify its own risk assessment and scoring to the NBB.
The key question is therefore not simply where an activity ranks in the NBB’s assessment, but how relevant those findings are to the institution’s own risk profile.
How does the NBB assesses ML/TF risk?
The NBB’s assessment considers three main elements: inherent risk, vulnerabilities and residual risk.
Inherent risk reflects the exposure associated with the characteristics of a particular activity before mitigating measures are taken into account. The NBB then considers the vulnerabilities identified within the activity and the measures available to mitigate them before determining the residual risk.
The 2023 assessment covers 19 activities across payment and electronic money institutions, credit institutions, stockbroking firms, life insurance companies and central securities depositories.
The assessment draws on the NBB’s supervisory experience and on information from a range of sources, including supervisory work and relevant national and international risk assessments. The NBB also notes that the availability of precise aggregate data may be limited and that professional judgement is therefore an important part of the assessment.
The main risk profiles by activity
Payment and money remittance activities
Payment activities and money remittance stand out among the activities with the highest residual money laundering risks identified by the NBB.
Activity | ML risk | TF risk |
|---|---|---|
Payment activities | 4/5 | 4/5 |
Money remittance | 4.5/5 | 4/5 |
Electronic money | 2.5/5 | 3/5 |
Acquiring activities | 2/5 | 1.5/5 |
Payment initation services | 2/5 | 1.5/5 |
Account information services | 0/5 | 0/5 |
The high score attributed to money remittance reflects characteristics that can increase exposure to ML/TF, including the speed and volume of transactions, cross border activity and the possibility of transactions involving higher risk customers or jurisdictions.
The assessment also shows that payment activities cannot be treated as one homogeneous risk category. Different payment services can present significantly different risk profiles depending on the nature of the service, the customers using it, the geographical scope and the level of control exercised over the transactions.
For Compliance functions, this makes the distinction between different payment services particularly important when assessing the institution’s exposure.
Banking Activities
The NBB identifies significant differences between the various banking activities.
Banking activity | ML risk | TF risk |
|---|---|---|
Private banking | 4/5 | 1.5/5 |
Retail banking | 2.5/5 | 4/5 |
Corporate banking | 2.5/5 | 2/5 |
Trade finance | 3/5 | 2/5 |
Correspondent banking | 3.5/5 | 3.5/5 |
Manual foreign exchange | 3.5 | 3.5/5 |
Private banking receives a relatively high ML score. The NBB associates this type of activity with characteristics such as higher value transactions, complex structures and customer profiles that can increase exposure to money laundering.
Retail banking presents a different profile. Its ML score is lower at 2.5/5, while its TF score reaches 4/5. This illustrates an important point in the NBB’s assessment: the characteristics that increase exposure to money laundering are not necessarily the same as those that increase exposure to terrorist financing.
Correspondent banking receives a relatively high score for both ML and TF. Its cross border nature and the involvement of several financial institutions can create additional complexity when assessing customers, transactions and jurisdictions.
The NBB’s scores therefore illustrate differences in the nature of the risks, rather than simply providing a ranking from low risk to high risk.
Investment Advice and Life Insurance
The assessment also identifies differences between investment advice and life insurance activities.
Activity | ML risk | TF risk |
|---|---|---|
Investment advice within private banking | 4/5 | 2/5 |
Investment advice without holding funds | 2/5 | 2/5 |
Traditional life insurance | 1.5/5 | 1.5/5 |
Investment life insurance products | 2.5/5 | 1.5/5 |
Investment advice provided within a private banking context receives a higher ML score than investment advice where the institution does not hold funds. This difference reflects the characteristics and level of exposure associated with the underlying business model.
Life insurance presents comparatively lower residual risks in the NBB assessment, although investment life insurance products receive a higher ML score than traditional life insurance.
What changed between the 2020 and 2023 assessments ?
The 2023 assessment introduced three particularly relevant developments.
First, the scope increased from 13 to 19 activities, allowing the NBB to distinguish more precisely between different financial services and business models.
Second, terrorist financing was assessed separately for the first time. This is important because ML and TF do not necessarily present the same risk drivers. The different scores attributed to activities such as retail banking, private banking and payment services illustrate this distinction.
Third, the assessment places greater attention on digitalisation, new products and evolving business models. Developments such as digital financial services and virtual IBANs are considered in the context of the changing ML/TF risk environment.
These developments make the 2023 assessment more granular and more closely aligned with changes in the financial sector.
Digitalisation and new business models
Digitalisation is an important theme throughout the 2023 assessment.
Digital onboarding, remote customer relationships, new payment solutions and technology driven distribution models can change the way AML/CFT risks arise. They can affect customer identification, transaction visibility, geographical exposure and the involvement of third parties.
The NBB specifically considers virtual IBANs as a development relevant to the risk assessment. Depending on how they are structured and used, virtual IBAN arrangements can create additional challenges concerning transparency, identification of the underlying customer and understanding the economic purpose of transactions.
The 2023 assessment should nevertheless be understood in its own timeframe. It describes the risks identified by the NBB at the time of its assessment. Regulatory requirements and supervisory expectations relating to digital financial services and virtual assets have continued to evolve since then.
The practical lesson is therefore not that digital products are automatically high risk. Rather, changes in technology, products or distribution models should be considered when assessing whether the institution’s ML/TF exposure has changed.
Brexit and the chanching financial landscape
Brexit is another development considered by the NBB in its 2023 assessment.
The United Kingdom’s withdrawal from the European Union changed the way certain financial services are provided across borders and contributed to changes in the Belgian financial landscape, particularly in payment and electronic money activities.
For Compliance functions, the relevance of Brexit lies primarily in the resulting changes to cross border structures, customer flows, outsourcing arrangements and operational models.
Where an institution relies on entities, service providers or group structures located in other jurisdictions, particular attention should be paid to the allocation of AML/CFT responsibilities and the effectiveness of oversight.
What are the risk factors specific to the Belgian context?
The NBB’s assessment also considers several risk factors that are particularly relevant to the Belgian financial environment.
The concentration of PEPs in Belgium
The NBB specifically addresses the concentration of politically exposed persons, or PEPs, as a relevant risk factor.
The presence of a PEP does not automatically mean that a customer presents an unacceptable risk. It does, however, require the institution to apply the enhanced due diligence measures required under the AML/CFT framework and to assess the relationship according to its specific circumstances.
For Compliance functions, effective PEP identification and verification therefore remain important, particularly where customer relationships involve complex ownership structures, significant assets or international exposure.
The port of Antwerp and organised crime
The NBB also identifies crime and money laundering risks linked to activities connected with the Port of Antwerp.
The port’s importance in international trade and its exposure to organised criminal activity create a relevant contextual risk for the Belgian financial sector.
Institutions with customers or activities connected to sectors particularly exposed to organised crime should therefore consider whether these external risks are appropriately reflected in customer risk assessments and transaction monitoring.
The UBO register improves transparency, but does not eliminate the risk
The identification of ultimate beneficial owners remains a fundamental component of the AML/CFT framework.
The existence of a UBO register provides an important source of information, but it does not replace the institution’s own identification and verification obligations.
Where ownership structures are complex, international or inconsistent with the customer’s profile, the institution should be able to understand the ownership and control structure and investigate relevant discrepancies rather than relying mechanically on registry information.
Virtual assets and the evolving risk environment
Virtual assets were already considered in the NBB’s 2023 assessment as part of the evolving financial environment.
The assessment recognises that virtual assets can create specific ML/TF vulnerabilities, particularly because of their technological characteristics, cross border nature and potential challenges relating to the identification and tracing of transactions.
However, it is important to distinguish the NBB’s 2023 observations from developments that occurred afterwards. The regulatory framework applicable to crypto asset activities has continued to evolve at European and Belgian level since the NBB completed its assessment.
For an article focused on the 2023 assessment, these later developments should therefore be considered as subsequent context rather than presented as findings of the 2023 NBB assessment itself.
From a Compliance perspective, the key issue remains whether the institution’s exposure to virtual assets or related services is properly understood and reflected in its AML/CFT framework.
Does an increase in suspicious transaction reports automatically mean an increase in risk?
The number of suspicious transaction reports should also be interpreted carefully.
An increase in reporting can result from stronger detection capabilities, improved monitoring systems, greater employee awareness or changes in reporting practices. It does not automatically mean that the underlying ML/TF risk has increased by the same proportion.
The NBB’s observations therefore reinforce the importance of looking beyond quantitative indicators.
Transaction monitoring should consider customer behaviour, transaction patterns and relevant contextual information rather than relying primarily on predefined thresholds or isolated objective criteria.
The quality of the analysis supporting a suspicious transaction decision is therefore as important as the number of alerts or reports generated.
10 points to check: The compliance officer’s checklist
The NBB’s assessment can be translated into a number of practical actions for Compliance functions.
Conclusion
The NBB’s 2023 sectoral assessment provides Compliance functions with a valuable reference for understanding how ML/TF risks can differ significantly across financial activities and business models. The expansion to 19 activities, the separate assessment of terrorist financing and the greater attention given to digitalisation and new business models provide a more detailed picture of the risks facing the Belgian financial sector.
For institutions, however, the value of the assessment lies less in reproducing the NBB’s scores than in understanding the risk factors behind them and determining how they apply to the institution’s own activities, customers, products and controls. A well documented risk assessment should be able to explain why the institution’s own risk profile and scoring are appropriate, including where they differ from the sectoral assessment.
The relevant question is therefore not only:
“What score does the NBB assign to our activity?”
but rather:
“Can we demonstrate that our governance, risk assessment and AML/CFT controls remain appropriately aligned with the risks to which our institution is actually exposed?”
