Skip to content This library is free, offered as dana. If it helps your work, donate here →
penguin tree ai
← back to libraryDonate here

This is one of 3,622 free prompts in the penguin tree ai library. Sign up once and the whole library opens, with new prompts by email.

open the library →

Compliance risk assessment generator

Generates a structured compliance risk assessment for a new product, process, or regulatory change — scoring inherent risk across BSA/AML and consumer protection dimensions, mapping applicable regulations, evaluating…

download .md

Purpose

Produce a defensible, regulator-ready compliance risk assessment that scores inherent risk, evaluates control effectiveness, calculates residual risk, and delivers a ranked remediation plan — so compliance teams can approve, condition, or block new products and changes with documented rationale instead of ad hoc judgment.

When to Use

Invoke this skill when the user asks to:

  • Assess the compliance risk of a new product, feature, or account type
  • Evaluate a process change or new operational workflow for regulatory exposure
  • Analyze the impact of a new or amended regulation on the business
  • Vet a new vendor, partner bank, or third-party integration for compliance risk
  • Build a documented risk assessment for an internal committee, board, or examiner
  • Refresh an existing risk assessment after a control or product change

Inputs Required

Before starting, collect:

  • Subject of assessment: The specific product, process, regulatory change, or vendor being evaluated, described in 2–4 sentences
  • Business model context: What the firm does, customer base (consumer / SMB / enterprise), and how money moves
  • Primary risk lens: BSA/AML, consumer protection, or both (default: both)
  • Customer and geographic scope: Customer types served, states/countries, and any high-risk segments (e.g., MSBs, crypto, cross-border)
  • Existing controls: Current policies, monitoring systems, KYC/CDD procedures, and second-line oversight relevant to the subject
  • Risk appetite / thresholds: Any board-approved risk tolerance statements or scoring conventions the firm already uses
  • Regulatory posture: Whether the firm is bank-chartered, a partner-bank fintech, a licensed MSB/MTL holder, or a registered entity

If risk appetite or scoring conventions are missing, default to a 1–5 scale (Low/Low-Moderate/Moderate/Moderate-High/High) and note the assumption.

Instructions

Step 1: Scope and Classify the Subject

Define exactly what is in and out of scope. Classify the subject as one of: New Product/Feature, Process Change, Regulatory Change, or Third-Party/Vendor. State the trigger for the assessment and the decision it must support (launch approval, go/no-go, control uplift, examiner documentation). List explicit exclusions to prevent scope creep.

Step 2: Map Applicable Regulatory Obligations

Identify the specific regulations, rules, and guidance that apply. Organize by lens:

BSA/AML obligations — where relevant, address:

  • Customer Identification Program (CIP) and Customer Due Diligence / Beneficial Ownership (31 CFR 1010.220 / 1020.220)
  • Suspicious Activity Reporting (SAR) and Currency Transaction Reporting (CTR) triggers
  • OFAC sanctions screening obligations
  • FinCEN Travel Rule and recordkeeping requirements
  • Enhanced Due Diligence for high-risk customers

Consumer protection obligations — where relevant, address:

  • UDAAP (Dodd-Frank §1031/1036) — unfair, deceptive, or abusive acts or practices
  • Reg E (EFTA) — error resolution, disclosures, unauthorized transfers
  • Reg Z (TILA), Reg B (ECOA/fair lending), Reg DD, and Reg CC as applicable
  • FCRA / FDCPA where credit or collections are involved
  • GLBA privacy and safeguards requirements

For each obligation, state the specific requirement triggered and why the subject implicates it.

Step 3: Score Inherent Risk

Assess risk before controls, across each applicable risk factor. For each factor assign a score (1–5) and one-sentence rationale:

  • Customer risk: Customer types, high-risk segments, PEP exposure
  • Product/service risk: Anonymity, speed, cross-border movement, cash-equivalence
  • Geographic risk: Jurisdictions served, sanctioned or high-risk regions
  • Channel/delivery risk: Onboarding method, non-face-to-face, agent/partner channels
  • Transaction risk: Volume, velocity, value, and money-movement rails
  • Consumer harm risk: Potential for deception, fee opacity, discriminatory impact, error frequency

Compute an inherent risk rating as the weighted or averaged composite, and state it explicitly (e.g., "Inherent Risk: Moderate-High / 4").

Step 4: Evaluate Control Effectiveness

For each material risk factor, document the existing control(s) and rate design + operating effectiveness as Effective / Partially Effective / Ineffective / Absent. Assess:

  • Preventive controls (system rules, hard blocks, onboarding gates)
  • Detective controls (transaction monitoring, screening, reconciliation)
  • Corrective controls (SAR filing, error resolution, remediation workflows)
  • Governance controls (policies, training, second-line testing, board reporting)

Flag any control that is manual where automation is expected, or absent where the regulation requires it.

Step 5: Calculate Residual Risk

Combine inherent risk with control effectiveness to derive residual risk per factor and overall. State the residual rating and whether it falls inside or outside the firm's stated (or default) risk appetite. Where residual risk exceeds appetite, mark it as a gap requiring remediation before approval.

Step 6: Build the Ranked Remediation Plan

List remediation actions ranked by risk reduction, not effort. For each action specify:

  1. The gap it closes and the residual risk it lowers
  2. Control type (preventive/detective/corrective/governance)
  3. Owner (first line / second line / vendor)
  4. Priority: Blocker (must fix before launch) / High (30 days) / Medium (90 days) / Monitor
  5. Target residual rating after implementation

Step 7: Define Ongoing Monitoring and Reassessment

Specify the metrics and cadence to keep the risk assessment current:

  • Key risk indicators (KRIs) with thresholds (e.g., alert-to-SAR conversion rate, false-positive rate, complaint volume, chargeback ratio)
  • Monitoring cadence (real-time / daily / monthly / quarterly)
  • Reassessment triggers (volume growth, new geography, control failure, regulatory change)
  • Escalation path and reporting destination (committee, CCO, board)

Step 8: Render the Approval Decision

Deliver a clear recommendation: Approve, Approve with Conditions (list conditions), or Do Not Proceed (state the disqualifying risks). Do not hedge — tie the decision to the residual rating and risk appetite.

Output Format

  • Structure: Structured risk-assessment document with numbered sections and scoring tables
  • Length: 1,100–1,500 words
  • Format: Structured document — prose framing with tables for inherent scoring, control evaluation, residual risk, and the remediation plan
  • Sections: Scope & Classification → Applicable Regulations → Inherent Risk Scoring → Control Effectiveness → Residual Risk → Ranked Remediation Plan → Monitoring & Reassessment → Approval Decision
  • Tone: Second-line compliance officer — precise, evidence-based, examiner-aware; states conclusions and cites the specific rule triggered

Quality Checklist

Before delivering output, verify:

  • [ ] Every risk factor has both an inherent score (1–5) and a residual score after controls
  • [ ] Each cited obligation names the specific regulation or rule (e.g., "Reg E," "31 CFR 1020.220") — not "AML rules" generically
  • [ ] Control evaluation rates every material control as Effective / Partially Effective / Ineffective / Absent
  • [ ] Residual risk is explicitly compared to the firm's stated or default risk appetite
  • [ ] Every remediation action has an owner, priority tier, and target residual rating
  • [ ] A single approval decision is rendered (Approve / Approve with Conditions / Do Not Proceed) — no hedging

Notes

  • Inherent risk is scored before controls and residual after — conflating the two is the most common error and the fastest way to lose examiner credibility.
  • When the primary lens is "both," run BSA/AML and consumer protection as parallel tracks through scoring rather than blending them into one number — a product can be low AML risk and high UDAAP risk simultaneously.
  • Partner-bank fintechs should treat the sponsor bank's expectations as a binding constraint; flag any residual risk that would breach the bank's oversight requirements as a Blocker regardless of internal appetite.
  • Keep a version stamp and reassessment trigger list on every assessment — a risk assessment with no refresh trigger is a stale document at the next exam.

How to use this skill

This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.

Installing in Claude Code:

  • ~/.claude/skills/<folder-name>/SKILL.md — auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)
  • <your-project>/.claude/skills/<folder-name>/SKILL.md — auto-loads only when working in that project (recommended for project-specific skills)

Restart Claude Code or open a new session to register.

Using in Claude.ai, ChatGPT, Gemini, or other AI tools:

  1. Drag this file into a new chat, or copy and paste its contents
  2. Send your task or request as your next message — the AI will apply the skill where it fits

For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills