How to Write a Dealer AML Risk Assessment

Every other part of a dealer's AML program rests on the risk assessment. The rule ties the internal controls to it, the compliance officer's update duty to it, and the scope and frequency of independent testing to it. A dealer that cannot show a written, current risk assessment has a program with nothing underneath it.

What the rule requires

Under 31 CFR 1027.210(b)(1), a dealer's program must incorporate policies, procedures, and internal controls "based upon the dealer's assessment of the money laundering and terrorist financing risks associated with its line(s) of business." The rule then says what the assessment must take into account, "including, but not limited to":

Products and parties. "The type(s) of products the dealer buys and sells, as well as the nature of the dealer's customers, suppliers, distribution channels, and geographic locations" (1027.210(b)(1)(i)(A)).
Unfamiliar counterparties. "The extent to which the dealer engages in transactions other than with established customers or sources of supply, or other dealers subject to this rule" (1027.210(b)(1)(i)(B)).
Payment routing. Whether payment or account reconciliation is routed to or from accounts in jurisdictions designated as state sponsors of terrorism, designated as non-cooperative by an intergovernmental group the United States belongs to and agrees with, or designated by Treasury under 31 U.S.C. 5318A as warranting special measures (1027.210(b)(1)(i)(C)).

The rest of the program is built to follow it. The compliance officer must keep the program "updated as necessary to reflect changes in the risk assessment" (1027.210(b)(2)(ii)). Independent testing must have a scope and frequency "commensurate with the risk assessment" (1027.210(b)(4)). When FinCEN adopted the rule in 2005, it said training should be shaped by "any factors the dealer has identified in its risk assessment" (interim final rule, June 9, 2005).

A retailer that is a dealer only because of its purchases from the public or from foreign sources needs a program, and so a risk assessment, that addresses only those purchases (1027.210(a)(2)). Our post on when a retail jeweler becomes a dealer covers that threshold.

What FinCEN said about how to do it

The rule gives no template, on purpose. In the 2005 preamble, FinCEN said the "reasonably designed" standard gives dealers "the flexibility to tailor their programs to their specific circumstances," and that dealers "must use the expertise that they possess about their industry, their particular business, and their particular customers and suppliers."

FinCEN's 2005 FAQs for dealers gave the one comparison that matters most. Business "with other U.S. dealers subject to the rule, and established customers or suppliers, presents a relatively low level of risk." Business with parties in, or payments routed through, jurisdictions "identified as particularly vulnerable to money laundering or terrorist financing" presents "a significantly higher risk, and therefore require[s] greater diligence." The FAQs also set the expectation: FinCEN "does not expect that this program can prevent all potential money laundering," but expects a dealer to take "prudent steps, with the same kind of thought and care that you take to guard against other crimes, such as theft or fraud."

That guidance is two decades old, and FinCEN has not replaced it with a dealer-specific risk assessment guide. The method below is a practical reading of the rule, not a FinCEN format.

A method that fits a dealer

Work through each factor the rule names. For each one, write down three things: what your business actually does, how risky that is and why, and what you do about it.

1. Products

List what you buy and sell, in volume terms. Investment-grade bullion, scrap and estate jewelry, loose stones, numismatic coins, and finished jewelry carry different risks. The 2024 National Money Laundering Risk Assessment describes precious metals, stones, and jewels as attractive to launderers because of their "high value, high value to low mass ratio, stable pricing, anonymity, and exchangeability for other commodities." Products closest to cash, such as standard bars and bullion coins, usually rate higher than items whose value is harder to realize quickly.

2. Customers

Describe who buys from you: walk-in retail, repeat collectors, online buyers you never meet, businesses, and foreign buyers. Note how you pay and get paid with each group. The rule's own red flags, in 1027.210(b)(1)(ii), are a useful checklist here: large cash, multiple or sequentially numbered money orders, traveler's checks, or cashier's checks, payment from third parties, and buyers who will not give complete information.

3. Suppliers

The rule names suppliers, and this is where many programs are thin. Describe who sells to you and in what form: other U.S. dealers, refiners, foreign trading companies, the public selling scrap, pawnshops. The largest dealer prosecutions began on the purchase side, as our post on dealers without an AML program shows. Our post on supplier due diligence covers sourcing risk in more detail.

4. Distribution channels

In person, online, by phone, at shows, through agents or consignment. Remote and non-face-to-face sales make identity harder to confirm. Trade shows bring in buyers and sellers you have never dealt with.

5. Geography

Where you operate, where your customers and suppliers are, and where shipments and payments go. Check each against the three kinds of designated jurisdictions the rule names, using the current lists, which change:

State sponsors of terrorism. As of November 2026, the State Department lists Cuba, North Korea, and Iran (State Department).
FATF's call-for-action list. As of FATF's October 30, 2026 statement, North Korea, Iran, and Myanmar (FATF "black and grey" lists).
Section 311 special measures. FinCEN keeps the jurisdictions and institutions it has acted against on its Special Measures page.

FATF's "grey list" of jurisdictions under increased monitoring is not one of the categories the rule names. Many dealers treat it as a risk factor anyway; if you do, say so in the assessment.

6. Unfamiliar counterparties

Estimate how much of your business, by count and value, is with people who are not established customers, established suppliers, or other U.S. dealers subject to the rule. A shop that buys most of its inventory from walk-in sellers has a different risk from one that buys from a few wholesale accounts. FinCEN's preamble linked the depth of inquiry to this: for a new customer or supplier, reasonable inquiry may mean "considerable scrutiny, including verification of customer identity, or the purpose of a transaction," while for an established customer it may need no extra steps "unless the transaction appears suspicious or unusual."

7. Payment routing

Record whether any payment or reconciliation runs to or from accounts in the designated jurisdictions above, including payments through third countries for a supplier located elsewhere. If the answer is never, say how you know.

From factors to a rating

The rule requires an assessment, not a score. Scoring is a voluntary choice above the requirement, and a common one: rate each factor's inherent risk (say, low, moderate, or high), describe the controls that address it, and state the risk that remains. Keep the scale simple enough that the person running the counter could explain it. A scale nobody uses is worse than a clear paragraph.

Consider a dealer that sells bullion coins online and in one store, and buys scrap from the public. Products: high, because its main products are close to cash. Customers: moderate, because most sales are by card or wire from repeat buyers, but some store sales are in cash. Suppliers: high, because a third of its purchases come from walk-in sellers it does not know. Geography: low, because it ships only within the United States and has no foreign suppliers. The written assessment should lead straight to controls that match: ID and inquiry steps for walk-in sellers, cash handling and Form 8300 procedures at the counter, and testing that samples purchases from the public, not only sales.

Keeping it current

The rule does not set a review interval. It requires the program to be updated as the risk assessment changes, so the assessment has to keep up with the business. Review it at least on a fixed schedule you choose and write down, and also when something changes: a new product line, a new sales channel, a new supplier type or country, a change to the designated-jurisdiction lists, or an enforcement action or advisory that bears on your business. Date every version and keep the old ones. A tester, an examiner, or your bank will want to see that the assessment moved when the business did.

FinCEN has proposed to make the risk assessment a formal program component for all covered institutions, as our post on FinCEN's 2026 proposal explains. As of November 2026 that is a proposal, not a final rule. The current dealer rule already requires the assessment.

Where this fits

Required of dealers by Part 1027: a risk assessment covering the factors in 1027.210(b)(1)(i), controls based on it, updates when it changes, and testing scaled to it.
Voluntary, above the requirement: a scoring matrix, a fixed review calendar, and treating the FATF grey list as a risk factor. A dealer that adopts any of these should write it into the program and follow it.
For other institutions: bank-style customer risk ratings tied to customer due diligence and beneficial ownership rules. Those rules do not apply to dealers (see Your AML Program Is Not a Bank's).

The Dealer Guide walks through the other three program parts.