Explanation
A financial institution should regularly update its AML risk assessment in order to ensure that the results of the assessment are accurate and reflect the current money laundering and other illicit financial activity risks that the institution may face. This helps to ensure the institution has a comprehensive understanding of the risks associated with its activities and can implement adequate controls and procedures as necessary.

AML risk assessments are a key component of the risk-based approach to AML compliance, as required by the MLR 20171 and the FATF Recommendations2. AML risk assessments help FIs to identify, assess, and mitigate the money laundering and terrorist financing risks they face, taking into account their specific products, services, customers, and geographic locations. AML risk assessments also help FIs to allocate their resources and implement their AML policies and procedures in a proportionate and effective manner. AML risk assessments are not meant to be a one-off exercise, but rather an ongoing process that should be updated regularly to reflect changes in the FI's risk profile and the external environment.
References:
1: The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
2: The FATF Recommendations - International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation Reference:
https://www.wolfsberg-principles.com/sites/default/files/wb/pdfs/faqs/17.%20Wolfsberg-Risk-Assessment-FAQ

shell banks are banks that have no physical presence in any country and are not affiliated with any regulated financial institution. They are often used by money launderers and terrorist financiers to hide their illicit activities and evade regulatory oversight. The USA PATRIOT Act prohibits US financial institutions from opening or maintaining correspondent accounts with shell banks, and requires them to take reasonable steps to ensure that their foreign correspondent banks do not provide services to shell banks12. Therefore, the US does not have jurisdiction over shell banks operating in foreign jurisdictions, unless they are involved in transactions that violate US laws or sanctions.
References:
USA PATRIOT Act Section 313: Prohibition on U.S. Correspondent Accounts with Foreign Shell Banks1 Fact Sheet Regarding the Treasury Department's Use of Sanctions Authorities to Combat Money Laundering and Terrorist Financing3 Reference: https://www.congress.gov/107/plaws/publ56/PLAW-107publ56.htm

a qualified compliance officer is a mandatory element of all anti-money laundering programs, regardless of the type or size of the financial institution. The compliance officer is responsible for developing, implementing, and overseeing the anti-money laundering program, ensuring its compliance with the relevant laws and regulations, and reporting any suspicious activity to the appropriate authorities12. The compliance officer should have sufficient authority, resources, and expertise to perform these duties effectively.
References:
Anti-Money Laundering (AML) | FINRA.org1
Anti-Money Laundering Program and Suspicious Activity Reporting Requirements For Insurance Companies Frequently Asked Questions | FinCEN.gov2

A startup virtual currency exchange that operates as a money services business (MSB) must comply with the anti-money laundering (AML) regulations and standards applicable to MSBs, such as the Bank Secrecy Act (BSA) in the United States. One of the key requirements for MSBs is to develop and implement an effective AML compliance program that covers the following four pillars: internal controls, independent testing, designated compliance officer, and training12.
Before launching its operations, the startup should consider the following two AML responsibilities that are essential for its compliance program:
A customer onboarding process: The startup should establish a customer identification program (CIP) that verifies the identity of its customers and collects relevant information, such as name, address, date of birth, and identification number12. The startup should also perform customer due diligence (CDD) and enhanced due diligence (EDD) for higher-risk customers, such as those who engage in large or frequent transactions, use anonymous or pseudonymous digital wallets, or originate from high-risk jurisdictions34. The startup should also screen its customers against sanctions lists and other watchlists to prevent dealing with prohibited or suspicious entities12.
Transaction limits consistent with risk appetite: The startup should set appropriate transaction limits for its customers based on its risk assessment and risk appetite. Transaction limits can help mitigate the exposure to money laundering and terrorist financing risks, as well as comply with the reporting and recordkeeping obligations under the BSA. For example, the startup should report any cash transactions over $10,000 or any suspicious transactions over $2,000 to the Financial Crimes Enforcement Network (FinCEN)12. The startup should also monitor its customers' transactions for any unusual or inconsistent patterns or behaviors that may indicate money laundering or other illicit activities34.
References:
1: ACAMS CAMS Certification Package - 6th Edition, Chapter 6: AML Compliance Program, pp. 139-1461
2: ACAMS CAMS Certification Video Training Course, Module 6: AML Compliance Program, Lesson
6.1: The Four Pillars of an AML Compliance Program3
3: ACAMS CAMS Certification Package - 6th Edition, Chapter 4: Customer Due Diligence, pp. 87-1061
4: ACAMS CAMS Certification Video Training Course, Module 4: Customer Due Diligence, Lesson
4.1: Customer Identification Program and Lesson 4.3: Enhanced Due Diligence3