The AML Risk Assessment
Mortgage Lenders Actually Use.
A free, interactive scoring tool built for residential mortgage lenders and originators. Score your geographic, customer, and product risk. Get your residual risk rating, gap findings, and remediation guidance \u2014 in under 15 minutes.
200+
Clients Served Nationwide
15+
Years of BSA/AML Expertise
Online
Delivery
50+
Training Programs Delivered
Built for Non-Bank Mortgage Lenders Under 31 CFR \u00a71029
Under 31 CFR \u00a71029, non-bank residential mortgage lenders and originators (RMLOs) are required to maintain a written AML program. A documented risk assessment is widely recognized as a foundational element of that program and is expected by FinCEN and state mortgage examiners \u2014 so a written, current assessment is one of the first documents they request.
A written, current risk assessment is one of the first documents examiners request. An outdated or incomplete risk assessment \u2014 one that doesn\u2019t reflect your current loan products, markets, or borrower mix \u2014 is among the most common AML examination findings for mortgage companies.
Penalty Risk
Willful BSA violations can bring civil penalties of up to $286,184 each, and some violations count separately for each day they continue. Negligent violations can bring up to $1,430 each, or $111,308 for a pattern of negligence. Criminal penalties may also apply. (31 U.S.C. 5321; 31 CFR 1010.821, as adjusted January 2025.) State mortgage regulators may impose additional fines and license revocation.
This Tool Is Built For
Mortgage Brokers
Non-bank originators required under 31 CFR §1029 to maintain a written AML program, with a documented risk assessment as a foundational component.
Retail Lenders
Direct-to-consumer mortgage lenders with multi-branch operations and diverse loan product portfolios.
Correspondent Lenders
Lenders with third-party origination relationships that amplify AML risk through broker channel exposure.
Hard Money Lenders
Asset-based lenders with elevated AML risk profiles due to non-traditional borrower types and loan structures.
Portfolio Lenders
Lenders holding loans on balance sheet with DSCR, Non-QM, and investor product concentrations.
BSA Compliance Officers
Designated compliance officers preparing for independent review or FinCEN examination.
4 Steps. Your Results in Minutes.
The assessment walks you through four structured sections, each covering a distinct risk domain. No account required. Results generate instantly.
Company Profile & Business Model
Enter your NMLS number, HQ state, annual production volume, number of MLOs, and business model mix (broker, retail, correspondent, hard money, etc.) with percentage allocations.
Geographic Risk & Volume Analysis
Select GTO and elevated-risk markets, enter loan volume by risk category, document international fund exposure, and disclose any FinCEN inquiries or prior AML findings.
Customer & Borrower Risk
Characterize your borrower population by type, document your PEP screening and OFAC procedures, and select your beneficial ownership verification method for entity borrowers.
Products, Transactions & Controls
Select loan products with portfolio allocation percentages, document cryptocurrency exposure, and score your AML program controls across all nine pillars.
Inherent Risk
62.5
/ 100
Control Score
45.0
/ 100
Residual Risk
34.4
Moderate
Gaps Found
4
2 Critical, 2 High
Engage a qualified third-party auditor. 31 CFR \u00a71029 requires independent review.
Three Risk Domains. Weighted Scoring.
The assessment scores three risk domains using the same weighting framework referenced in the FFIEC BSA/AML Examination Manual for residential mortgage entities.
Geographic Risk
- GTO-designated market presence (South Florida, NYC Metro, SoCal, Las Vegas, etc.)
- High-risk market loan volume as % of total production
- Border state origination activity
- International / foreign-source fund exposure
- FinCEN inquiry, prior AML findings, GTO receipt, law enforcement subpoena
Customer & Borrower Risk
- Borrower mix: W-2, self-employed, investors, LLC/entity, foreign nationals, cash-income
- PEP identification and Enhanced Due Diligence process
- OFAC screening on all transaction parties
- Beneficial ownership verification method for entity borrowers
- Broker-referred loans, layered ownership structures, alternative documentation
Product & Transaction Risk
- Loan product portfolio: DSCR, Non-QM, hard money, foreign national, construction
- Cryptocurrency source-of-funds acceptance and volume
- Alternative income documentation programs
- Remote Online Notarization (RON) usage
- AML program controls: written program, independent audit, OFAC system, TX monitoring
What You Get After Completing the Assessment
A complete risk report generated instantly in your browser. No email required. Save as PDF for your compliance file.
Inherent Risk Score
Weighted composite of geographic, customer, and product risk before controls are applied.
Control Effectiveness Score
Scores your AML program pillars: written program, BSA officer, training, audit, OFAC, TX monitoring, SAR procedures.
Residual Risk Rating
Net risk after controls: Low, Moderate, High, or Critical — the rating examiners care about most.
Compliance Gap Findings
Prioritized list of Critical, High, and Medium findings with specific regulatory citations and remediation recommendations.
Volume & Portfolio Analysis
Visual breakdown of loan volume by risk category, product portfolio allocation, and business model mix.
Regulatory References
9 regulatory citations including 31 CFR §1029, FinCEN GTO guidance, CDD Rule, and FATF real estate typologies.
Residual Risk Rating Scale
Strong controls relative to inherent risk. Maintain current program.
Some gaps identified. Address medium-priority findings within 90 days.
Significant gaps. Immediate remediation required for critical findings.
Severe program deficiencies. Examiner action risk is elevated.
Mortgage Professionals Rely on Soflo
200+ mortgage companies, law firms, and compliance officers trust Soflo for AML-BSA compliance.
Luisito "Louie" Flores
Vice President of Mortgage Operations, Modus Mortgage
“We've been working with Soflo Consulting for over 3 years, and they've been a key part of how we approach compliance today. What started as basic AML/BSA requirements turned into a much more structured and practical program that actually supports our operations instead of slowing...”
Javed Rahman
Partner, Rahman Le, Real Estate & Business Law
“Soflo Consulting has been instrumental in training our team on AML and BSA requirements. They made what can be a very complex and technical subject feel clear and practical for our staff. The training wasn't just theoretical. It was tailored to how we actually operate, which made...”
Built on 9 Regulatory References
Every gap finding in the assessment includes the specific regulatory citation. The scoring framework is built on the following authorities.
31 CFR §1029
AML program requirements for non-bank residential mortgage lenders and originators
FinCEN GTO Guidance
Geographic Targeting Orders for elevated-risk real estate markets
FFIEC BSA/AML Manual
Examination procedures and risk framework for mortgage entities
FinCEN CDD Rule
Customer Due Diligence and beneficial ownership verification requirements
FinCEN RRE Rule 2024
Residential Real Estate reporting rule for all-cash transactions (effective 2025)
FinCEN Virtual Asset Guidance
AML obligations for crypto-sourced funds in real estate transactions
FATF Report 2022
Money laundering through real estate — risk indicators and typologies
USA PATRIOT Act §352
AML program requirements — four pillars framework
31 CFR §1010.820
Civil money penalties for AML program deficiencies
The 7 Most Common AML Gaps the Assessment Identifies
These findings appear in the majority of mortgage company AML examinations. The assessment checks for all of them and provides specific remediation guidance for each.
No written AML program maintained
Develop a written AML program meeting the program requirements under 31 CFR §1029.
No AML Compliance Officer designated
Appoint a qualified individual with documented authority and reporting lines.
OFAC screening not performed on all transaction parties
Screen all parties against the OFAC SDN list. Maintain records for 5 years.
No independent AML audit within 18 months
Engage a qualified third-party auditor to conduct an independent review.
No transaction monitoring system in place
Establish transaction monitoring with documented thresholds and SAR protocols.
No PEP identification and EDD process
Implement PEP screening for all borrowers and transaction parties.
AML policies not updated within 12 months
Conduct annual policy review incorporating FinCEN guidance updates.
After the Assessment
Once you have your risk assessment results, Soflo can help you remediate the gaps \u2014 from independent AML audits and policy creation to OFAC screening implementation and annual training.
Not a Substitute for Independent Review
This tool is a self-assessment designed to help you understand your risk profile and identify gaps. FinCEN's mortgage rule requires independent testing, with scope and frequency that fit your risk. A third party or a qualified employee may do it, but the BSA officer cannot review their own program.
Mortgage AML Risk Assessment Questions
Who needs an AML risk assessment under 31 CFR §1029?
Non-bank residential mortgage lenders and originators (RMLOs) are required under 31 CFR §1029 to maintain a written AML program. A documented risk assessment is widely recognized as a foundational element of that program and is expected by examiners, though the rule does not prescribe one specific format. This applies regardless of company size or loan volume.
What does the Soflo Mortgage AML Risk Assessment 2026 tool score?
The tool scores three risk domains: Geographic Risk (30% weight) covering GTO markets, high-risk volume, border state activity, and regulatory history; Customer & Borrower Risk (35% weight) covering borrower mix, PEP screening, OFAC, and beneficial ownership; and Product & Transaction Risk (35% weight) covering loan product mix, cryptocurrency exposure, and alternative documentation. It then calculates an inherent risk score, a control effectiveness score based on your AML program pillars, and a residual risk score after controls.
How often should a mortgage company update its AML risk assessment?
Best practice is to update your AML risk assessment whenever there are material changes to the business — new loan products, new markets, significant changes in borrower mix, or changes in business model. Many organizations also refresh it on a regular cycle as part of their program review. An assessment that no longer reflects current operations is a common examination finding.
What is a residual risk score and why does it matter?
Residual risk is the risk that remains after your AML controls are applied to your inherent risk. A company with high inherent risk but strong controls (written program, independent audit, OFAC screening, transaction monitoring) will have a lower residual risk score. Examiners evaluate residual risk to determine whether your AML program is commensurate with your actual risk exposure.
What happens after I complete the risk assessment?
After completing the 4-step assessment, you receive a full results report including your inherent risk score, control effectiveness score, residual risk rating (Low / Moderate / High / Critical), a domain-by-domain breakdown, loan volume analysis, product portfolio allocation, a compliance gap findings list sorted by severity, and regulatory references. You can save the results as a PDF for your compliance file.
Is this tool a substitute for a formal independent AML audit?
No. The Soflo Mortgage AML Risk Assessment 2026 is a self-assessment tool designed to help you understand your risk profile and identify gaps. Where independent testing or review is required, it must be conducted by a qualified third party — the BSA officer cannot review their own program. This tool helps you prepare for that review and identify areas to address before an examiner arrives.
What are the most common AML risk assessment findings for mortgage companies?
The most common findings include: (1) risk assessment not updated within 12 months; (2) risk assessment does not reflect current loan products or markets; (3) no OFAC screening on all transaction parties; (4) no beneficial ownership verification for entity borrowers; (5) no independent review within 18 months; (6) no documented SAR escalation procedures; and (7) no designated AML Compliance Officer.
What regulatory framework does this assessment follow?
The assessment is built on 31 CFR §1029 (FinCEN AML program requirements for residential mortgage lenders and originators), the FFIEC BSA/AML Examination Manual, FinCEN GTO guidance, the FinCEN CDD Rule, FinCEN’s 2024 Residential Real Estate reporting rule, and FATF real estate typology guidance. All gap findings include the specific regulatory citation.
Know Your AML Risk Score Before the Examiner Does
Complete the Soflo Mortgage AML Risk Assessment 2026 in under 15 minutes. Get your inherent risk score, residual risk rating, and a prioritized list of compliance gaps \u2014 all built on 31 CFR \u00a71029 and the FFIEC BSA/AML Examination Manual. No account required. No data stored.
Soflo Consulting LLC \u00b7 31 CFR \u00a71029 Assessment Framework \u00b7 2026 Edition