1. Understanding TF risks involves a consideration of known or suspected TF threats and vulnerabilities in the jurisdiction, and an understanding of how the threats and vulnerabilities interact. One approach to articulate the interaction of TF threats and vulnerabilities is the use of risk events. These are hypothetical scenarios derived from identified TF threats, vulnerabilities and consequences.

2. This practical tool provides further guidance on the use of risk events. The identified risk events can be taken into account in the analysis stage of the TF risk assessment. This includes assessing the nature, sources, likelihood and consequences of the possible risk events. It should be noted that the list of TF threats and vulnerabilities included in this Annex are examples only and are not intended to be exhaustive.

Identification of threats and vulnerabilities

3. The first step in the process is to identify jurisdiction-specific TF threats and vulnerabilities. It is best conducted with an open mind to brainstorm potential threats and vulnerabilities to ensure that the widest range of possible risk events are identified initially. These can then be refined based on the primary methods and payment mechanisms used, the key sectors which have been exploited, and the primary reasons why those carrying out the TF activities have not been apprehended or deprived of their assets. Chapter 2 of this Guidance includes further information on the identification of TF threats and vulnerabilities.

Combining threats and vulnerabilities into risk events