129. Developing a supervisory risk assessment methodology for the first time, or updating the methodology, to provide more nuanced risk assessment, can be a daunting task.

130. Strategies to address this challenge:

• Supervisory authorities should seek to build an initial understanding of the inherent risk in the sectors they supervise and the national context from the NRA, sector experts and engagement with other relevant authorities. This will ensure that the risk factors assessed are adapted for ML/TF purposes.

• Supervisors should seek to identify and use quantitative and qualitative data when starting or updating a risk assessment. Ideally, risk assessments should be performed with a set of up-to-date, accurate, relevant and consistent data. This data can be obtained through a questionnaire or data return from entities which can include information such as data on ML/TF alerts, STR activity, staff training (among other quantitative data), as well as information on the financial and economic activity of the entity.