SIRA: systematic integrity risk assessment
The SIRA is the first document a Dutch supervisor asks for and the last one that gets updated internally. We prepare it, or review what you already have — and make sure the outcome actually reaches your policy, your acceptance decisions and your monitoring.
A SIRA — systematische integriteitsrisicoanalyse — is the structured assessment in which a Dutch institution establishes which integrity risks it is exposed to, how large those risks are and which controls stand against them. It covers money laundering and terrorist financing, and also sanctions breaches, bribery and corruption, conflicts of interest, fraud and improper conduct. It is the foundation on which customer acceptance policy, transaction monitoring, the sanctions framework and the training plan all rest: what is not in the SIRA is usually not controlled anywhere else either.
Where the obligation comes from
No single provision uses the word SIRA. The requirement arises from two directions at once, which is why some institutions end up maintaining two separate documents.
| Basis | What it requires | Who it applies to |
|---|---|---|
| Controlled and ethical operations s. 3:10 Wft, s. 14 Wtt 2018 | A systematic assessment of integrity risks and a controlled policy against them, adopted by the management board. | Institutions supervised by DNB or the AFM |
| Wwft risk assessment s. 2b Wwft | Identifying, recording and keeping current the money laundering and terrorist financing risks, proportionate to the nature and size of the institution. | Every obliged entity, licensed or not |
| Sanctions risk assessment Sanctions Act 1977 | Insight into sanctions risk across the client base, transactions and supply chain, and screening calibrated accordingly. | Institutions under the Sanctions Act supervision rules |
| AMLR from 10 July 2027 Regulation (EU) 2024/1624 | A business-wide risk assessment under directly applicable, more detailed requirements for substantiation and updating. | All obliged entities in the EU |
What goes wrong in practice
Too generic
The assessment describes the sector rather than this institution. The same text would fit any competitor. A supervisor recognises that within a page.
Gross and net conflated
Without separating risk before and after controls, it is impossible to see what the controls achieve — or where residual risk remains for the board to accept.
Controls never tested
Controls are listed but not examined for effectiveness. A screening rule nobody has ever calibrated counts in the SIRA as though it works.
No follow-through
The SIRA sits apart from policy. What scores high in the assessment does not reappear in acceptance policy, monitoring scenarios or the training plan.
How we work
| Step | What happens | Timing |
|---|---|---|
| 1. Inventory | Products, services, distribution channels, client segments, countries and the chain you operate in — plus whatever already exists: policy, earlier assessments, findings from a supervisor or auditor. | Week 1 |
| 2. Risk scenarios | A written set of scenarios that could realistically happen at your institution, not a standard list. For each: how it would unfold, where it would become visible and what it would cost. | Week 2 |
| 3. Gross and net scoring | Likelihood and impact before controls, the controls with a judgement on how well they actually work, and the residual risk that remains. | Week 2–3 |
| 4. Risk session | A half-day session with the board and, where applicable, the supervisory board: testing the scores, setting risk appetite and naming what will not be accepted. | Week 3 |
| 5. Translation | Concrete consequences for acceptance policy, enhanced due diligence, monitoring scenarios, sanctions screening and the training plan — with owners and deadlines. | Week 4 |
| 6. Adoption | Final document for board adoption, including a readable two-page summary for the supervisor. | Week 4–5 |
What it costs
- Review of an existing SIRA: € 3,450 excluding VAT, fixed price. A findings report with prioritisation, so you can repair what is repairable yourself.
- Full SIRA: € 6,500 excluding VAT, fixed price, for one licence and a straightforward product structure.
- Annual update: € 2,250 excluding VAT, where we prepared or reviewed the previous version.
- For multiple licences, multiple countries or a group structure we agree a different fixed price in advance. We do not work on open-ended time and materials.
Further reading
Related
Frequently asked questions about the SIRA
What is a SIRA?
A SIRA (systematische integriteitsrisicoanalyse) is the systematic integrity risk assessment Dutch supervised institutions are expected to maintain. It sets out which integrity risks the institution is exposed to, how large those risks are and which controls are in place against them. It covers money laundering and terrorist financing, but also sanctions breaches, bribery and corruption, conflicts of interest, fraud and improper conduct. It is the foundation for customer acceptance policy, transaction monitoring, the sanctions framework and the training plan.
Is a SIRA required by law?
For prudentially supervised institutions the requirement follows from the controlled and ethical business operations provisions: section 3:10 of the Financial Supervision Act (Wft) and, for trust offices, section 14 of the Trust Offices Supervision Act 2018. Separately, section 2b of the Wwft requires every obliged entity to identify, record and keep current an assessment of its money laundering and terrorist financing risks. In practice DNB and the AFM treat these together under the heading SIRA and ask for it in almost every examination.
How does a SIRA differ from the Wwft risk assessment?
The section 2b Wwft risk assessment covers money laundering and terrorist financing only. The SIRA is broader and covers all integrity risks, including sanctions, corruption, fraud, conflicts of interest and improper conduct. Many institutions produce a single document in which the Wwft risk assessment is a clearly delineated part of the SIRA. That is acceptable, provided the money laundering and terrorist financing risks are recognisable and complete.
How often must a SIRA be updated?
At least annually, and in addition whenever something changes that affects the risk picture: a new product, market or distribution channel, an acquisition, a shift in the client portfolio, new legislation or a new sanctions regime. A SIRA that has not changed in two years while the institution has, reads to a supervisor as evidence that the document is not actually used.
What does it cost?
A review of an existing SIRA costs € 3,450 excluding VAT at a fixed price. A full SIRA for an institution with one licence and a straightforward product structure costs € 6,500 excluding VAT. An annual update is € 2,250 excluding VAT where we prepared or reviewed the previous version. For multiple licences, multiple countries or a group structure we agree a different fixed price in advance; we do not work on open-ended time and materials.
Who adopts the SIRA?
The management board. The SIRA is a board document, not a compliance report: the board sets the risk appetite, approves the assessment and is answerable for the choices in it. We prepare the analysis and run the sessions, but we do not take over that responsibility — and a supervisor who finds that the board cannot explain its own document will draw conclusions from that.
Every rate for every service is listed together on the pricing page, so you can compare without opening each service page.
Sources
- Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) — wetten.overheid.nl
- Handvatten voor de SIRA — AFM
- Leidraad Wwft en Sanctiewet — De Nederlandsche Bank
- Wwft — Open Boek Toezicht, De Nederlandsche Bank
- Sanctions Act 1977 — wetten.overheid.nl
- Regulation (EU) 2024/1624 (AMLR) — EUR-Lex
- Wet toezicht trustkantoren 2018 — wetten.overheid.nl
Not sure whether you need a new SIRA? Send us the current version. In a thirty-minute call we will tell you whether a review is enough or whether it needs rebuilding — including when the answer is that you need nothing from us. Book the call.