For many organisations, the financial crime risk assessment is still a box to be ticked. It is completed, filed and forgotten until the next regulatory cycle comes round.