A few months ago, an MLRO who had gone through an expensive BWRA transformation project asked me a question I didn’t expect: “Would it be possible for us to go back to spreadsheets?”.
They’d spent time and money on a shiny new platform that promised to transform their business-wide risk assessment. Instead, it slowed them down. The tool didn’t fit the way they worked; they were feeding the system rather than learning from it.
It’s a story I’ve heard more than once. And it tells you something important: digitalising the BWRA isn’t just a tech challenge – it’s an execution challenge.
Everyone recognises the goal of digitalisation: faster, cleaner assessments, stronger evidence, less pain. But between spreadsheets and full automation can lie a swamp of integration delays, cost justifications and unplanned complexity.
-1.png)
Digitalising a BWRA isn’t just about moving data online. It’s about cleaning up everything underneath, strengthening the link between your enterprise risk, RCSA and BWRA frameworks and ensuring that controls, inherent risks and residual risks all speak the same language.
One bank that I worked with had a control library so inconsistent that mapping it to a digital platform took around six months. Aligning their AML and sanctions taxonomies was particularly time-consuming, with many conversations between line 1 and line 2, just so that the team could land on shared language that could be reflected in the new digitalised processes.
Senior management see the headline cost of a new system. They don’t see the hidden FTE cost of the current one – the endless rekeying, reconciliation, and firefighting. Until you quantify that pain, it’s hard to justify the change.
These weren’t mistakes; they were symptoms of years of ‘good enough’ spreadsheets. When you start to digitise these processes, the gaps appear. That's one reason why digitalisation is hard to sell internally.
Done properly, digitalisation isn’t about making the BWRA pretty, it’s about making it useful.
The real benefits are the ones that make your life easier, and make your operations more scalable:
- Consistency: one data structure, one scoring logic, one version of the truth.
- Auditability: every decision logged, every update time stamped.
- Efficiency: no more chasing teams for their answers; workflows do it for you.
- Visibility: AML, fraud and sanctions risk finally live in the same place.
- Engagement: people actually participate because it fits around their day, not the other way round.
When digitalisation works, it changes the conversation. You can show your board where risks are rising, where controls are thin, and how residual exposure aligns with appetite. You’re not arguing over spreadsheets anymore – you’re managing risk.
So why doesn’t everyone get there? Because digitalisation is messy, and it exposes things you’d rather not see.
Most programmes get stuck on three fronts:
- Funding: the benefits don’t always sit with the people paying for them.
- Integration: the platform has to plug into data sources, control libraries and assurance outputs that were never built to talk to each other. Control libraries, RCSA and BWRA taxonomies rarely align cleanly, forcing firms to reconcile them before automation can even start.
- Readiness: the process itself isn’t mature enough to automate – so digitalisation becomes a mirror showing where the cracks already were.
The temptation is to push ahead anyway. But that’s where firms fall into the trap of buying the technology before fixing the process.
Not every firm needs the same level of sophistication, and not every regulator expects it.
For organisations with smaller, less complex financial crime functions, a well-run spreadsheet can still beat an over-engineered platform. But those cases are the exception, not the rule. For larger, multi-jurisdictional, more complex firms, digitalisation isn’t optional. The scale and complexity of the data makes manual reconciliation impossible.
The key is knowing where your tipping point is. If you’re spending more time maintaining your spreadsheet than analysing what it tells you, you’re already there.
If you’re still wrestling with spreadsheets, you’re not behind. You’re just one of the many firms trying to modernise without breaking what already works.
A good first step in digitalisation is to make the BWRA easier to use and maintain, with cleaner data, clearer ownership and better evidence. As the process matures, it can start to connect with broader frameworks such as the RCSA or enterprise-risk model, giving a more joined-up view of control effectiveness over time.
That’s the moment the BWRA stops being a compliance chore and starts being genuine management tool.
-1.png)