According to the text, non-compliance risk mapping is the starting point. It involves identifying applicable regulatory obligations, assessing risk exposure, evaluating the effectiveness of control mechanisms, and determining residual risk. This step is crucial because it structures the entire evaluation methodology.

The AMF's SPOT reviews identify several best practices, including a dedicated committee structure (regular compliance committee), the RCCI reporting to senior management, and a clear separation between permanent and periodic control. These practices strengthen the effectiveness of the ethical framework.

The strategic dashboard includes a summary of major risks, the evolution of key indicators, significant incidents, a benchmark of sanctions and budget monitoring. These elements help senior management make informed decisions.

The risk mapping must include several key elements: identification of regulatory obligations, assessment of risk exposure (probability multiplied by impact), evaluation of the effectiveness of control mechanisms, determination of residual risk, and prioritisation of actions. These elements are essential for a complete and regular assessment.

The text specifies that the risk mapping must be updated at least annually, or upon any significant change in activity or regulation. This means that the annual update is mandatory, even in the absence of significant changes.

Permanent control includes thematic and sample-based controls, while periodic control includes internal audits. This distinction is crucial for understanding the overall compliance framework.

The text indicates that the control plan execution rate must be above 95%. This indicator is crucial for measuring the effectiveness of the permanent control system.

The text mentions that this decision imposed fines for typical deficiencies, including a non-existent or inadequate AML/CFT risk mapping. This underlines the importance of a complete and up-to-date risk mapping.