It is a structured process to identify, evaluate, and prioritize potential money laundering and terrorist financing risks based on factors like customer profiles, products, services, and geographies. It enables a risk-based approach to control design.