Your statistical return: you've spent weeks pulling together data, finally filed it, and you have the sleepless nights and stress levels to prove it. Now it's sitting in a folder somewhere and you intend to spend the next 12 months trying to forget it ever existed. Totally understandable.

But it's a shame, because buried inside it is most of the evidence base your Business Risk Assessment (BRA) has been crying out for.

The FSA has been saying this since 2020

The Financial Services Authority wrote to TCSP chief executives in 2020 to tell them, plainly, that they were seeing risk assessments that identified threats at a generic level, applied generic controls, and demonstrated no real understanding of the specific business behind them. A generic BRA, they said, does not show that you understand the risks within your own business. It just shows that you did the exercise.

Between 2023 and 2024, the FSA ran a two-phase BRA thematic across the TCSP sector. The resulting reports did something genuinely useful: they showed, with case studies and best-practice examples, exactly what good looks like. What the inspections found was that the two most commonly failed requirements are, at root, upstream and downstream data problems — and both require you to know and understand your own numbers. Which is precisely what you spend weeks generating, in granular detail, in a regulatory return you have filed and mentally set fire to.

So, before you light that match, let's look at what you actually have. Each firm needs to situate itself within the context of the National Risk Assessment (NRA), but it also needs to parse what is coming up from its own client base through the Customer Risk Assessment (CRA) process. That second part is where most BRAs fall short — not because firms aren't doing CRAs, but because they never translate the aggregate picture into the BRA itself.

The two requirements firms keep failing are simple to state:

• Engage meaningfully with the NRA, don't just cite it. The best-practice example showed a firm that built a structured comparison: each relevant NRA observation alongside the firm's own data, with a note on whether they sat above, below or in line with the sector average.
• Reflect the actual outcomes of your CRAs in your BRA. Not a description of your process — the detailed picture of what your process has found. The actual, honest-to-goodness numbers: how many higher-risk clients, what proportion of the total, where they are from, what your PEP exposure looks like.

What your return actually contains

The statistical return is where that aggregate picture lives. And that, precisely, is what the Code means when it requires your BRA to reflect the outcomes of your CRAs.

The return data captures your customer base by risk rating and type, drawn directly from your CRA outcomes. It records your PEP and Commercially Exposed Person counts. It maps the jurisdictional spread of your clients and their beneficial owners. It asks about your disclosure rates, your income concentration, and your introducer usage. If you stop and look at that list, what you are actually looking at is a structured data breakdown of your client base by risk category. It is the same dataset we describe in more than a filing exercise, viewed from the BRA side.

The best-practice firms in the FSA thematic had dedicated CRA-outcomes sections in their BRAs, showing risk distribution across the client base and analysis of jurisdictional exposure. They compared their PEP concentration against sector averages. And then, critically, they used those numbers to drive the rest of the document. Where the data showed elevated geographic exposure, the BRA addressed it. Where the higher-risk proportion sat above the sector average, the risk appetite statement explained why that was acceptable and what controls justified the position.

Benchmarking against the NRA

The jurisdictional data in the return gives you both sides of the NRA comparison the regulator wants to see: your numbers on one side, the published sector aggregates on the other. If your higher-risk proportion looks different from the sector average, your BRA should say why — and your risk appetite statement should give some context around that as well.

If your SAR rate looks low relative to your client base, your BRA should address that too. Not because a low number is necessarily wrong, but because the FSA will notice it, and your BRA should get there first — specific, evidenced, and written by you before anyone asks the question. That is what separates a BRA that works from one that just exists.

Leverage your data

You can now extract your return data in Excel before you submit. If you didn't do that this year, do it next year. Your risk profile is not static: client numbers shift, jurisdictional exposure changes, PEP counts move. Year-on-year movement in any of these figures is exactly the kind of internal trigger that should prompt BRA updates and board reporting between formal reviews. The return gives you a consistent, comparable snapshot every twelve months. Used properly, it provides genuine trend and management information over time.

The data in your statistical return is what makes your BRA real rather than generic — which is, as it happens, exactly what the FSA has been asking for since 2020.

If your BRA still reads as too generic, talk to Knight about turning your statistical return into a defensible, evidence-led assessment.

Frequently asked questions

Why does the FSA say a generic BRA isn't good enough?

Because a generic BRA shows you completed the exercise, not that you understand your own business. Since its 2020 message to TCSP chief executives and through the 2023–24 BRA thematic, the FSA has been clear that a strong BRA engages with the NRA using your own data and reflects the real outcomes of your CRAs — not a description of your process.

How does the statistical return feed my BRA?

The return is an aggregated, year-end snapshot of your client base: risk ratings and types from your CRA outcomes, PEP and Commercially Exposed Person counts, the jurisdictional spread of clients and beneficial owners, disclosure rates, income concentration and introducer usage. That is exactly the evidence a BRA needs, so the data should drive the BRA narrative and remain reconcilable back to what you submit.

What should I do with the return data after I file it?

Don't file it and forget it. Extract it in Excel before you submit, keep it in a usable format, and compare it year on year. Material movements in risk distribution, jurisdictions or PEP numbers are internal triggers for BRA updates and board reporting between formal reviews.