How not to conduct an AML risk assessment