Residual risk represents the remaining level of risk after considering the effectiveness of controls. Under a risk-based approach, strong controls reduce risk, while weak or ineffective controls increase it.

In this scenario, the inherent risk is assessed as moderate, meaning the underlying exposure is neither low nor extreme. However, the controls are evaluated as less than satisfactory, indicating that existing measures are not adequately mitigating the identified risks.

When controls are weak, residual risk increases above the inherent risk level, as vulnerabilities remain unaddressed. Regulators expect financial institutions to escalate residual risk ratings and implement remediation plans in such cases.

Therefore, the most likely residual risk conclusion is high, reflecting the combination of moderate inherent risk and ineffective controls. This outcome aligns with AML best practice and regulatory expectations.