ORBS in Action: Inside Jamaica’s 2026 National Risk Assessment

Jamaica’s newly published third-round National Risk Assessment (NRA3) offers something regulators rarely get: a documented, multi-year trail of what happens when a jurisdiction moves risk-based AML/CFT supervision from paper to platform. Across several supervised sectors, one solution recurs throughout the report — AML Analytics’ Online Risk Based Systems (ORBS).

From data-gap problem to data-collection solution

Every National Risk Assessment starts with the same challenge: gathering consistent, comparable data from agencies and sectors that have never had to report in the same format before. Jamaica’s NRA3 working group faced exactly this problem — and turned to ORBS to solve it.

According to the report, ORBS served as the primary platform for the NRA3 process, enabling secure, structured and standardised data submission across multiple agencies and sectors, with data gathering questions mapped directly to the World Bank NRA Tool. Where other jurisdictions might rely on a patchwork of spreadsheets and one-off surveys, Jamaica had a single system that could gather comparable data at national scale.

A platform doing double duty across sectors

What makes Jamaica’s experience noteworthy is that ORBS wasn’t built for one regulator’s use case and then bent to fit others. The NRA3 documents genuine multi-sector adoption which covers not only data collection but also ongoing risk assessment implementations, such as:

• The Bank of Jamaica (BOJ) transitioned its existing risk-rating methodology for Deposit-Taking Institutions (DTIs) into ORBS, moving from manual assessment to automated data collection, risk scoring and enhanced analytics across its entire licensed population — with every entity now risk-rated and categorised on a consistent scale.
• The Betting, Gaming & Lotteries Commission (BGLC) took a phased approach over several years: a mandatory risk-assessment questionnaire first, then a numeric scoring methodology, then full digitisation through ORBS with a sharper multi-point risk scale for finer discrimination between similarly rated entities. That risk rating now determines examination frequency — from frequent reviews for the highest-risk entities down to much longer cycles for the lowest.

Multiple regulators with multiple mandates are supported by one data solution providing consistency and scalability without losing the specificity each sector requires.

The numbers that shaped the National Action Plan

Adoption is one thing; usable data is another. NRA3 shows ORBS doing the harder job — producing evidence granular enough to steer policy.

For example, the ORBS-based data for Jamaica’s Microcredit Institutions demonstrated that across 101 institutions, 89.91% had processes in place to identify and report suspicious transactions. However, the report goes further: it breaks down how those institutions monitor, finding that 57.80% still rely on manual transaction monitoring, 30.28% use hybrid systems, and just 1.83% have moved to fully automated monitoring.

That level of detail is what let Jamaica’s National Action Plan set specific, evidence-based priorities — including a gradual push toward more sustainable hybrid or automated monitoring where transaction volumes justify it — rather than generic recommendations. It’s a good illustration of what risk-based supervision looks like when the underlying data actually supports decision-making.

Beyond the case study: a full supervisory lifecycle in one platform

What Jamaica’s NRA3 captures is ORBS in its ongoing-monitoring role. But the platform is built to cover a supervisor’s entire relationship with an entity, not just the data collection stage.

At the front end, licensing and registration is supported through ORBS into a standardised process — every new entity assessed against the same criteria, with document review, an automated residual risk score, and controls testing actioned before a licence is even issued. That risk profile then carries forward rather than resetting: the ORBS Risk Matrix gives supervisors an overall residual risk score, sector-level results and an entity-by-entity breakdown on a single screen, covering newly licensed and existing entities alike. From there, bespoke Requests for Information can be deployed across an entire entity population for annual or ad hoc reassessment, with completion tracking and automated scoring feeding straight into targeted remediation actions where gaps are found — and guidance or education materials can be issued at scale, with visibility into who has actually engaged with them.

Licensing, risk assessment, ongoing monitoring, remediation and education — the full supervisory lifecycle in one consolidated view instead of five disconnected systems, with traceability at every stage.

This is also why the same architecture is now being extended into newer supervisory frontiers. The lifecycle logic that NRA3 shows working across established sectors is directly transferable to supervisors standing up an entirely new risk-based framework from scratch, where there’s no legacy infrastructure to migrate away from and consistency needs to be built in from day one.

Setting up the next cycle, not just closing out this one

Most of the conversation around a National Risk Assessment focuses on getting it done. Less attention goes to what happens after — and that’s where Jamaica’s position looks genuinely different coming out of NRA3.

The data-gap problem that typically resurfaces every NRA cycle — chasing down comparable information from agencies and sectors that don’t naturally report the same way — has already been solved, through ORBS. That infrastructure doesn’t reset once an assessment is filed. It stays in place, continuing to collect structured, standardised data on an ongoing basis, from the same agencies, in the same comparable format.

Practically, that means the next National Risk Assessment won’t start from zero. It starts from a running baseline: consistent risk data already being gathered, already comparable across agencies, already mapped to recognised assessment variables. The heavy lift shifts from “how do we get this data” to “what does the data now tell us has changed” — a materially different, and considerably lighter, starting position than most jurisdictions get to take into their next cycle.

Recognised, and increasingly replicated

ORBS was named winner of Best Risk Management Initiative at the Central Banking Awards 2024, recognising its role in helping jurisdictions establish risk-based supervision frameworks in practice. Jamaica’s NRA3 is a real-world illustration of this: a platform that started in one supervisory context and has since scaled across sectors, producing the kind of granular, comparable data that both National Risk Assessments and Mutual Evaluations increasingly demand.

For regulators watching Jamaica’s progress — whether they’re weighing a transition from manual, sector-siloed risk assessment toward a unified supervisory model, or standing up a risk-based framework for a sector that doesn’t have one yet — NRA3 offers a rare thing: a publicly documented account of what that journey actually looks like, sequencing, adoption data and all.

Want to see how ORBS could support risk-based supervision in your jurisdiction? Book a demo or get in touch.