Bank Protection Act and NCUA security requirements do not specifically require risk assessments, but do require the financial institution to be aware of crimes against financial institutions in the area.  Gathering crime history and completing risk assessments are an excellent method of compliance with the Bank Protection Act and NCUA requirements.