There is no such legal requirement. The closest you will get is the fact that your BSA/AML & OFAC programs should be supported by a current risk assessment. That's per the BSA/AML Examination Handbook, not regulation.
There is no predetermined frequency for updating the risk assessment; it should be reviewed whenever one of the major elements on which it is based; i.e. products, services, customers, or geography change. For a low risk bank, updating it between on site exams is the minimal effort; e.g. every 18 months. However, I suggest you update it and report the results to the board at least annually.
_________________________
In this world you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant.