Risk-Based Approach

A risk-based approach (RBA) is the principle that countries, supervisors and financial institutions should first understand where their money-laundering and terrorist-financing risks lie, and then allocate their controls in proportion: stronger measures where risk is higher, simplified measures where it is demonstrably lower. It is the organizing idea of the standards issued by the Financial Action Task Force (FATF) and of most modern anti-money laundering (AML) laws.

The approach replaced an older, rules-based style in which every customer and transaction received the same checklist treatment. It is frequently misunderstood as permission to do less. In practice it requires a firm to know its exposure well enough to defend each decision, and it often leads to more work on the riskiest parts of a business.

The FATF introduced risk-based language in the 2000s and made it the first of its Forty Recommendations in the 2012 revision. Recommendation 1 requires countries to identify, assess and understand their money-laundering and terrorist-financing risks and to apply a risk-based approach so that measures are commensurate with those risks. It also requires countries to oblige financial institutions and designated non-financial businesses to do the same. The FATF has since issued sector guidance on the risk-based approach for banks, money or value transfer services, virtual asset service providers and others. For the body's full profile, see the FATF industry body profile.

Inside a regulated firm, the risk-based approach is usually built in four stages:

1. Business-wide risk assessment. The firm analyzes its inherent risk by customer type, products and services, delivery channels, and geography, including exposure to sanctioned or high-risk jurisdictions.
2. Customer risk rating. Each customer is scored at onboarding and periodically after that, using factors such as ownership structure, occupation, expected activity and whether the customer is a politically exposed person.
3. Calibrated controls. The rating drives the level of customer due diligence: enhanced due diligence for high risk, standard measures for most customers, and simplified due diligence only where the law allows and the low risk is documented. Transaction-monitoring thresholds and review frequency follow the same logic.
4. Review and evidence. The assessment is refreshed when the business, its products or the threat environment change, and the reasoning is written down so that an examiner or an independent AML review can test it.

The results feed directly into the written AML program, staffing levels, and the information a money laundering reporting officer presents to senior management.

A money transmitter serves two kinds of customer: salaried workers sending small, regular amounts to family in one country, and small businesses paying suppliers in several high-risk jurisdictions. Under a risk-based approach, the first group may be onboarded with standard identification and monitored with broad thresholds, while the second group receives beneficial ownership checks, collection of source of funds information, lower alert thresholds and annual reviews. The firm spends most of its compliance budget on the second group because that is where the risk sits.

Supervisors are expected to apply the same principle to themselves. A risk-based supervisor ranks the firms it oversees by risk and allocates examination time accordingly, rather than visiting every institution on a fixed cycle. In the United States, examination manuals for the Bank Secrecy Act are organized around the institution's own risk assessment; in the European Union, the anti-money laundering directives require national and supranational risk assessments; and in the United Kingdom, the Money Laundering Regulations 2017 require firms to carry out and document a risk assessment.

Critics point to three recurring problems. First, some firms use the language of risk to justify thin controls, which supervisors treat as a failure of the approach rather than an application of it. Second, the opposite error, de-risking, occurs when institutions exit entire categories of customers, such as remittance companies or charities, instead of managing the risk; the FATF has stated that wholesale exits are not consistent with the risk-based approach. Third, risk models depend on data quality and judgment, so two firms with similar customers can reach very different ratings. A further concern is regulatory arbitrage, where flexibility in national rules lets businesses choose the most lenient supervisor.