Risk-Based Approach (RBA)
Matching the strength of AML controls to the level of risk: more scrutiny where risk is higher, simpler measures where it is demonstrably lower.
Definition
The risk-based approach (RBA) is the principle that a firm should identify and assess its money laundering, terrorist financing and sanctions risks, and then apply controls in proportion to them. Higher risk calls for enhanced measures. Lower risk, where it is properly assessed and justified, can allow simplified ones.
The RBA is not a single control. It is the logic that sits behind the others: how deep customer due diligence goes, how often files are reviewed, how sensitive screening and monitoring thresholds are, and where investigative effort is spent.
Why a regulated firm cares
No firm has unlimited resources. Applying the same level of scrutiny to every customer means either spreading effort too thinly over high-risk relationships or wasting it on low-risk ones. The RBA asks the firm to decide deliberately where its effort goes, and to be able to explain that decision.
It also cuts the other way. A risk-based approach is not permission to do less. Where the assessment identifies higher risk, the firm is expected to do more, and a firm that rates everything as low risk to justify light controls has not applied an RBA at all.
Some obligations are not risk-based. Sanctions prohibitions generally apply whatever the risk rating: a firm can scale how it screens, but not whether a designated person may be dealt with.
How it works in practice
Business-wide risk assessment. The firm assesses its exposure across customers, products and services, geographies, delivery channels and transactions. National and supranational risk assessments feed into this. The result is written down, approved by senior management and refreshed periodically or when the business changes.
Customer risk rating. Each customer is rated using factors such as ownership complexity, occupation or sector, countries involved, PEP status, product use and screening results. The rating decides the level of due diligence and the review frequency.
Calibrated controls. Screening match thresholds, transaction monitoring rules and review cycles are set with the risk assessment in mind, and the reasoning is recorded. Tuning a threshold to reduce alert volumes is a risk decision, not only an operational one.
Mandatory high-risk categories. Some situations require enhanced due diligence regardless of the firm's own view, such as relationships with PEPs or with certain high-risk third countries, depending on the jurisdiction.
Review and feedback. Alerts, investigations, typologies and regulatory findings feed back into the assessment. The RBA is a cycle, not a one-off document.
Regulatory basis
- FATF Recommendation 1 requires countries to identify and assess their risks and to apply a risk-based approach, and requires firms to do the same for their own risks. FATF has also published sector-specific guidance on applying the RBA.
- FATF Recommendation 10 links the depth of customer due diligence to risk, allowing enhanced and, in lower-risk cases, simplified measures.
- Directive (EU) 2015/849, amended by Directive (EU) 2018/843, requires firms to carry out and keep up to date documented risk assessments, and sets out simplified and enhanced due diligence.
- UK Money Laundering Regulations 2017 require a firm-wide risk assessment and risk-based policies, controls and procedures, including enhanced due diligence in specified cases.
- United States: the Bank Secrecy Act framework expects AML programmes to be risk-based, and the FinCEN CDD Rule (31 CFR 1010.230) sits within that framework. FinCEN has also published national AML/CFT priorities for firms to take into account.
The detail of what an assessment must contain, and which cases require enhanced measures, differs between jurisdictions. Firms should confirm local requirements; this is not legal advice.
Worked example
Hypothetically, Fernhill Payments serves small domestic retailers and a smaller group of cross-border wholesale traders. Its business-wide assessment rates the domestic retail segment lower risk: simple ownership, local activity, low average values. It rates the cross-border segment higher: complex structures, trade with higher-risk jurisdictions, and exposure to goods that could have dual-use applications.
It sets its controls accordingly. Domestic retailers receive standard due diligence and a three-year review cycle. Cross-border traders receive full beneficial ownership tracing, screening of the whole ownership chain, enhanced checks on trade flows, and an annual review. Transaction monitoring rules for the cross-border segment are set at lower values.
The assessment records why each choice was made. When a regulator asks why a domestic retailer was reviewed less often than a wholesale trader, the firm points to the assessment rather than to habit.
Related terms
Related Articles
Account Takeover (ATO)
A form of identity theft where a fraudster gains access to a user's bank accounts, email, or other services.
Adverse Media
Adverse media is published information linking a person or company to crime or serious misconduct, screened as part of customer due diligence.
Alert Rules
Configured parameters within AML software that automatically trigger an alert when suspicious activities match defined criteria.
Algorithmic Fraud
Automated and programmatic approaches to attempting financial fraud at scale utilizing bots and specialized software.