Risk-based approach
RBAAlso called risk-based AML approach
The risk-based approach is the principle that firms and supervisors focus anti-money laundering effort where the risk is highest. A firm identifies and assesses its money laundering and terrorist financing risks, then applies stronger controls to higher-risk customers, products and countries and lighter controls where risk is low.
How it works
The firm starts with a business-wide risk assessment covering customers, products, delivery channels and geographies, informed by national and supranational risk assessments. It sets a risk appetite and writes policies that link each risk level to a control set. Customers receive a risk rating at onboarding, which decides simplified, standard or enhanced due diligence and the depth and frequency of monitoring.
The approach matters because rules no longer set a single standard for every customer. Supervisors judge whether the firm's assessment is credible and whether controls match it. Firms that treat every customer the same either waste resources or miss real risk. Poorly evidenced risk assessments are among the most common findings in AML reviews.
The rules
Requires countries and firms to identify and assess money laundering and terrorist financing risks and apply measures proportionate to them.
Countries, supervisors and regulated firms in FATF jurisdictionsRequires firms to identify and assess their money laundering and terrorist financing risks and keep an up-to-date written record. Amended by SI 2026/621, mostly from 30 June 2026.
Relevant persons including banks, payment firms and cryptoasset businessesRequires a documented business-wide risk assessment, kept up to date, that shapes the obliged entity's policies, procedures and controls.
Obliged entities in the EUDirects that AML programmes be risk-based, with more attention and resources on higher-risk customers and activities.
Financial institutions subject to the Bank Secrecy ActCommon questions
What is the difference between a rules-based and a risk-based approach?
A rules-based approach applies the same checks to every customer. A risk-based approach varies the depth of checks by assessed risk. Most AML regimes are now risk-based, with a few fixed rules such as sanctions screening and reporting thresholds.
Does a risk-based approach allow firms to accept high-risk customers?
Yes. It does not require firms to exit high-risk customers. It requires them to understand the risk and apply enhanced measures. Supervisors have warned against blanket de-risking that cuts off whole customer groups.
Is the US AML programme rule changing?
FinCEN published a proposed AML/CFT programme rule on 10 April 2026 built around effective, risk-based programmes. It withdraws and supersedes a July 2024 proposal. The rule was still a proposal at the end of October 2026.
