A risk based approach lets a firm go lighter only where it can show the risk is lower. Under Recommendation 1 of the FATF Recommendations, firms need processes to "identify, assess, monitor, manage and mitigate" their risks, and the Interpretive Note adds that "simplified measures should not be permitted whenever there is a suspicion of money laundering or terrorist financing" (INR 1, paragraph 2). Where risk is higher, heavier checks are required.
What are the main elements of a risk based approach?
Table 1. The risk based approach, stage by stage.
| Step | What goes in | What comes out | Owner |
|---|---|---|---|
| 1. Assess the business | Customers, countries, products, transactions and delivery channels; the national risk assessment | A documented business wide risk assessment | Senior management approves |
| 2. Rate each customer | CDD data, PEP and adverse media results, the factors from stage 1 | A customer risk profile and rating (customer risk assessment) | Compliance analyst, by the firm's method |
| 3. Set due diligence | The rating | Standard, simplified or enhanced due diligence | Compliance; senior management for high risk acceptance |
| 4. Monitor | Transactions, changes in the customer, list updates | Alerts and refreshed ratings | Analyst, with escalation |
| 5. Review and record | Results, audit findings, new rules | An updated assessment and policies | Senior management |
Stage 1, the application of the approach to the whole firm, is its own AML risk assessment, built on what the national risk assessment says about the country, and everything after it applies that assessment to one customer at a time. FATF asks firms to document their assessments "to be able to demonstrate their basis" (paragraph 12), so the record is part of the approach.
The stages do not have to move together. A customer can get normal checks at acceptance and enhanced ongoing monitoring, "or vice versa" (paragraph 16). The customer risk profile is where those choices meet.
Where does the risk based approach principle come from?
Table 2. Where each market writes the risk based approach (as of October 2026).
| Jurisdiction | Rule | What it scales | Status |
|---|---|---|---|
| FATF | Recommendation 1 and its Interpretive Note | Country and firm measures, proportionate to the risks identified | Standard; revised February 2025, June 2026 edition |
| EU | Directive (EU) 2015/849, Article 8 | Risk assessment and policies, proportionate to the nature and size of the firm, approved by senior management | In force through national law |
| EU | Regulation (EU) 2024/1624, Articles 10 and 20(2) | The business wide assessment, approved by the management body; CDD on "an individual analysis of the risks" | Applies from 10 July 2027 |
| UK | Money Laundering Regulations 2017, regulation 18 and regulation 28(12) | The firm's risk assessment, by its size and nature; CDD that reflects it | In force |
| US | 31 CFR 1020.210 | Ongoing customer due diligence by risk based procedures | In force for banks |
| US | FinCEN proposal of 10 April 2026 | Programs that put more attention and resources on higher risk customers and activities than on lower risk ones | Proposed; comments closed 9 June 2026; not final |
Each row asks the same thing in its own words: know the firm's risks, then match the controls to them. The EU rows also show a handover. Until 10 July 2027 the directive works through each member state's law; from then the regulation applies directly, and Article 20(2) ties the depth of each customer's due diligence to the firm's business wide assessment. The US text is still a proposal, so a US bank works from the current rule and its examiners' manual until FinCEN publishes a final rule.
Same numbers, different risk: what does a risk based approach example look like?
The FFIEC's BSA/AML examination manual gives the example of two banks that each send "100 international funds transfers per day". The count is the same. At the first bank about 90 percent are recurring, documented transfers for long term customers; at the second, "90 percent of its funds transfers are nonrecurring or are processed for noncustomers". The manual's verdict: "While these percentages appear to be the same, the risks may be different".
Now add illustrative numbers. Bank A has 10 transfers a day outside a documented pattern and Bank B has 90. At 15 minutes of analyst review each, Bank A spends 2.5 hours a day and Bank B 22.5 hours, close to three full time analysts. Some of Bank B's 90 are processed for noncustomers. Its approach either brings those senders under enhanced due diligence or stops transfers for noncustomers. Bank A keeps standard checks and writes down why, since "sound practice would be to document the factors considered, including any weighting".
The rating step is where most of that work sits. complead, formerly Sanction Scanner, scores customers in customer risk assessment and KYC against a risk model the firm builds, and every rating shows the factors behind it; the analyst still decides what the rating means for the customer.
What does a risk based approach change in KYC and transaction monitoring?
In KYC, it sets the depth. UK regulation 28(12) says the extent of customer due diligence "must reflect" the firm's risk assessment and its view of the risk in the particular case, and "may differ from case to case". A salaried local customer opening a current account and a company with nominee shareholders in three countries should not get the same file.
In transaction monitoring, it changes the rules and thresholds a transaction monitoring tool runs. A firm sets lower alert thresholds and more scenarios for high risk segments, and wider ones for low risk segments it can justify. Picture, as an illustration, a cash deposit rule that alerts at $3,000 a week for cash intensive businesses rated high and at $9,000 for salaried retail customers rated low. Both thresholds can be right, and both need the same written reason as a KYC decision, tested against the alerts they actually produce.
Which risk based approach texts moved in 2025 and 2026?
- February 2025. The FATF revised Recommendation 1 and its note "to increase focus on proportionality of measures" and to make countries allow and encourage simplified measures in lower risk areas.
- 10 April 2026. FinCEN's program proposal; its comment window shut on 9 June, and there is no final rule yet.
- 16 April to 15 July 2026. AMLA consulted on draft guidelines for the business wide risk assessment; results are still to follow.
What does an examiner ask to see?
The decision this approach leaves with the firm is where to go lighter, and the firm has to write down why. FATF wants the policies "approved by senior management" (paragraph 13), the UK's regulation 19 says the same of a firm's own senior management, and from 10 July 2027 the EU regulation has the management body approve the business wide assessment (Article 10(2)).
A risk based approach is tested as much by what a firm chose not to do as by what it did. A US examiner, or a UK supervisor such as the FCA or an EU one, who sees lighter checks on a low risk segment asks for the line in the risk assessment that justifies them, and a file that only shows extra checks on high risk customers shows half the approach.
Related terms
- Customer risk assessment. Rating one customer's risk.
- KYC risk rating. The score or band that rating produces.
- Simplified due diligence (SDD). Lighter checks where risk is shown to be low.
- Enhanced due diligence (EDD). Deeper checks where risk is high.
- AML risk assessment. The firm wide view that stage 1 produces.
- De risking. Ending whole categories of customers instead of managing their risk.
How this entry was checked. Only the arithmetic added to the FFIEC example is illustrative. The two banks and every quoted line come from the texts named here. The base is FATF Recommendation 1 and its Interpretive Note in the June 2026 edition, with the February 2025 revision. Against it the author, Emirhan Akgün (Software Engineer at complead), compared the EU directive of 2015 (Article 8, consolidated version), the EU AML Regulation of 2024 (Articles 10, 20 and 90), the UK Money Laundering Regulations 2017 (regulations 18, 19 and 28), 31 CFR 1020.210, FinCEN's proposal of 10 April 2026 (91 FR 18704), AMLA's consultation page and the FFIEC examination manual's risk assessment section; Fatih Coşkun, Founder and CEO of complead, checks the same texts before publication. Last reviewed: 30 October 2026.
