Risk-Based Approach (RBA)
A risk-based approach means identifying where the money-laundering and terrorist-financing risk actually sits and applying stronger controls there and lighter ones elsewhere. It is the organising principle of the FATF standards, and it is not a licence to do less.
Also called: risk based approach
The risk-based approach sits at the front of the FATF Recommendations, in Recommendation 1. Countries are expected to identify and assess their national risks and apply measures proportionate to them; regulated firms are expected to do the same for their own business. The general principle FATF states is that where risks are higher, firms should take enhanced measures to manage and mitigate them, and where risks are lower, simplified measures may be permitted.
Operationally that means a firm has to be able to show its work. A documented business-wide risk assessment covering customers, products, delivery channels and geographies; a customer risk-rating methodology that follows from it; due diligence and monitoring calibrated to the rating; and evidence that the calibration is reviewed when the business changes. An examiner is not usually testing whether a firm reached the same conclusion they would have. They are testing whether there is a reasoned basis for the conclusion it did reach.
The counterweight is that simplified measures are never available where there is a suspicion of money laundering or terrorist financing, whatever the customer’s rating says. FATF amended Recommendation 1 in February 2025 to press the point that proportionate means fit for the risk in both directions — and that blanket de-risking of whole categories is a failure of the approach, not an application of it.
In practice
Risk-based is not the same as discretionary. A firm that cannot produce a written risk assessment, or that rates every customer medium, has not applied a risk-based approach — it has applied no approach and used the phrase as cover. That is one of the most common findings in AML examinations.
Example
A remittance business finds that 4% of its corridors generate 60% of its alerts. It moves those corridors to enhanced due diligence with lower monitoring thresholds, and reduces the documentation burden on low-value domestic transfers. Both halves of that decision are the risk-based approach; doing only the second half is not.
Commonly confused with
| Term | How it differs |
|---|---|
| De-risking | De-risking is exiting whole categories of customer rather than managing them. FATF treats it as a failure of the risk-based approach, not an example of it. |
| Enhanced Due Diligence | EDD is the set of stronger measures applied at the high-risk end. The risk-based approach is the framework that decides who lands there. |
See also
- FATFThe Financial Action Task Force, or FATF, is the intergovernmental body that sets the international standards for anti-money-laundering and counter-terrorist financing, assesses countries against them, and maintains the lists — informally the grey list and the black list — that drive country risk ratings across the industry.
- Enhanced Due DiligenceEnhanced due diligence, or EDD, is the additional scrutiny applied where money laundering risk is higher. In the UK and the EU it is mandatory in prescribed cases — politically exposed persons, high-risk countries, correspondent banking — as well as wherever a firm’s own risk assessment says the baseline is not enough.
- Customer Due DiligenceCustomer due diligence, or CDD, is the baseline set of checks a regulated firm performs on a customer: who they are, who owns and controls them, and what activity to expect. It is done at onboarding and then kept current for as long as the relationship lasts, with risk rather than a fixed calendar setting when it is revisited.
- De-riskingDe-risking is a bank exiting a whole category of customer, such as money services businesses, crypto firms or particular corridors, rather than assessing and pricing each relationship on its own facts. Accounts close because of what the customer is, not what the customer did.
- AML ProgramAn AML program is the documented set of controls a regulated firm must maintain to detect and deter money laundering. In the United States it is conventionally described as four pillars: written policies and procedures, a designated compliance officer, staff training, and independent review. Other regimes frame the same components differently.
- Transaction MonitoringTransaction monitoring is the ongoing review of customer activity — automated rules and models plus human investigation — against what the firm expected that customer to do and against known laundering patterns. Activity that does not fit produces an alert for someone to work.