The risk-based approach to AML means matching a firm’s controls to the money laundering risk it actually faces. Rather than treating every customer the same, a firm applies lighter checks to low-risk cases and deeper checks to high-risk ones. It is the core of the FATF standard.
Key takeaways
- The risk-based approach allocates AML effort in proportion to risk.
- The FATF made it the foundation of its Recommendations in 2012.
- Firms assess risk across customers, products, geographies, and channels.
- Low-risk cases get simplified checks; high-risk cases get enhanced due diligence.
- It replaces a one-size-fits-all, rules-only model that wastes effort and misses real risk.
- A written risk assessment is what makes the approach defensible to a regulator.
On this page
What it isWhy the FATF requires itHow it worksRisk factors to assessApplying it: low vs highDocumenting itRisk-based vs rules-basedCommon mistakesFAQsRead more
1989
Year the FATF was founded to set the standard
Source: FATF
40
FATF Recommendations built on the risk-based approach
Source: FATF
$800B to $2T
Laundered worldwide each year the approach targets
Source: UNODC
What is the risk-based approach in AML?
The risk-based approach means a firm focuses its anti-money laundering effort where the risk is greatest. It accepts that not every customer or transaction carries the same threat, so it treats them differently.
In practice, that means a low-risk customer gets simpler checks, while a high-risk one gets deeper scrutiny. The firm decides the difference using a documented assessment of its own risks, guided by the Financial Action Task Force.
The approach is now the default worldwide. Read more: it underpins every AML compliance program a regulated firm runs.
Why the FATF requires a risk-based approach
The FATF made the risk-based approach the foundation of its 40 Recommendations when it revised them in 2012. The logic is simple: resources are limited, so they should go where they do the most good.
A rules-only model spreads effort evenly, which means wasting time on low-risk cases while under-watching the dangerous ones. The risk-based approach fixes that mismatch by design.
Because the FATF standard shapes AML law in more than 200 jurisdictions, the approach is written into national rules from the US to Singapore.
See where your risk is concentrated
Answer a few questions about your customers, products, and markets to get an indicative risk rating in minutes.
How the risk-based approach works
The approach follows a repeating cycle. A firm identifies its risks, rates them, applies controls to match, then reviews the result.
- Identify. List the money laundering risks the firm is exposed to.
- Assess. Rate each risk as low, medium, or high, and write it down.
- Mitigate. Apply controls that fit the rating, from simplified checks to enhanced due diligence.
- Monitor and review. Watch for change, and update the assessment as the business shifts.
The written assessment is the heart of it. Without it, a firm cannot show a regulator why its controls are set the way they are.
Risk factors to assess
A sound risk assessment looks across several factors, not just the customer. Each one can raise or lower the overall rating.
- Customer risk. Who the customer is, including politically exposed persons and complex ownership.
- Product and service risk. Whether the product favors anonymity or fast movement of funds.
- Geographic risk. Whether the customer or money touches a high-risk country. Check with our Country Risk Checker.
- Channel risk. Whether onboarding is face to face or fully remote.
- Transaction risk. The size, frequency, and pattern of expected activity.
Check where a country sits on risk
Look up a country against FATF, EU, and corruption data to feed the geographic part of your risk assessment.
Applying the approach: low risk vs high risk
Once a customer is rated, the rating decides how the firm treats them. The two ends of the scale look very different.
- Low risk. Simplified due diligence, with basic identity checks and lighter ongoing monitoring.
- Standard risk. Full customer due diligence and normal monitoring.
- High risk. Enhanced due diligence, including source-of-funds checks, senior sign-off, and closer monitoring.
Use the tool: turn customer details into a risk level with our Customer Risk Calculator.
Documenting your risk assessment
Documentation is what turns a risk-based approach from a good intention into a control you can defend. A regulator cannot see your judgment, so it has to see your records.
A sound write-up covers a few things:
- The risks you identified, across customers, products, geographies, and channels.
- The rating you gave each one, and the reasoning behind it.
- The controls you apply at each rating, from simplified to enhanced checks.
- The date of the assessment and when it will next be reviewed.
The write-up does not need to be long. For a small firm it can run to a few pages. What matters is that the reasoning is visible, so an examiner can follow how you got from a risk to a control.
Keep it current. An assessment that still describes last year’s business is one of the most common findings in an examination, and it weakens every control built on top of it. Read more: the assessment sits at the base of your AML compliance program.
Risk-based approach vs rules-based approach
The risk-based approach is often set against a rules-based one. The difference is where judgment sits.
| Rules-based | Risk-based | |
|---|---|---|
| Basis | Fixed rules applied to everyone | Controls matched to assessed risk |
| Strength | Simple and consistent | Focuses effort where it matters |
| Weakness | Wastes effort, misses new risk | Needs judgment and documentation |
Most regimes now expect a risk-based approach with rules inside it, not one or the other. The rules set a floor, and the risk assessment decides where to go beyond it.
Common mistakes in applying the approach
The approach fails in predictable ways. Avoiding these keeps it defensible.
- Rating without reasoning. A score with no written justification does not satisfy an examiner.
- Set and forget. A risk assessment that is never updated drifts away from the real business.
- Treating high risk as prohibited. High risk means more checks, not automatic refusal, which is where de-risking problems start.
- Ignoring low-risk drift. Low-risk customers can change, so monitoring still matters.
- Over-engineering low risk. Piling checks onto genuinely low-risk customers wastes the effort the approach is meant to save.
Turn customer details into a risk rating
Enter a few details about a customer and get an indicative money laundering risk level to guide your due diligence.
Frequently asked questions
What is the risk-based approach in AML?
The risk-based approach means a firm matches its anti-money laundering controls to the risk it actually faces. Low-risk customers get simpler checks, and high-risk customers get deeper scrutiny. The firm decides the difference using a documented risk assessment. It is the core principle of the FATF standard.
Why does the FATF require a risk-based approach?
The FATF made the risk-based approach the foundation of its 40 Recommendations in 2012. The reasoning is that resources are limited, so they should focus where laundering risk is highest. A rules-only model spreads effort evenly, which wastes time on low-risk cases and under-watches dangerous ones.
What are the main risk factors in an AML risk assessment?
The main factors are customer risk, product and service risk, geographic risk, channel risk, and transaction risk. Each can raise or lower the overall rating. The skill is weighing them together, since one high-risk factor does not automatically make a customer high risk, and low-risk factors do not cancel a serious red flag.
What is the difference between the risk-based and rules-based approach?
A rules-based approach applies fixed rules to everyone, which is simple but wastes effort and can miss new risk. A risk-based approach matches controls to assessed risk, which focuses effort but needs judgment and documentation. Most regimes now expect a risk-based approach with rules setting a minimum floor.
What is simplified due diligence?
Simplified due diligence is the lighter set of checks applied to low-risk customers under the risk-based approach. It usually means basic identity verification and lighter ongoing monitoring. Firms can only use it where their risk assessment supports a low rating, and they must still watch for changes that would raise the risk.
How do you apply the risk-based approach?
Identify your money laundering risks, rate each as low, medium, or high, and write the assessment down. Apply controls that match the rating, from simplified checks to enhanced due diligence. Then monitor for change and update the assessment as the business shifts. The written reasoning is what makes it defensible.
What is enhanced due diligence in the risk-based approach?
Enhanced due diligence is the deeper set of checks applied to high-risk customers. It typically includes source-of-funds verification, senior management sign-off, and closer ongoing monitoring. Under the risk-based approach, high risk means more scrutiny rather than automatic refusal, so the customer can still be onboarded with the right controls.
Is the risk-based approach a legal requirement?
In most countries, yes. Because the FATF standard shapes AML law in more than 200 jurisdictions, the risk-based approach is written into national rules from the US to Singapore. Regulators expect firms to hold a documented risk assessment and to apply controls that match the risks it identifies.
What is a common mistake in the risk-based approach?
A common mistake is rating a customer without recording the reasoning, which does not satisfy an examiner. Others include never updating the risk assessment, treating high risk as automatic refusal, and ignoring the fact that low-risk customers can change over time. Documentation and review prevent most of these.
How does the risk-based approach relate to an AML program?
The risk-based approach is the principle that shapes an AML program. The written risk assessment sits underneath the program and decides how strong each control needs to be. Every element, from customer due diligence to monitoring, is set in proportion to the risks the assessment identifies.
Can a customer be refused under the risk-based approach?
A firm can decline or exit a customer, but the risk-based approach does not require it for high risk alone. High risk means applying more checks, not automatic refusal. Refusing whole categories of customers to avoid effort is called de-risking, and regulators discourage it because it can push activity into less transparent channels.
Who is responsible for the AML risk assessment?
The firm’s senior management owns the risk assessment, and the compliance officer usually prepares and maintains it. It must be documented, kept current, and available to the regulator. The assessment justifies the whole program, so responsibility for it sits at a senior level rather than with front-line staff alone.
Read more: our ultimate guides, whitepapers and templates
Related guides and resources to help you act on what you just read.
Last reviewed July 12, 2026 · 10 min read · Written for compliance and risk professionals · By the WhoWiki editorial team
Key takeaway: the risk-based approach means spending AML effort where the laundering risk is highest, and it is the foundation of the FATF standard.
