Definition
The risk-based approach is the principle, set by FATF Recommendation 1, that countries and financial institutions should identify and assess their money laundering and terrorist financing risks and apply controls proportionate to those risks, focusing more resources on higher-risk customers, products and geographies and allowing simplified measures where risk is low.
How it works
An institution first conducts a business-wide risk assessment of its customers, products and services, delivery channels and geographies. It then designs controls (CDD levels, monitoring scenarios, screening, approvals) proportionate to the assessed risk, applies customer-level risk ratings, and periodically reassesses both the risks and the effectiveness of its controls. Higher risk triggers enhanced measures; lower risk can justify simplified ones.
Requirements by jurisdiction
FATF: February 2025 revisions to Recommendation 1 replaced "commensurate" with "proportionate," require countries to allow and encourage simplified measures in lower-risk scenarios, and state that non-face-to-face relationships are higher risk only where appropriate mitigation is absent.
US: BSA programs must be risk-based. FinCEN's April 2026 proposed rule would formally define an effective, risk-based AML/CFT program, require risk assessment processes covering products, services, channels, customers and geographies, and incorporate national AML/CFT priorities. It supersedes the 2024 proposal and is not yet final; FinCEN proposed a 12-month implementation period after any final rule.
EU: AMLR Article 10 requires a documented business-wide risk assessment from 10 July 2027, informed by the EU supranational and national risk assessments.
UK: Regulation 18 of the Money Laundering Regulations 2017 requires a written firm-wide risk assessment, and Regulation 19 requires risk-based policies and controls.
Common challenges
Risk assessments often become static documents disconnected from actual controls. Firms may over-apply controls to whole categories ("de-risking"), which FATF's financial inclusion work discourages, or struggle to evidence why lower-risk treatment is justified.
How teams handle it in practice
Teams maintain a living risk assessment that maps each inherent risk to specific controls and residual risk ratings, refresh it when products or markets change, and use data from monitoring and SAR outcomes to recalibrate. Customer risk scores are recalculated as new information arrives. Compliance platforms like Corsa can keep customer risk ratings dynamic so controls adjust as risk changes.
How Corsa helps:
Dynamic Risk Assessment →
Frequently asked questions
Does a risk-based approach mean fewer controls?
Not necessarily. It means controls match the risk: stronger measures for higher-risk areas and simplified measures where risk is demonstrably low, never where there is suspicion.
How often should a business-wide risk assessment be updated?
Regularly and whenever the business changes materially, such as new products, channels or markets. Rules generally require it to be documented and kept up to date.
What did FATF change in 2025?
FATF revised Recommendation 1 to emphasize proportionality and require that simplified measures be allowed and encouraged in lower-risk scenarios.
