Overview
Using FATF banking-sector guidance and the Federal Reserve’s July 2026 proposal as reference points, this series explains why banks are moving beyond checklist completion toward a risk-based feedback loop. It follows exposure assessment, proportionate CDD and monitoring, accountable judgment, and effectiveness testing, while preserving legal, capability, supervisory, and non-zero-failure limits.
Learning outcomes
- Risk-based AML/CFT does not remove controls; it aligns their intensity with the bank’s actual exposure.
- A risk assessment is a revisable model whose findings should change CDD, monitoring, staffing, technology, and oversight.
- Alerts need contextual analysis before reporting, but formed suspicions must be reported promptly under applicable requirements.
- Effectiveness depends on lawful design, current information, material implementation, independent challenge, and learning—not zero failures.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What does risk-based AML/CFT change for banks?
It requires banks to connect controls and resources to their identifiable ML/TF exposure instead of applying every procedure with equal intensity. Formal obligations remain, and higher-risk situations still require stronger mitigation.
How does an AML risk assessment guide a bank’s controls?
It guides controls by explaining how the bank could be misused, the potential impact, and where attention is most valuable. Those findings can shape CDD, monitoring, staffing, technology, and supervisory focus.
Who is accountable for risk-based AML judgment?
Accountability is shared: the board and senior management set direction and resources, the AML/CFT officer coordinates, staff provide information, compliance and audit test the program, and supervisors challenge its adequacy.
What limits flexibility in a risk-based AML program?
Flexibility remains bounded by applicable law, the duty to mitigate higher and lower risks, institutional capability, and supervisory challenge. The approach also cannot guarantee that every illicit transaction will be detected.