Why AML Is Moving Beyond the Checklist
This series examines risk-based anti-money laundering and countering the financing of terrorism (AML/CFT) programs in banks: how they identify exposure, decide where attention belongs, and turn what they learn into useful action. The immediate question is why a system built around completed tasks, forms, and reports is giving way to a model organized around risk. The practical value of answering it is larger than understanding a change in vocabulary. It gives readers a way to tell the difference between a bank that merely documents compliance and one that has designed a program to recognize the particular ways its business could be misused.
The change is not a rejection of rules. It is a change in what the rules are meant to accomplish.
The program behind the checklist
A bank’s AML/CFT program is often easiest to see through its visible parts: customer identification, transaction monitoring, staff training, suspicious-activity reports, independent testing, and written policies. Those parts matter. They create duties, evidence, and points of accountability. But they can also create a misleading picture of success. A bank may be able to show that a form was completed or that a report was filed without showing that its controls were aimed at the risks most likely to arise from its customers, products, locations, and ways of delivering services.
That is the problem the risk-based approach is designed to address. In its banking-sector guidance, the Financial Action Task Force (FATF) defines the approach through a sequence: countries, authorities, and financial institutions identify, assess, and understand the money-laundering and terrorist-financing risks to which they are exposed, then apply measures commensurate with those risks. An assessment is therefore not an archive of facts. It is supposed to change what the institution does.
The difference can be made concrete without imagining that any control is optional. Consider two banks. One is a small institution with a narrow local footprint and a relatively limited range of products. The other provides wealth-management and correspondent services across several jurisdictions. The second bank may face more complicated ownership structures, more cross-border exposure, and less direct knowledge of the people behind transactions. Treating both institutions as successful only when they use the same procedures with the same intensity would make uniformity the goal. A risk-based program asks a different question: are each bank’s controls reasonably suited to the risks its own business creates?
This does not make the smaller bank “safe” by definition, nor does it make the larger bank suspicious by definition. It means that risk is a property of a relationship between an institution and its activities, not a label attached permanently to an institution type. A checklist can record whether a control exists. Risk-based AML/CFT asks whether the control is pointed at the right exposure, whether its intensity is defensible, and whether the bank changes it when the exposure changes.
The Federal Reserve’s July 2026 notice of proposed rulemaking makes this distinction unusually explicit for banks it supervises. The proposal describes a modernization effort intended to produce highly useful information about illicit financial transactions for law enforcement and national-security agencies. It also describes a historical U.S. framework built around individual reporting mechanisms and older technology assumptions, even as financial institutions now operate more sophisticated systems. The proposed answer is not to discard reporting or other formal elements. It is to connect them to a risk-based set of policies, procedures, and controls that is reasonably designed to achieve the purposes of the Bank Secrecy Act.
That status matters. The Federal Reserve document is a proposal, not a final rule and not a universal statement of global law. Still, it is useful evidence of the direction of supervisory thinking: a program should be judged by how its parts work together to address material risks, not by whether every institution resembles an abstract template.
Why useful information matters to more than the compliance team
A bank does not control illicit finance by looking inward only. Its risk assessment depends on information about threats, customers, transactions, and the wider environment. Its reports are valuable only when they help public authorities understand and act on illicit activity. Its supervisor needs enough information to decide where examination time is most needed. Risk-based AML/CFT is therefore an institutional relationship, not simply a workflow inside a compliance department.
At the national level, competent authorities establish the legal and regulatory setting, identify broader risks, and communicate information that banks may need to consider. Supervisors then form a view of risk across the banking sector and within individual banks. FATF says that supervisors should draw on national risk assessments, typologies, financial-intelligence-unit feedback, prudential information, management and compliance fitness, and information from other supervisors or law enforcement. They should use that understanding to allocate more supervisory resources to higher-risk areas.
The bank has a different but connected responsibility. It must understand its own exposure and decide how to mitigate it within the applicable legal framework. A supervisor does not replace that judgment with a single preferred control design. Nor can a bank treat its own judgment as beyond challenge. The relationship works only when the bank can explain why its controls fit its risk profile and the supervisor can test that explanation against evidence.
This is why the goal of “useful information” changes the meaning of a report. A suspicious-activity report is not valuable merely because it exists in a database. The broader system needs information that helps law enforcement and national-security agencies identify patterns, connect activity, and prioritize attention. The 2026 proposal links AML modernization to more routine coordination, communication, and feedback among financial institutions, regulators, and law enforcement. FATF makes a related point from the bank’s side: accurate, timely, and objective information about ML/TF risk is a prerequisite for an effective risk-based approach. Without it, a bank may fail before it reaches the stage of choosing a control.
The result is a feedback loop. External intelligence can change a bank’s understanding of its exposure. That understanding can change where the bank assigns people, technology, review time, and management attention. Monitoring and reporting then generate new information about what is happening in practice. Supervisory findings and law-enforcement feedback can expose a weakness or refine the risk picture. The bank should be able to learn from those signals rather than treating its original assessment as permanent.
A checklist is not incapable of supporting this loop. A customer record, a monitoring rule, or an audit finding can all supply useful evidence. The problem arises when the visible completion of the task becomes the endpoint. The risk-based model treats the task as one component in a continuing decision: what does this information reveal, what should change, and how can the bank demonstrate that the response was proportionate?
Proportionality is not permission to do less
The most important boundary is also the easiest to lose. Risk-based AML/CFT does not mean that low-risk situations require no controls. FATF says that all relevant parties still have to mitigate ML/TF risk when it is assessed as low, although the degree, frequency, or intensity of controls may be lighter where the legal framework permits. In higher-risk situations, the response should become stronger. More information may need to be obtained, verification may need to use more robust sources, and monitoring may need to be more frequent or more hands-on.
The approach is also not a promise of zero failure. FATF expressly recognizes that a bank may take all reasonable measures to identify and mitigate risk and still be used for money laundering or terrorist financing. That admission is not a retreat from effectiveness. It establishes a more realistic test. The question is not whether an institution can guarantee that no illicit transaction will pass through it. The question is whether it understood the risks it faced, selected measures that were reasonably related to those risks, implemented them consistently, and learned when evidence showed that the model needed revision.
This distinction protects against two opposite mistakes. The first is false uniformity: assuming that every bank must use the same controls in the same way, even when their activities and exposures differ. The second is defensive minimalism: calling a program risk-based whenever it does less, without demonstrating why less is justified. FATF warns that financial institutions need skilled and trusted personnel, suitable systems, and access to reliable information. Where a banking sector or institution cannot manage discretion effectively, a more prescriptive approach may be appropriate until its capability improves.
The same logic explains why financial inclusion cannot be handled through a shortcut. FATF cautions that financial exclusion does not automatically mean lower ML/TF risk. A person or business may be excluded for many reasons, including a poor credit rating or criminal background. At the same time, a carefully supported risk-based approach can allow more flexible due diligence for particular lower-risk products or customers and can bring financial flows into a regulated system where they are more visible and traceable. The sound decision is neither to simplify checks for an entire category nor to deny service to an entire category. It is to assess the relationship and the evidence.
The Federal Reserve proposal supplies a second boundary: a risk-based program has to remain current. For Board-supervised banks, the proposal would distinguish between establishing an AML/CFT program and maintaining it. Establishing concerns the design of a reasonably designed program. Maintaining means implementing that program in all material respects. A bank that launches a new product, enters a new geography, changes its customer base, adopts new mitigation technology, or grows through a merger may encounter risks that its former controls did not address. If the bank knows, or has reason to know, that its risk profile has changed significantly, a static assessment may no longer support a reasonably designed program.
That is the central reason AML is moving beyond the checklist. The issue is not that checklists are always bad or that rules have become optional. The issue is that a fixed list cannot by itself decide whether the bank is looking in the right places, spending attention wisely, or responding to new information. A risk-based program keeps the formal foundations but makes their purpose visible: understand the bank’s exposure, direct effort toward the most consequential risks, produce information others can use, and revise the system when reality changes.
This series will therefore treat risk-based AML/CFT as a discipline of judgment under constraints. Its success cannot be measured by identical procedures or perfect detection. It must be considered through the relationship between risk assessment, proportionate controls, information, governance, and supervision—and through the legal limits that keep flexibility from becoming neglect.