What Risk-Based AML Actually Changes
Risk-based AML/CFT programs in banking are the subject here. The specific question is what changes when a bank organizes its anti-money-laundering and countering-the-financing-of-terrorism controls around its actual exposure rather than applying every procedure with the same intensity. Understanding that distinction helps a reader recognize the difference between lawful flexibility and weak compliance.
The answer begins with a simple rule: a bank should identify, assess, and understand the money-laundering and terrorist-financing risks it faces, then choose measures that are commensurate with those risks. This is the core of the risk-based approach, or RBA. It sounds modest, but it changes what counts as a good decision. A control is no longer judged only by whether it appears in the program. It is also judged by whether it addresses a risk the bank can explain, whether its strength matches that risk, and whether the bank can revise it when the facts change.
The symptom: the same task can hide different risks
A checklist mindset treats visible activity as a useful proxy for protection. If the bank collected identification documents, ran a screening process, trained employees, tested controls, and filed reports, the program can appear complete. Those activities are still important. They create the minimum structure through which a bank can know its customers, observe transactions, and demonstrate that responsibilities exist. The problem occurs when completion becomes the end of the reasoning.
A bank’s exposure does not come from its forms alone. It comes from the relationship between the bank’s business, customers, locations, delivery channels, and money movement. Two banks can therefore face different risks even when both perform the same visible tasks. A risk-based program asks whether each bank’s controls are reasonably suited to the exposure its own activities create, rather than treating procedural uniformity as the definition of effectiveness.
If two banks have different exposures, identical control intensity can fail in opposite directions. It can consume time on low-consequence activity while leaving a complex relationship underexamined. Or it can impose a heavy process on a narrow, lower-risk activity without producing better information. A list of tasks cannot make that allocation decision by itself. It must be connected to a reasoned view of risk.
The same problem can occur inside one bank. A bank may offer several ways to move money, serve customers with different ownership structures, and reach them through both face-to-face and remote channels. A single onboarding rule may be easy to administer, but it can hide the fact that the bank knows much less about one relationship than another. A risk-based program asks what uncertainty matters in this relationship and what additional information or scrutiny would reduce it. The answer might involve stronger verification, more information about the purpose of the relationship, or closer monitoring. It is not automatically a demand for every possible check.
This is why the RBA changes the meaning of proportionality. Proportionality is not simply a decision to make a process shorter. It is a relationship between the seriousness and plausibility of an exposure and the strength of the response. A bank that applies a light process should be able to explain the lower-risk facts that support it. A bank that applies a stronger process should be able to connect the additional work to a particular source of uncertainty or potential harm. In both cases, the reasoning should be visible to the people who operate, oversee, and examine the program.
The Financial Action Task Force (FATF) describes this reasoning as more than collecting qualitative and quantitative information. The assessment should analyze how identified threats affect the country, supervisor, or bank, including the likelihood of occurrence and the impact if the risk materializes. Risk categories such as low, medium, and high can help prioritize attention, but they are aids to understanding rather than a substitute for it. FATF does not require every bank to calculate a precise probability, in part because the volume of illicit transactions is not known well enough for such a calculation to be consistently meaningful.
A useful assessment therefore needs to answer two linked questions. First, what could make this bank vulnerable to misuse? Second, what would be the consequence if that vulnerability were exploited? The first question points toward the bank’s activities, customers, jurisdictions, channels, and transaction patterns. The second prevents the bank from treating every conceivable risk as equally urgent. Together they give the institution a basis for deciding where investigation, monitoring, staff time, and technology are most valuable. Without that connection, a risk category becomes another piece of paperwork rather than a reason for action.
This leads to the first important distinction. Risk-based AML/CFT is not a choice between “all controls” and “no controls.” It is a choice about how controls are designed and applied after the bank has identified the risk. In a higher-risk situation, the range, degree, frequency, or intensity of controls should become stronger. In a lower-risk situation, standard measures may be applied more lightly where the applicable legal framework permits. The direction of the relationship changes, but the obligation to mitigate does not disappear.
Nor is the RBA a promise of zero failure. FATF expressly recognizes that an institution may take all reasonable measures to identify and mitigate risks and still be used for money laundering or terrorist financing. That is not an excuse for carelessness. It is a realistic definition of what an effective program can control. A bank can be responsible for the quality of its risk understanding, decisions, implementation, and learning without being able to guarantee that no illicit transaction will pass through its systems.
The distinction matters when a program is evaluated after an incident. A single isolated event does not automatically prove that the entire control framework was unsound, especially if the bank’s controls were proportionate and the event did not reveal a material weakness. But the event may still be a signal that changes the bank’s understanding of a product, customer group, or monitoring rule. The risk-based approach makes room for that investigation. It does not make the incident irrelevant, and it does not permit the bank to use “risk judgment” to dismiss a pattern it has reason to examine.
The low-risk boundary works in the other direction. A lower assessment may justify lighter application of standard measures where the law allows it, but it does not remove the need for a basic understanding of the relationship or for controls that can detect meaningful change. A program that labels an activity low risk and then stops asking whether the label still fits is not demonstrating proportionality. It is replacing a rigid checklist with a rigid category. The point of the RBA is to make the response sensitive to evidence, including evidence that the original assessment was wrong.
Where discretion lives—and where it stops
The word “risk-based” can sound as though each bank is free to invent its own standard. That is not what the model means. The responsibility is distributed across three connected levels.
Countries and competent authorities establish the legal and regulatory environment. They identify national risks, decide which sectors and activities fall within the AML/CFT regime, and determine whether any narrowly defined low-risk exemptions or simplified measures are permitted. A bank’s own risk judgment cannot override those requirements. FATF’s banking-sector guidance is non-binding guidance, so its principles must be applied through the relevant national framework rather than treated as a replacement for it.
Supervisors then have to understand both the banking sector and individual banks. They may consider national risk assessments, typologies of illicit finance, feedback from a financial intelligence unit, prudential information, the fitness of management and the compliance function, information from other supervisors, and law-enforcement input. That understanding affects where supervisory resources go. Higher-risk banks or lines of business may receive more frequent reviews, more on-site work, or more intensive testing. Lower-risk areas may receive less supervisory attention, but covered institutions remain subject to supervision.
Risk-based supervision changes the examiner’s question. Instead of asking only whether a prescribed activity appears somewhere in the program, the supervisor asks whether the bank’s understanding of risk is credible and whether its controls are adequate for that understanding. The supervisor can combine off-site information with on-site testing, increase scrutiny when a new threat emerges, and use findings to revise the sector or bank profile. That is still supervision; it is a different allocation of supervisory effort.
Banks have the closest view of their own customers and operations, so they must assess their exposure and choose appropriate mitigation. This is where discretion has practical value. A bank may need to decide how much information to obtain, how robustly to verify it, how often to monitor a relationship, and where to place staff or technology. But the decision is not merely a preference. It should follow from the bank’s risk assessment, fit within law, and remain open to supervisory challenge.
The bank’s explanation also needs to survive contact with its own evidence. If staff repeatedly encounter information that does not fit the customer profile, if a control cannot cover an important activity, or if the bank cannot show why a lighter measure is lawful and appropriate, the decision deserves reconsideration. The RBA does not require the supervisor to prescribe a new design in advance; it requires the bank to make a defensible choice and respond when experience exposes its limits.
The division of responsibility can be shown as a chain of judgment rather than a ladder of permission:
The chain works only if its participants share enough understanding to evaluate one another. FATF says supervisors should recognize that not all banks will adopt identical AML/CFT controls. A difference may be justified by operational complexity or risk profile. At the same time, banks must understand that flexibility does not exempt them from effective controls. A supervisor should not simply impose a preferred design, but a bank should be able to show why its design is reasonable and how it operates in practice.
That is why capability is a limit on discretion. Risk-based decisions require accurate and timely information, skilled personnel, trustworthy staff, and technical capacity suited to the complexity of the bank’s operations. If a bank or an emerging banking sector cannot identify and manage ML/TF risk reliably, a more prescriptive approach may be appropriate until its experience and supervisory capability improve. Flexibility without the ability to use it well is not sophistication; it is an unmeasured risk.
Communication matters for the same reason. The RBA can produce different but defensible controls only when banks understand what their legal and regulatory obligations require and supervisors explain how they will judge risk-sensitive compliance. FATF calls for guidance and dialogue so supervisory actions are predictable, consistent, and proportionate. Multiple authorities should also coordinate their interpretations. Otherwise, inconsistent expectations can create confusion, regulatory arbitrage, or a race toward whichever interpretation appears least demanding.
The U.S. Federal Reserve’s July 2026 notice of proposed rulemaking illustrates how these ideas are being translated into a current supervisory debate. The proposal would require banks supervised by the Board to establish a risk-based set of internal policies, procedures, and controls reasonably designed to identify, assess, and document ML/TF risks and to mitigate them by directing more attention and resources toward higher-risk customers and activities. It would also place the bank’s risk-assessment processes at the center of that design. The proposal is not a final rule, but it makes the accountability logic clear: the bank retains judgment because it understands its own business, while examiners assess whether that judgment is informed by a reasonably designed process.
This is also why a risk label cannot be the final answer. Calling a customer, product, or activity “low risk” should not end the analysis. The bank still needs to explain the basis for the label, apply the required measures, monitor whether the activity remains consistent with the assessment, and respond if new information changes the picture. Calling something “high risk” is not enough either. The label has value only if it leads to stronger or more focused mitigation.
The same boundary applies to any risk category. A label should not end the analysis. The bank still needs a defensible basis for the label, the required controls, and a way to recognize when new information changes the picture. Simplifying a response merely because a category appears lower risk would replace one shortcut with another if the bank could not explain the decision within the applicable legal framework.
The essential change, then, is not that banks are allowed to do less. It is that they are expected to explain why their attention, resources, and controls are directed as they are. Higher risk should attract stronger effort. Lower risk may justify lighter application within the rules. Both conclusions must remain connected to evidence, capability, and supervision. The next unresolved issue is therefore the instrument at the center of the model: how a bank builds a risk assessment that can support those judgments instead of merely giving them a label.