Risk-Based Approach to AML: Moving Beyond Tick-Box Compliance

The risk-based approach is the cornerstone of the FATF framework. It is also the element that regulated businesses most consistently get wrong.

The principle is straightforward: countries, authorities, and businesses must identify, assess, and understand their money laundering and terrorist financing risks, then take mitigation measures proportionate to those risks. Higher risks demand enhanced measures. Lower risks permit simplified measures. Resources are allocated where they matter most, not spread uniformly across every customer and transaction.

In theory, this produces efficient, proportionate compliance. In practice, many businesses default to one of two extremes. Over-implementation — applying maximum controls to every customer regardless of risk, generating mountains of documentation that no one reads and false positive alerts that clog investigation queues. Or under-implementation — conducting a surface-level risk assessment, documenting it in a policy manual, and treating it as a one-time exercise that never informs operational decisions.

Both extremes fail the test. Regulators in 2026 are increasingly focused not on whether a risk-based approach exists on paper, but on whether it works in practice. Does the risk assessment actually drive the control framework? Are resources concentrated where risks are highest? Can the business explain — with evidence — why a particular customer received simplified due diligence rather than enhanced? Can it demonstrate that its transaction monitoring rules are calibrated to the risks it has identified, not to generic industry templates?

The practical barriers are real. Legacy systems lack the flexibility to implement graduated controls. Data quality issues compromise risk scoring. Compliance teams are stretched thin, making risk-based judgments feel like a luxury when the priority is simply keeping up with volume. False positive backlogs — often exceeding 90% in traditional AML monitoring systems — drain resources that could be directed toward genuine risk.

But the regulatory direction is clear. The FATF's own guidance acknowledges that the greatest impediments to financial inclusion stem from inadequate implementation of the risk-based approach — businesses that de-risk entire categories of customers rather than assessing individual risk. Over-cautious "gold-plating" — applying the maximum measure in every case — is explicitly identified as a problem, not a solution.

Moving beyond tick-box compliance requires three things. First, a risk assessment that is genuinely tailored to the business model — not a generic template rebranded with the company name. Second, controls that are graduated and proportionate — where the intensity of CDD, monitoring, and reporting reflects the actual risk, not a uniform standard. Third, documentation that connects the risk assessment to operational decisions — evidence that the framework drives behaviour, not just policy.

At Kybri Consulting Limited, we help regulated businesses design and implement risk-based AML frameworks that work in practice — from business-specific risk assessments through to control calibration, monitoring design, and regulatory demonstration.