< Back to Glossary

What is the Risk-Based Approach (RBA)?

Last updated: 23 October 2026

What Is the Risk-Based Approach (RBA)?

The risk-based approach (RBA) is the principle that anti-money laundering and counter-terrorist financing controls should be proportionate to the risks a firm faces. Instead of applying the same checks to every customer, institutions identify where money laundering, terrorist financing and sanctions risks are highest and focus resources there. The RBA is central to FATF Recommendation 1 and underpins AML regulation in the US, UK, EU and most other jurisdictions.

How does the risk-based approach work?

A risk-based AML program typically follows four steps.

  1. Identify risks across customers, products, services, delivery channels and geographies.
  2. Assess the likelihood and impact of each risk, usually through an enterprise-wide risk assessment and a customer risk rating.
  3. Mitigate by applying proportionate controls, such as simplified due diligence for lower-risk customers and enhanced due diligence for higher-risk ones.
  4. Monitor and review the controls and the risk assessment, and update them as risks change.

Where does the risk-based approach apply in AML?

Why do many risk-based programs fall short?

Most AML programs are risk-based in design but not in execution. Common limitations include:

  • Risk assessments completed once or twice a year, which become outdated quickly
  • Manual monitoring of typologies, advisories and enforcement actions, which doesn’t scale
  • Control changes that lag emerging threats by months
  • Silos between monitoring, screening, fraud and investigations

Regulators are also shifting their emphasis from whether a risk-based framework exists to whether it demonstrably works in practice. The Wolfsberg Group has published guidance on this theme.

What is the difference between a traditional and a continuous risk-based approach?

Comparison Traditional RBA Continuous risk alignment
Core question What is the risk level for this customer or product? How is the risk posture of this customer or product evolving?
Risk and threat definition Manual and ad hoc Dynamic definition and mapping
Risk factors, scenarios and parameters Static, reviewed periodically Recalibrated dynamically
Evidence for regulators A documented framework Near real-time proof that controls reflect current risk

How does AI support the risk-based approach?

Agentic AI can monitor threat sources continuously, translate them into risk insights, and recommend or apply control changes, with human review where an institution wants it. This supports continuous compliance and ties controls to current risk. It can also keep policy documentation aligned with how controls actually run. Read our whitepaper, Reengineering the Risk Based Approach, or watch the on-demand webinar Is the Risk-Based Approach Broken?

FAQs

Is the risk-based approach mandatory?
In most major jurisdictions, yes. FATF standards require countries and regulated firms to take a risk-based approach, and national laws build it into AML program requirements. See the FATF guidance.

What is the difference between a rules-based and a risk-based approach?
A rules-based approach applies the same fixed checks to everyone. A risk-based approach adjusts the level of checks to the level of risk.

Does a risk-based approach mean doing less?
No. It means concentrating effort where the risk is, not reducing overall rigor. Firms must still be able to justify and document how they calibrated their controls.

What is a risk assessment in AML?
It is the process of identifying and rating the money laundering, terrorist financing and sanctions risks a firm faces, and it is the starting point for the controls it applies.

For more, see anti-money laundering (AML).