Risk-Based Approach

It means the law fixes which checks a firm must carry out and leaves the firm to decide how far to take each one. Article 20(2) of the Anti-Money Laundering Regulation (AMLR) puts it this way: obliged entities determine the extent of the due diligence measures on the basis of an individual analysis of the risks, having regard to the specific characteristics of the client and of the business relationship or occasional transaction.

The approach works in both directions. Where the firm identifies an increased risk, it must apply enhanced measures. Where it identifies lower risk, it may apply simplified ones. The first is a duty. The second is an option.

It is not a licence to do less. The recitals to the AMLR say the risk-based approach is not an unduly permissive option and that it involves evidence-based decision-making. The operative text backs this up: a firm must at all times be able to demonstrate to its supervisor that the measures it took are appropriate to the risks it identified (Article 20(4)).

Through a business-wide risk assessment, which comes before any individual client is assessed. Under Article 10 a firm must identify and assess the money laundering and terrorist financing risks it is exposed to, together with the risk that targeted financial sanctions are not implemented or are evaded. The effort is to be proportionate to the nature of the business, its risks, its complexity and its size.

The assessment draws on named inputs: the risk variables and risk factors in the annexes to the regulation, the EU-level and national risk assessments, publications by international standard setters, the Commission and AMLA, information from competent authorities, and information on the firm's own customer base. It must be documented, kept up to date and regularly reviewed. The compliance officer draws it up and the management body approves it. A firm must also assess the risks before it launches a new product, service or delivery channel.

The assessment then shapes the firm's rulebook. Article 9(1) requires internal policies, procedures and controls that are proportionate to the nature of the business, including its risks and complexity, and to the size of the firm. The subjects the policies must cover are the same for every firm. Their extent is not.

The AMLR gives three lists in its annexes, and each is described as non-exhaustive. Annex I sets out risk variables, the questions to ask about any client: what the customer and its beneficial owner do, their reputation and behaviour, and where they are based, what the product or service is for and how transparent it is, and how the relationship is conducted, for instance without meeting face to face.

Annexes II and III give factors that point to lower or higher risk. The table sets a few of them side by side.

The annexes speak of potentially lower and potentially higher risk. A factor is evidence to weigh, not a verdict. Article 20(3) set 10 July 2026 as the deadline for AMLA to issue guidelines on the risk variables and risk factors.

It places the client at one of three levels of customer due diligence: standard measures by default, simplified measures where the risk is low (Article 33) and enhanced measures where it is higher (Article 34). The firm's judgment has limits in both directions. The regulation names cases where enhanced measures always apply, whatever the firm's own analysis says (Article 34(1)), and simplified measures must stop in the situations listed in Article 33(5).

The analysis of one client does not stand alone. Article 20(2) requires it to take into account the firm's business-wide risk assessment, the risk variables in Annex I and the risk factors in Annexes II and III.

Yes. Article 40 of Directive (EU) 2024/1640 requires member states to make sure that supervisors apply a risk-based approach to supervision. Supervisors must base the frequency and intensity of their on-site, off-site and thematic supervision on the risk profile of each obliged entity and on the risks present in the member state. They draw up annual supervisory programmes.

This is where a firm's own work is tested. The business-wide risk assessment must be made available to supervisors on request (Article 10(2) of the AMLR), and a firm with a higher risk profile can expect closer attention.