In plain English
A risk-based approach means identifying and understanding the risks an institution faces, then applying stronger measures to higher risks and, where the law allows, simpler measures to lower risks. It is the foundation of modern AML and sanctions regimes.
It is not an excuse to do less. Supervisors expect the reasoning to be documented, applied consistently and reviewed as risks change.
Why it matters to a board
The board sets risk appetite and approves the framework. It should be able to explain why resources are where they are.
Common mistakes
- Using 'risk-based' to justify gaps without a documented rationale.
- Rating almost every customer as medium risk.
- Not revisiting the approach when products, customers or markets change.
What the standards and regulators say
- FATF Recommendations: international standards on combating money laundering and the financing of terrorism and proliferation
- UAE: Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation, and its executive regulations (Cabinet Resolution No. 134 of 2025)