Every financial crime control has three effects. It costs money to run. It prevents, or fails to prevent, a loss. And it changes the experience of the customers it touches. A transaction monitoring threshold, a screening rule or an onboarding requirement sits somewhere on each of these lines, whether or not anyone has decided where.
The risk based approach asks institutions to make those choices deliberately. Boards and supervisors increasingly expect to see that the choices have been made on evidence, recorded and kept under review. This article sets out what regulators now expect, why institutions find the balance difficult, and how it can be explained to a board and to a supervisor.
Proportionality is now the standard
In February 2025 the Financial Action Task Force amended Recommendation 1 and its Interpretive Note. The word "commensurate" was replaced with "proportionate", defined as "a measure or action that appropriately corresponds to the level of identified risk and effectively mitigates the risks". Countries must now allow and encourage simplified measures in lower risk scenarios. Supervisors must also take into account the risk mitigation that institutions already apply, "to avoid overcompliance resulting from an only partial understanding of associated risks". In June 2025 FATF followed with revised guidance on financial inclusion, which calls for a proportionate and risk based approach that considers the risks of financial exclusion.
Proportionality works in both directions. The FATF assessment methodology states that risk, materiality and context "should not be an excuse for poor or uneven implementation". A simplified measure is defensible only where the lower risk has been identified and documented.
Industry bodies and other regulators have moved in the same direction. The Wolfsberg Group's July 2025 Statement on the Risk-Based Approach says that "an FI should prioritise attention on, and the allocation of resources to, higher risk customers and activities". In the United States, FinCEN proposed a rule on 7 April 2026 under which institutions would "direct more attention and resources toward higher-risk customers and activities". For banks, enforcement over the maintenance of a program would be limited to "a significant or systemic failure to implement an effective AML/CFT program".
The UAE position
The UAE National AML/CFT/CPF Strategy 2024 to 2027 focuses on the pillars of risk based compliance, effectiveness and sustainability.
Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025 and replaced the 2018 law. Penalties for legal persons now range from AED 5 million to AED 100 million, or the equivalent value of the criminal property if greater. The regime continues to follow a risk based approach, and the implementing regulations define senior management to include board members.
On 16 April 2026 the Central Bank of the UAE published Best Practices on Implementing a Risk-Based Approach and Conducting Risk-Based Institutional Risk Assessments. The manual explains how to apply "counter-measures proportionate to the scale and nature of the identified risks". It sits alongside the CBUAE guidance on transaction monitoring and sanctions screening of September 2021, which calls for "a well-calibrated risk-based framework", "active oversight by their board", and "independent testing, validation, and auditing" of the systems and their models.
In ADGM, the FSRA wrote to Senior Executive Officers in October 2025 after a thematic review of virtual asset service providers. It found that some business risk assessments were generic and that some customer risk assessment methodologies were not adequately documented, and observed that "Without a detailed assessment, BRAs cannot effectively guide the allocation of resources".
The message across these sources is consistent. Controls should follow risk. The board is accountable for how they are set. The institution must be able to show why.
Three pressures on one program
Cost. LexisNexis Risk Solutions puts the cost of financial crime compliance in EMEA at USD 85 billion, with costs rising for 98 percent of financial institutions in 2023. The most cited driver, named by 35 percent of respondents, was the escalation of financial crime regulations and regulatory expectations. Labor is the largest component of that spend, which means that every unproductive alert and every manual review has a direct cost.
Loss. Loss includes fraud borne by the institution and its customers, and the regulatory, legal and reputational consequences of a money laundering or sanctions failure. Controls reduce loss only when they are directed at the exposures that matter. The UK offers a recent example of how moving one lever moves the others. An independent evaluation for the Payment Systems Regulator, published in July 2026, found that after mandatory reimbursement for authorized push payment scams was introduced, losses within its scope were on average around 21 percent lower per month, about GBP 73 million a year. Losses to international scams, which fall outside the scheme, rose from GBP 21 million in 2023 to GBP 60 million in 2025, which the evaluators said could indicate some displacement. They also found that stronger controls "appear to have increased payment friction in some cases, but there is limited evidence of material wider consumer or business harm".
Customer outcomes. When the cost of managing a customer segment appears to exceed its value, the easiest response is to exit it. The US Treasury's 2023 De-risking Strategy found that "profitability is the primary factor in financial institutions' de-risking decisions", and that profitability is influenced by the cost of implementing AML/CFT compliance measures. The effect is visible in correspondent banking. CPMI data show that the number of active correspondents in Western Asia, the region that includes the GCC states, fell by 34.7 percent between 2011 and 2022. Supervisors also look at the treatment of individual customers. In its July 2024 review of politically exposed persons, the UK FCA asked firms to "ensure that information requests are proportionate to those risks" and to explain the reasons for their actions where possible.
Each pressure pulls against the others. Lower alert volumes reduce cost but may allow more loss to go undetected. Tighter onboarding reduces loss but adds friction and may exclude legitimate customers. Exiting a segment reduces cost and perceived risk, but it harms customers and sits uneasily with the FATF emphasis on proportionate measures and the risks of financial exclusion.
Why the balance is hard to strike
Asymmetric incentives. A missed suspicious transaction can lead to enforcement. An unnecessary alert, a delayed onboarding or a closed account rarely does. Controls are therefore easier to add than to remove. The Wolfsberg Group's Demonstrating Effectiveness paper observes that expectations which do not produce highly useful information or materially prevent crime are "often counterproductive to an effective AML/CTF programme".
Generic risk assessments. A risk assessment that does not distinguish between products, channels, customer segments and geographies cannot tell management where to spend more or where to simplify. This is the weakness the FSRA identified.
Fragmented measurement. Compliance cost, fraud loss and customer friction are often owned by different functions and reported to different committees. Where they are measured separately, the choices between them are made implicitly rather than by the board.
Data and evidence. Calibration depends on reliable data. Without it, and without documented testing, an institution cannot show that a change to a scenario or threshold has not opened a gap, so settings stay as they are long after the risk has moved.
Displacement. Criminal activity moves to the channel with the weakest control. A measure that performs well in isolation may simply move the loss elsewhere, as the UK evaluation suggests.
Articulating the balance to the board and to supervisors
In our view, five practices allow a board to own the balance and a supervisor to test it.
- Start from a risk assessment that drives allocation. The institutional risk assessment should show where inherent risk is highest and where it is lower, by product, channel, customer segment and geography, so that resources and simplified measures follow from it and can be traced back to it.
- State the appetite for all three dimensions. A financial crime risk appetite statement usually expresses tolerance for residual risk. It should also set the level of loss the institution is prepared to accept by product, and the customer outcomes it is not prepared to accept, such as onboarding times or exit rates in a given segment. The board can then approve choices rather than only receive reports.
- Report a small set of measures for each dimension. For cost, alert volumes and conversion rates, backlogs and cost per case. For loss, fraud losses and recoveries by product and channel, and the quality of suspicious transaction reporting. For customers, onboarding times, legitimate activity declined or delayed, complaints and account exits by segment. Trends over time say more than any single figure.
- Treat calibration as a governed decision. Tuning, segmentation and threshold changes should be supported by testing, approved at the right level and recorded with the reasons and the residual risk accepted. Independent validation confirms that the evidence holds. Where fraud and AML controls act on the same customers and payments, the effect on both should be assessed together.
- Engage supervisors with evidence. FATF now requires supervisors to take account of the mitigation an institution has applied. An institution that can show its risk assessment, its appetite, its measures and its decisions is well placed to explain why a control was simplified, retained or strengthened.
"Ultimately, each FI should be able to demonstrate effectiveness by telling its unique story, based on its risks and corresponding AML/CTF programme."
The Wolfsberg Group, Demonstrating Effectiveness
Questions for the board
- Does our risk assessment tell management where to spend more and where to simplify?
- Has the board approved tolerances for loss and for customer impact, as well as for residual risk?
- Do we see cost, loss and customer outcomes in one report?
- Can we evidence the reasons for our current thresholds and for the last changes made to them?
- Could we explain these choices to our supervisor today?
A risk based program is a set of choices about where to accept cost, where to accept residual risk and where to accept friction. Institutions that make those choices openly, measure their effects and record their reasons are better placed to satisfy their boards and supervisors and to treat their customers fairly. Kompass advises boards and compliance leaders on calibrating that balance and evidencing it.