What is a risk-based approach to AML?

Common AML risk factors

A proactive risk-based approach to AML relies on accurate risk assessment and there are distinct areas of risk that regulated industries need to focus on in that assessment.     

Individual risks

Governments are responsible for collecting and maintaining lists of high-risk individuals. These sanction lists typically include known fraudsters, money launders, terrorists, and also red-flagged ‘Politically Exposed Persons’ (PEPs) and their associates; individuals assessed as high-risk because of their influence and access to large funds.

Checking for high-risk individuals is a Know Your Customer (KYC) regulatory requirement.

Geographic risks

Governing bodies (such as HM Treasury in the United Kingdom) also compile assessments of the risk posed by geographic jurisdictions, flagging unsatisfactory money laundering and terrorist financing controls. Geography determines the laws, regulations, technology, security, data privacy and data accuracy of a business environment, so a proactive risk-based approach to AML needs to take account of the market-specific risk present for a product or service.

Channel risks

The way a product or service is taken to market can affect the risk. In an increasingly digital economy, internet-mediated sales of a product and services carry an inherent risk of identity fraud without a suitably robust digital identity verification and authentication process in place. Meanwhile, third-party services or payments associated with product or service delivery can increase the assessment of risk associated with a transaction.

“A proactive risk-based approach to AML relies on accurate risk assessment and there are distinct areas of risk that regulated industries need to focus on in that assessment.” 

 
Transaction risks

There are a variety of indicators that might red-flag an individual transaction as higher risk.

An unusually large transaction or unusual activity that seems to sit outside normal commercial activities might represent a risk factor. Transactions that are complex in nature or involve payment type (cash or cryptocurrency) or routing of payments may also be assessed as higher risk.

How to implement a risk-based approach to AML

Managing a risk-based approach to AML is like managing any other risks in your business.  For example, a health and safety risk management cycle in a factory would typically include identifying and assessing hazards, establishing procedures for safely controlling those dangers, reviewing and reporting on the controls in place.  A piece of machinery or manufacturing process may present higher risk of injury; this doesn’t mean that the manufacturer cannot use it, it means that the factory must maintain tight controls over its use to operate safely.

A risk-based approach to AML follows a similar process and the same logic.

1. Identifying business risks

To identify AML risk, a business must first conduct a review of its product or service portfolio, reflecting common AML risk factors and its own size and complexity, for example,

• Customers: what do you know about the type of customers for your service?
• Geography: what is the exposure of the target markets to financial crime?
• Delivery channel: how will the product or service be delivered to the customer?
• Industry: how advanced are the regulations governing your industry?
• Monetary value: does your product or service have a high monetary value?
• Regulatory controls: how advanced are the regulations in the industry?
• Product / service: how much monetary value can be gained?
• Market: what is the exposure of the market to financial crime?
• Process controls: how well do you document and follow your processes as a business?

2. Assessment of the risks

Central to a risk-based approach to AML is an assessment of a product or service’s exposure to risks occurring and the potential impact. Using a table of risk factors for each product, a business can begin by assigning an ‘unknown’ level of risk until review allows the assignment of ‘low’, ‘medium’ or ‘high’, or the deployment of effective mitigation policies or procedures helps adjust the risk level.

The FATF guide to National money laundering and terrorist financing risk assessment shows how to rank risks using a simple matrix.

3. Implement policies mitigating risks

Once assessment is complete, a risk-based approach shifts to policies and implementation of solutions to mitigate risks. These should ensure that the right level of scrutiny is applied; a balance that pivots towards security for high risks and towards minimising customer friction for low risks.

Anti-Money Laundering technology

Managing and mitigating risk is likely to include an orchestrated combination of solutions and processes to cover different business activities and activity risk profiles. There are a lot of AML tools out there, the best of which will automate risk-assessment for new customers and new transactions in real time.

The key Anti-Money Laundering technologies breakdown into two key categories.

Know your customer

Know your customer (KYC) refers to the customer due diligence (CDD) and enhanced due diligence (EDD) that regulated companies carry out to ensure their customers are genuine and do not pose an individual risk to the business at the point of onboarding and as part of continuous monitoring during the business relationship.

In an increasingly digital economy, solutions for digital identity verification and identity proofing are always advancing. These technologies can assess whether an identity is genuine and whether the person presenting it is the legitimate owner. They can also assess the risk or reputation of that identity based on past activities and continue to review risk with ongoing monitoring, helping a business to know its customers.  

Transaction monitoring

The process of monitoring a customer's transactions such as transfers, deposits and withdrawals is known as transaction monitoring.  Transaction monitoring solutions are designed to mitigate the risk of money laundering, monitoring digital transactions across all business channels for suspicious behaviour which could indicate money laundering occurring and preventing it before it occurs.

The cost of these solutions to the business is a consideration but one which needs to be weighed against the potential cost of fraudulent activity, fines and reputational damage.

Businesses also need to balance risk mitigation with customer experience when deploying Anti-Money Laundering technologies, flexibly adapting controls for the level of risk an individual customer or transaction is assessed to represent to the business. Speed and convenience matter as much as security for services that inspire trust. Not every customer journey needs to take the most secure route and unnecessary friction that causes prospective customers or transactions to drop should be dialled down.  

“Central to a risk-based approach to AML is an assessment of a product or service’s exposure to risks occurring and the potential impact.” 

Frequently asked questions

What is Anti-Money Laundering?

Anti-Money Laundering (AML) refers to a wide set of laws and regulations mandating steps that financial institutions and other regulated industries must take to prevent criminals from laundering money. These regulations are designed to ‘counter the financing of terrorism’ (CFT) and other illicit activities. Regulated business must not knowingly or unknowingly aid these activities.

What is a risk-based AML assessment?

Central to a risk-based approach to AML is an assessment of a product or service’s exposure to individual customer, geographic, channel, transaction or other risk factors occurring. The level (low, medium or high) of that risk and the potential impact on the business is assessed so that mitigating policies and procedures can be devised and implemented.

Where can I find industry-specific guidance to risk-based AML?

Many of the national and international AML regulatory bodies, produce industry-specific guidance for a risk-based approach to AML around the world. FATF publishes recommendations and risk-based guidance for several industries; including accountancy services, banking, cryptocurrencies, legal and real estate services. Professional bodies representing highly regulated industries also produce industry-specific guidance.

What is Know Your Customer?

Know your customer (KYC) refers to the customer due diligence (CDD) and enhanced due diligence (EDD) that regulated companies carry out to ensure their customers are genuine and do not pose an individual risk to the business at the point of onboarding and as part of continuous monitoring during the business relationship.