The Risk-Based Approach and Proportionate Controls

Why This Topic Matters
The risk-based approach (RBA) is the foundation of modern anti-financial crime (AFC) compliance and one of the most heavily tested concepts on the CAMS exam. The Financial Action Task Force (FATF) made the RBA central to its Recommendations in 2012 (Recommendation 1), and virtually every national regulator, including FinCEN, the FCA, MAS and the EU under its AML Directives, requires institutions to identify, assess and understand their money laundering and terrorist financing (ML/TF) risks and to apply controls that are proportionate to those risks. Understanding this concept is essential because it explains why compliance programs are designed the way they are and how limited compliance resources should be allocated. Exam questions on governance, customer due diligence (CDD), transaction monitoring and sanctions all ultimately connect back to the RBA.

What the Risk-Based Approach Is
The risk-based approach is a methodology under which an institution identifies the ML/TF and sanctions risks it faces, assesses their likelihood and potential impact, and then applies preventive and detective measures that are commensurate with the level of risk. It replaces the older rules-based (or "one-size-fits-all") model, in which the same controls were applied to every customer and transaction regardless of risk.

Key principles of the RBA include:
• Risk identification – recognising the inherent risks arising from customers, products and services, delivery channels, geographies, and transactions.
• Risk assessment – measuring the likelihood and impact of those risks, usually through an enterprise-wide risk assessment (EWRA).
• Risk mitigation – designing controls (policies, procedures, systems, training) whose intensity matches the assessed risk.
• Residual risk – the risk that remains after controls are applied; it should fall within the institution's board-approved risk appetite.
• Proportionality – higher-risk areas receive enhanced measures; lower-risk areas may receive simplified measures, provided the regulator permits it and the low-risk conclusion is documented.
• Dynamic review – risk assessments and controls are refreshed as the business, customer base, threat environment and regulation change.

What Proportionate Controls Mean
Proportionate controls are AML/CFT measures scaled to the level of risk. Examples:
• Customer due diligence: Simplified due diligence (SDD) for low-risk customers such as regulated financial institutions or listed companies in equivalent jurisdictions; standard CDD for most customers; Enhanced due diligence (EDD) for high-risk customers such as politically exposed persons (PEPs), correspondent banking relationships, cash-intensive businesses and customers in high-risk jurisdictions.
• Transaction monitoring: Tighter scenario thresholds and more frequent review for high-risk segments; wider thresholds for low-risk segments.
• Periodic review: High-risk customers refreshed annually (or more often), medium-risk every two to three years, low-risk every three to five years.
• Approval levels: Senior management sign-off required to onboard or retain high-risk relationships.
• Resource allocation: More investigators, more audit coverage and more training focused on high-risk business lines.

Importantly, proportionality works in both directions. Applying excessive controls to low-risk customers wastes resources and can lead to de-risking (wholesale exit of entire customer categories), which FATF discourages because it pushes activity into less transparent channels and harms financial inclusion.

How the Risk-Based Approach Works in Practice
Step 1 – Identify inherent risk. The institution catalogues its risk factors across the main categories:
• Customer risk: PEPs, non-resident customers, complex ownership structures, shell companies, cash-intensive businesses, non-profit organisations, money service businesses.
• Product/service risk: private banking, correspondent banking, trade finance, prepaid cards, virtual assets, wire transfers, products permitting anonymity.
• Geographic risk: FATF-listed jurisdictions, countries subject to sanctions, high corruption indices, tax havens, conflict zones.
• Delivery channel risk: non-face-to-face onboarding, use of intermediaries or introducers, online-only services.

Step 2 – Assess likelihood and impact. Each factor is rated (for example, low / medium / high) and weighted. The output is an inherent risk rating for each business unit, product and customer.

Step 3 – Evaluate control effectiveness. The institution assesses the design and operating effectiveness of existing controls (KYC, screening, monitoring, training, governance, independent testing).

Step 4 – Determine residual risk. Inherent risk minus control effectiveness equals residual risk. Where residual risk exceeds appetite, controls must be strengthened or the business exited.

Step 5 – Document and approve. The EWRA and resulting risk appetite statement are documented, approved by the board or senior management, and used to drive the AML program design.

Step 6 – Monitor and update. Triggers for reassessment include new products, mergers, entry into new markets, regulatory changes, audit findings, enforcement actions in the industry and emerging typologies.

Governance Dimension
Under AFC program governance, the board is accountable for setting the risk appetite and ensuring the RBA is properly resourced. Senior management implements it, the compliance function (second line) designs and oversees controls, the business (first line) owns the risk day-to-day, and internal audit (third line) independently tests whether the RBA is working. The RBA must be supported by a culture of compliance and clear tone from the top. Regulators expect the institution to be able to explain and evidence its risk-based decisions; a decision is defensible if it is documented, reasoned and consistent with the approved methodology, even if a bad actor later slips through.

Common Pitfalls
• Treating the RBA as a reason to do less everywhere, rather than to do more where it matters.
• Static risk ratings that are never refreshed after onboarding.
• Failing to link the EWRA to actual control design (the "paper exercise" problem).
• Applying SDD without regulatory permission or without documenting the low-risk rationale.
• Blanket de-risking instead of case-by-case risk management.
• Ignoring sanctions, bribery and fraud risk in an assessment that focuses only on money laundering.

Exam Tips: Answering Questions on The Risk-Based Approach and Proportionate Controls

1. Look for the word "proportionate" or "commensurate." When a question asks for the best course of action, the correct answer almost always matches the intensity of the control to the level of risk. Options that apply the same measure to every customer ("all customers," "every transaction") are usually distractors reflecting a rules-based mindset.

2. Recognise the four classic risk categories. CAMS questions frequently test whether you can classify a scenario as customer, product/service, geographic or delivery-channel risk. Learn examples of each, and remember that risk factors combine: a PEP (customer) using private banking (product) in a high-risk jurisdiction (geography) onboarded remotely (channel) is extremely high risk.

3. Know the sequence. Identify → Assess → Mitigate → Monitor/Review. Questions that ask "what should the institution do first" typically want risk identification or completion of a risk assessment before controls are designed.

4. Inherent vs. residual risk. Be clear that inherent risk exists before controls, residual risk is what remains after controls, and the goal is residual risk within appetite. If a scenario says controls are weak, residual risk is close to inherent risk.

5. Enhanced measures for high-risk relationships. Expect questions on PEPs, correspondent banking, high-risk jurisdictions and complex structures. The correct answer usually involves EDD: source of wealth/funds, senior management approval, enhanced ongoing monitoring, and more frequent reviews. Remember that identifying a PEP triggers EDD but does not automatically require rejection.

6. Simplified measures have limits. SDD is acceptable only where the risk is genuinely low, the regulator permits it, and the rationale is documented. SDD is never permitted where there is suspicion of ML/TF.

7. De-risking is not the risk-based approach. If an answer option suggests exiting an entire category of customers (for example, all money service businesses or all charities) to avoid risk, it is usually wrong. FATF expects case-by-case management of risk, not wholesale avoidance.

8. Documentation and defensibility. When asked what will best satisfy a regulator or examiner, prefer answers that involve a documented, board-approved risk assessment that demonstrably drives the control framework.

9. Governance roles. Tie the RBA to the three lines model: the board sets appetite and oversees; senior management implements; compliance advises and monitors; internal audit independently tests. Questions asking who is ultimately accountable for the AML program and its risk appetite point to the board of directors.

10. Triggers for reassessment. New products, new markets, mergers and acquisitions, regulatory changes and significant audit or examination findings should all prompt an updated risk assessment. An answer that says "the risk assessment was completed three years ago and does not need updating" is a distractor.

11. Read for the "most appropriate" qualifier. Several options may be technically correct; choose the one that best reflects proportionality, documentation and alignment with FATF Recommendation 1 and the institution's own risk appetite.

12. Avoid absolutes. Options containing "always," "never," "all" or "must reject" are rarely consistent with a risk-based philosophy, which is inherently judgement-based and flexible.

Summary
The risk-based approach requires institutions to understand their ML/TF and sanctions exposure and to apply controls in proportion to that exposure, concentrating resources where risk is highest while avoiding unnecessary burdens where risk is low. For the CAMS exam, master the four risk categories, the inherent/residual risk distinction, the EDD/SDD spectrum, the governance accountability chain and the principle that controls must be documented, dynamic and defensible. When in doubt, choose the answer that matches control intensity to risk level and that can be evidenced to a regulator.