Sectoral Risk Assessments and the Risk-Based Approach

1. Why This Topic Matters

The risk-based approach (RBA) is the foundation of the entire modern anti-money laundering and counter-terrorist financing (AML/CFT) framework. FATF Recommendation 1 requires countries, supervisors and financial institutions to identify, assess and understand their money laundering and terrorist financing (ML/TF) risks and to apply measures that are proportionate to those risks. Sectoral risk assessments are the bridge between a country's National Risk Assessment (NRA) and the enterprise-wide risk assessment performed by an individual institution. If you do not understand how risk flows from the national level, through the sector, down to the business and the customer, you will struggle with a large portion of CAMS questions on compliance programme design, customer due diligence (CDD), enhanced due diligence (EDD) and supervisory expectations.

In practical terms, the RBA matters because:
- Resources are finite. Applying the same controls to every customer wastes effort on low-risk relationships and under-protects against high-risk ones.
- Regulators and FATF evaluators judge institutions and countries on how well risk understanding is translated into controls.
- A documented, defensible risk assessment is the first thing examiners ask for and the first thing criticised in enforcement actions.
- Sectoral assessments allow policymakers to see that, for example, money service businesses, casinos, real estate agents or virtual asset service providers face very different threats and vulnerabilities than retail banks, and to calibrate obligations accordingly.

2. What It Is

2.1 The Risk-Based Approach
The RBA is a methodology in which the intensity of AML/CFT measures is driven by the level of assessed ML/TF risk. Higher risk requires enhanced measures; lower risk permits simplified measures, provided the law allows it and the lower risk is demonstrated. The opposite of the RBA is the rules-based or tick-box approach, in which identical, prescriptive controls are applied regardless of risk.

Key principles of the RBA:
- Identify the risks the country, sector or institution is exposed to.
- Assess the likelihood and impact of those risks.
- Understand how the risks arise and interact.
- Mitigate through proportionate policies, procedures and controls.
- Monitor and review on an ongoing basis, because risk is dynamic.

2.2 Levels of Risk Assessment
Risk assessments are conducted at several nested levels:
- Supranational: for example the European Commission's Supranational Risk Assessment (SNRA) covering the EU internal market.
- National Risk Assessment (NRA): a country-wide exercise, usually coordinated by the ministry of finance, FIU or a dedicated committee, identifying the main threats (criminal proceeds, predicate offences, terrorist financing typologies) and vulnerabilities (weak sectors, gaps in supervision, cash intensity, corruption). FATF Recommendation 1 and its Interpretive Note require countries to perform NRAs and keep them up to date.
- Sectoral Risk Assessment: a focused assessment of a specific industry or category of obliged entities, such as banking, securities, insurance, money or value transfer services (MVTS), casinos and gaming, dealers in precious metals and stones, lawyers and notaries, accountants, trust and company service providers (TCSPs), real estate, and virtual asset service providers (VASPs). It identifies the products, services, delivery channels, customer types and geographic exposures that make that sector attractive to criminals.
- Institutional or Enterprise-Wide Risk Assessment (EWRA): the assessment each financial institution or designated non-financial business and profession (DNFBP) must perform of its own inherent risk, control effectiveness and residual risk.
- Customer Risk Assessment: the rating of individual customers or relationships, which drives CDD intensity and transaction monitoring thresholds.

2.3 Who Produces Sectoral Risk Assessments?
Sectoral assessments are typically produced by national authorities (treasuries, FIUs, supervisors), by FATF in its sector-specific RBA guidance papers, by regional bodies such as FATF-style regional bodies (FSRBs), and by industry associations. FATF has published RBA guidance for the banking sector, securities sector, life insurance, MVTS, casinos, legal professionals, accountants, TCSPs, real estate, dealers in precious metals and stones, prepaid cards and mobile payments, and virtual assets. Supervisors frequently publish their own sector-specific guidance that institutions are expected to consider in their EWRA.

2.4 Core Risk Categories
Across all levels of assessment, risk is analysed through consistent lenses:
- Customer risk: politically exposed persons (PEPs), cash-intensive businesses, shell companies, complex ownership structures, non-resident customers, non-profit organisations with high-risk exposure.
- Product and service risk: private banking, correspondent banking, trade finance, wire transfers, prepaid cards, bearer instruments, trust formation, crypto-to-fiat exchange.
- Geographic risk: jurisdictions on FATF lists, sanctioned countries, high corruption, tax havens, conflict zones, drug-producing or transit regions.
- Delivery channel risk: non-face-to-face onboarding, intermediaries and introducers, agents, online platforms.
- Transaction risk: volume, velocity, cross-border nature, use of cash or anonymising technology.

2.5 Key Terminology
- Threat: a person, group or activity with the potential to cause harm (e.g., drug traffickers, corrupt officials, terrorist financiers).
- Vulnerability: a weakness that can be exploited (e.g., anonymity of a product, weak supervision, high cash usage).
- Consequence: the impact if the risk materialises (financial loss, reputational harm, damage to the integrity of the financial system, funding of terrorism).
- Inherent risk: the level of risk before controls are considered.
- Control effectiveness: how well existing mitigants reduce inherent risk.
- Residual risk: the risk remaining after controls are applied. Institutions decide whether residual risk is within their risk appetite.
- Risk appetite: the amount and type of risk the board is willing to accept in pursuit of its objectives.
- Proportionality: controls commensurate with risk, not excessive and not deficient.
- De-risking: wholesale termination or avoidance of entire customer categories to avoid rather than manage risk. FATF explicitly states de-risking is not consistent with the RBA.

3. How It Works

3.1 The Flow from National to Sector to Institution
1. The country completes its NRA, identifying, for example, that real estate and MVTS are high-vulnerability sectors because of cash, foreign buyers and limited supervisory coverage.
2. The relevant supervisor produces a sectoral risk assessment and guidance, highlighting red flags, high-risk products and expectations for mitigation in that sector.
3. Each obliged entity in the sector incorporates the NRA and sectoral findings into its own EWRA. If the national assessment rates a product as high risk, the institution is expected to either justify a different conclusion or apply enhanced controls.
4. The EWRA informs policies, risk appetite statements, customer risk-rating models, transaction monitoring scenarios, training and resourcing.
5. Customer-level risk ratings drive the application of standard CDD, simplified due diligence (SDD) or EDD, as well as the frequency of periodic reviews.
6. Results feed back upward: suspicious activity reports (SARs/STRs), supervisory findings and typologies inform the next iteration of sectoral and national assessments.

3.2 Conducting a Sectoral Risk Assessment
A sectoral assessment typically follows these steps:
- Scoping: define the sector, its size, number of participants, transaction volumes and economic importance.
- Threat analysis: review law enforcement cases, FIU statistics, STR trends and typologies to understand which criminal actors use the sector.
- Vulnerability analysis: examine products, customer base, cross-border exposure, cash intensity, quality of supervision, level of compliance culture and availability of beneficial ownership information.
- Consequence analysis: consider the scale of harm if the sector is abused.
- Rating and prioritisation: assign risk levels (often low, medium-low, medium, medium-high, high) to sub-sectors, products or activities.
- Mitigation recommendations: propose regulatory changes, supervisory focus areas, guidance and outreach.
- Publication and communication: share findings with the private sector so firms can align their own assessments. Public-private partnerships (PPPs) often support this exchange.
- Review: update periodically and when material changes occur, such as new technology, new legislation or emerging typologies.

3.3 Applying the RBA Inside an Institution
- Governance: the board approves the risk appetite and the EWRA methodology; senior management owns implementation; the compliance officer coordinates; internal audit tests independently.
- Methodology: scoring models combine likelihood and impact across risk categories. Both quantitative data (transaction volumes, customer counts by jurisdiction) and qualitative judgement are used.
- Control mapping: each identified risk is linked to specific mitigants such as CDD standards, screening, monitoring rules, limits and training.
- Differentiated due diligence: SDD for demonstrably low-risk situations (where permitted), standard CDD for normal risk, EDD for high risk including PEPs, correspondent banking, high-risk jurisdictions and complex or unusually large transactions with no apparent lawful purpose.
- Documentation: the rationale for every risk rating and control decision must be recorded so that it can be explained to a supervisor.
- Ongoing review: the EWRA is refreshed at least annually and whenever trigger events occur, such as entering new markets, launching new products, mergers or significant regulatory change.

3.4 Benefits and Challenges
Benefits: efficient use of resources, better detection of genuine suspicion, flexibility to adapt to new threats, alignment with international standards, and the ability to demonstrate a reasoned compliance posture.
Challenges: subjectivity in risk judgements, data quality limitations, inconsistency between institutions, the temptation to de-risk, regulatory uncertainty where supervisors still behave in a rules-based manner, and the need for skilled staff to exercise judgement.

3.5 Supervision Under the RBA
FATF Recommendation 26 and 28 require supervisors themselves to adopt a risk-based approach, allocating inspection frequency and intensity according to the risk profile of institutions and sectors. Sectoral risk assessments are a primary input to supervisory planning.

4. How to Answer Exam Questions on This Topic

CAMS questions on this subject are rarely pure definitions. They tend to present a scenario and ask what a compliance officer, institution or supervisor should do, or ask which statement best reflects the RBA. The exam rewards candidates who think in terms of proportionality, documentation, and risk understanding rather than rigid rules.

Exam Tips: Answering Questions on Sectoral Risk Assessments and the Risk-Based Approach

Tip 1: Always choose the proportionate option. If an answer applies maximum controls to everyone, or minimal controls to everyone, it is almost certainly wrong. The RBA answer calibrates measures to assessed risk.

Tip 2: Risk assessment comes first. When a question asks what an institution should do first when launching a product, entering a new market or building a programme, the answer is usually to conduct or update the risk assessment before designing controls.

Tip 3: Know the hierarchy. Supranational, national, sectoral, institutional, customer. Questions may ask how an institution should use the NRA or sectoral findings: the correct answer is to incorporate them into the EWRA and adjust controls, not to ignore them and not to copy them blindly without considering the firm's own profile.

Tip 4: Distinguish threat, vulnerability and consequence. A criminal group is a threat; an anonymous product is a vulnerability; damage to financial integrity is a consequence. Questions may test whether you can classify these correctly.

Tip 5: Inherent versus residual risk. Inherent risk ignores controls; residual risk is what remains after controls. If a question describes risk before any mitigation, it is inherent. The institution compares residual risk against its risk appetite.

Tip 6: De-risking is not the RBA. If an option proposes exiting an entire category of customers (all MSBs, all charities, all correspondent relationships from a region) simply to avoid risk, FATF considers this inconsistent with the RBA. The better answer manages risk on a case-by-case basis with EDD.

Tip 7: Simplified due diligence has conditions. SDD is permitted only where lower risk has been identified and the law allows it, and never where there is suspicion of ML/TF or where specific high-risk scenarios apply.

Tip 8: The RBA is dynamic. Answers describing a one-time assessment that is never updated are wrong. Look for options mentioning periodic review and trigger-based updates.

Tip 9: Documentation and rationale matter. Supervisors expect institutions to explain and evidence why a risk was rated as it was. An answer that includes documenting the methodology and rationale is usually preferred.

Tip 10: Watch for sector-specific red flags. Expect scenarios involving casinos (chip purchases with minimal play), real estate (cash purchases through companies), MVTS (structured remittances), TCSPs (layered ownership), lawyers (client accounts used as pass-through), and VASPs (mixers, privacy coins). Recognise that each sector has its own typologies and that sectoral guidance addresses them.

Tip 11: Supervisors also use the RBA. Questions may ask how a regulator should allocate examination resources; the answer is according to the risk profile of sectors and institutions, informed by the NRA and sectoral assessments.

Tip 12: Eliminate absolutes. Words such as always, never, all and none frequently signal incorrect answers in RBA questions, because the RBA is inherently about judgement and gradation.

Tip 13: Board and senior management ownership. If the question concerns who is ultimately responsible for approving the risk appetite or the risk assessment framework, the answer points to the board or senior management, with the compliance officer responsible for execution and reporting.

Tip 14: Read for the stem's real question. Many scenarios include distracting detail. Ask yourself: is this testing identification of risk, design of proportionate controls, governance, or the relationship between national and institutional assessments? Match your answer to that purpose.

5. Quick Revision Summary
- FATF Recommendation 1 mandates the RBA at country, supervisor and institution level.
- Risk assessments cascade: supranational, national, sectoral, institutional, customer.
- Sectoral assessments identify sector-specific threats and vulnerabilities and inform both supervisors and obliged entities.
- Core risk factors: customer, product or service, geography, delivery channel, transaction.
- Inherent risk minus control effectiveness equals residual risk, compared to risk appetite.
- Higher risk requires EDD; demonstrably lower risk may permit SDD where legally allowed.
- The RBA is proportionate, documented, dynamic and owned by senior management.
- De-risking and tick-box compliance are the antithesis of the RBA.

Mastering these principles will allow you to reason through unfamiliar scenario questions with confidence, because nearly every correct CAMS answer in this domain is the one that best reflects proportionate, well-documented, risk-informed decision making.