Due Diligence

Risk-Based Approach (RBA)

The risk-based approach (RBA) is the principle, set out in FATF Recommendation 1, that countries identify, assess and understand their money laundering and terrorist financing risks and apply measures proportionate to them, and that firms identify and assess their own risks and take risk-based action to mitigate them. For a firm it means two things: a documented assessment of the risks the business faces, and controls, including the depth of customer due diligence, that become stronger where risk is higher and may be simplified, where the rules allow, where risk is lower.

See Customer Risk Assessment Back to Glossary

The RBA is the reason two investors in the same fund can go through different levels of checks. It does not remove the core obligations a firm must meet. It decides how far each control goes, and it makes the firm responsible for showing why. FATF calls it "an effective way to combat money laundering and terrorist financing" and says it allows firms to "allocate their own resources in the most effective way" (Interpretive Note to Recommendation 1, para 1).

The two levels of risk assessment

In practice the RBA works at two levels. The Hong Kong SFC Guideline names them clearly (para 2.1):

Institutional (business-wide) risk assessment. How, and to what extent, the firm as a whole is exposed to money laundering and terrorist financing (para 2.2), given its customers, markets, products and channels. It shapes the firm's policies, procedures and controls.
Customer risk assessment. The risk of a particular customer or proposed relationship, which sets the degree, frequency or extent of CDD and ongoing monitoring. The SFC says firms may do this by assigning a risk rating to each customer (para 2.16).

For a fund manager, the first is the enterprise-wide assessment reviewed by the board or senior management. The second is the investor risk rating decided at onboarding and revisited at each review.

The four risk factors

FATF lists the same factors that national rules repeat: customers; countries or geographic areas; products, services and transactions; and delivery channels (Interpretive Note to Recommendation 1, para 12). FATF also says firms "should consider all the relevant risk factors before determining what is the level of overall risk" (para 16).

Risk factor	What it covers	Examples for a fund manager (our illustrations)
Customer	Who the customer and its beneficial owners are, and how they are structured	A listed pension fund versus a newly formed holding company owned through a trust; an investor who is a politically exposed person
Country or geographic area	Where the customer is from or operates, and where the firm itself operates	Investors resident in, or paying from, higher-risk countries; beneficial owners in countries with weak beneficial ownership transparency
Products, services and transactions	How the product can be used to move or hide money	Open-ended funds with frequent dealing versus closed-ended funds with capital calls; transfers of interests; redemptions to third parties
Delivery channels	How the relationship is established and serviced	Non-face-to-face onboarding; subscriptions through nominees, platforms or distributors; reliance on third parties for CDD

How regulators write it into the rules

The wording varies, but the structure is the same: assess, document, keep up to date, control, and scale the controls to the risk.

Source	What it requires
FATF (Recommendation 1 and its Interpretive Note, paras 12 to 16)	Financial institutions should identify and assess ML/TF risks for customers, countries or geographic areas, products, services, transactions and delivery channels; document the assessment and keep it up to date; have senior-management-approved controls; apply enhanced measures where risk is higher; and may be allowed to apply simplified measures where risk is lower
Singapore (MAS Notice SFA04-N02, paras 4.1 to 4.3)	Capital markets intermediaries must identify, assess and understand their ML/TF risks in relation to customers, the countries their customers are from or in, the countries where they operate, and products, services, transactions and delivery channels; document and update the assessment; adopt senior-management-approved controls; and perform enhanced measures where higher risks are identified
Hong Kong (SFC AML/CFT Guideline, Chapter 2)	An institutional risk assessment, documented (para 2.10), approved by senior management (para 2.11) and reviewed at least every two years, or more often after trigger events with a material impact (para 2.9), plus a customer risk assessment that sets the degree, frequency or extent of CDD and ongoing monitoring (para 2.1)
United Kingdom (Money Laundering Regulations 2017, regs 18 and 19)	Appropriate steps, taking account of the size and nature of the business, to identify and assess risks, including those relating to customers, countries or geographic areas, products or services, transactions and delivery channels, with an up-to-date written record (reg 18); and proportionate policies, controls and procedures approved by senior management (reg 19)
Cayman Islands (Anti-Money Laundering Regulations (2025 Revision), reg 8)	Steps appropriate to the nature and size of the business to identify, assess and understand ML, TF and PF risks; a documented, up-to-date assessment; senior-management-approved controls; and enhanced CDD where higher ML or TF risks are identified
Luxembourg (CSSF Regulation 12-02, Article 5)	Every customer is categorised by risk level, assessed before the customer is accepted and updated during the relationship; the risk assessment cannot be used to avoid enhanced due diligence where the law requires it

What the risk-based approach does not allow

Skipping the core CDD steps. FATF Recommendation 10 says firms should be required to apply each CDD measure, with the extent set using the RBA.
Simplified measures where there is suspicion. FATF says simplified measures "should not be permitted whenever there is a suspicion of money laundering or terrorist financing" (Interpretive Note to Recommendation 1, para 2).
Risk-based sanctions compliance. FATF says the targeted financial sanctions obligations in Recommendation 7 "are not risk-based". Risk-based measures for proliferation financing are there to support full compliance with those obligations, not to replace it (para 3).
Avoiding mandatory enhanced due diligence. Where the law sets enhanced due diligence for a situation, a lower internal rating does not remove it. CSSF Regulation 12-02 says this expressly (Article 5(3)).
Undocumented judgments. The SFC expects firms to keep records showing how they assessed a customer's risk and why the extent of CDD and monitoring fits it (para 2.18).

Applying the RBA in a fund: an illustration

A manager runs a closed-ended private equity fund. Its business-wide assessment identifies higher risk from investors who subscribe through holding companies with layered ownership, and from investors linked to higher-risk countries. Its customer risk methodology therefore rates a regulated pension fund investing in its own name as lower risk, so the manager applies the checks its rules require, which may be simplified where those rules allow. A new investment holding company owned through a discretionary trust, with a beneficial owner who is a foreign politically exposed person, is rated high risk and gets enhanced due diligence: senior management approval, source of wealth and source of funds checks, and more frequent reviews. The Cayman Islands Monetary Authority's guidance for mutual funds says investors rated low "may be subject to SDD procedures" (a low rating is valid only if it is consistent with the national risk assessment or the supervisor's findings), those rated medium "may be subject to normal CDD procedures", and those rated high "must be subject to EDD procedures" (Guidance Notes, Part VI, Section 1, mutual funds, section D, para 5).

Keeping the assessment current

A risk assessment is not a one-off document. MAS and FATF require it to be kept up to date. The SFC sets a review at least every two years, or sooner after trigger events such as new customer segments, new products or a significant control breach (para 2.9). At customer level, the UK regulations require customer due diligence on existing customers at appropriate times on a risk-based approach and when circumstances relevant to the customer's risk assessment change, taking into account, for example, any indication that the identity of the customer or its beneficial owner has changed (reg 27(8) and (9)). CSSF Regulation 12-02 says the customer's risk level must be assessed before acceptance and adapted to any significant change during the relationship (Article 5(4)).

Key points

Set out in FATF Recommendation 1 and its Interpretive Note; national rules in Singapore, Hong Kong, the UK, the Cayman Islands and Luxembourg follow the same structure
Works at two levels: a business-wide risk assessment and a customer risk assessment
Four risk factors: customers; countries or geographic areas; products, services and transactions; delivery channels
Higher risk requires enhanced measures; lower risk may allow simplified measures where the rules permit, but never when there is suspicion
Targeted financial sanctions obligations are not risk-based; the assessment must be documented and kept up to date, and the controls approved by senior management

How One Constellation helps

One Constellation gives fund managers, administrators and transfer agents a SaaS AML/KYC platform with customer risk assessment, identity verification, KYB and beneficial-owner records, sanctions, PEP and adverse-media screening, transaction monitoring, and case management with STR/SAR workflows. Your risk methodology and decisions stay with your compliance team.

Explore Customer Risk Assessment

Frequently asked

What is the risk-based approach in AML?+

It is the principle in FATF Recommendation 1 that firms identify and assess their money laundering and terrorist financing risks and take risk-based action to mitigate them: enhanced measures where risks are higher, and simplified measures, where permitted, where risks are lower.

What are the four risk factors in a risk-based approach?+

Customers; countries or geographic areas; products, services and transactions; and delivery channels. FATF lists them in the Interpretive Note to Recommendation 1, and MAS, the SFC, the UK regulations and the Cayman regulations use the same factors.

Does a risk-based approach mean low-risk customers need no KYC?+

No. FATF Recommendation 10 says firms should be required to apply each CDD measure; the risk-based approach sets how far each goes. Simplified measures are allowed only where the applicable rules permit them, and never where there is a suspicion of money laundering or terrorist financing.

Is sanctions screening risk-based?+

The obligation to comply with targeted financial sanctions is not. FATF says the Recommendation 7 obligations "are not risk-based". In the context of proliferation financing, FATF says risk-based measures reinforce and complement full compliance by detecting and preventing breaches or evasion; they do not replace it.

How often should a firm review its AML risk assessment?+

The rules say it must be kept up to date. The Hong Kong SFC sets a review at least every two years, or sooner after trigger events such as new products, new customer segments or a significant control breach. Other rules require the assessment to be kept up to date and new risks, such as those from new products or technologies, to be assessed as they arise.

What is the difference between a business-wide and a customer risk assessment?+

A business-wide (institutional) risk assessment looks at the firm's overall exposure and shapes its policies and controls. A customer risk assessment rates an individual customer or relationship and sets the level of CDD and ongoing monitoring for that customer.

Sources

This entry is general information, not legal advice. Check the current text with the regulator before relying on it. Sources read on 9 November 2026.

Apply Your Risk Methodology Consistently

Rate customers and investors, scale due diligence to the risk, and keep the evidence in one place, with a SaaS AML/KYC platform built for regulated firms.

Book a Demo Explore Customer Risk Assessment