Risk-Based Approach to AML: Practical Guide for UK Firms
In brief: A risk-based approach means applying stronger AML controls where the risk is higher and proportionate controls where the risk is lower, with a written rationale either way.
Key points
- The risk-based approach is not a reason to do less work without evidence.
- It should connect client risk, service risk, geography, delivery channel, and transaction facts.
- The file should explain why the firm chose simplified, standard, or enhanced measures.
What is a risk-based approach to AML?
A risk-based approach to AML means the firm applies controls in proportion to the money laundering and terrorist financing risk. Higher-risk clients or matters need deeper checks, stronger evidence, more senior review, and more frequent monitoring. Lower-risk work may justify lighter measures, but only if the rationale is recorded.
The UK Money Laundering Regulations require firms to identify and assess risk and apply customer due diligence measures. The legislation is available at legislation.gov.uk.
The risk factors to consider
For a UK accountancy or law firm, risk usually comes from a mix of:
- Client type and behaviour.
- Ownership and control.
- Services provided.
- Source of funds and source of wealth.
- Geography and sanctions exposure.
- Delivery channel, such as remote onboarding.
- Transaction size, urgency, and complexity.
- Previous concerns or adverse information.
How the approach works in practice
| Risk level | Typical response |
|---|---|
| Lower risk | Standard checks, concise rationale, normal review cycle. |
| Medium risk | More evidence, clearer review notes, defined triggers. |
| Higher risk | Enhanced due diligence, senior approval, stronger source-of-funds/source-of-wealth checks, closer monitoring. |
The file should show why the decision was reasonable at the time.
What good evidence looks like
A strong risk-based file explains:
- What risk factors were considered.
- Which factors increased or reduced risk.
- What evidence was reviewed.
- Which due diligence level was selected.
- Who approved higher-risk work.
- When the risk rating will be reviewed.
Common failure mode
The common failure is treating the risk-based approach as a label. "Client is low risk" is not enough. A reviewer should be able to see why the firm reached that conclusion and what would cause it to change.
Official reference
This guide is general information and is not legal advice.