What is the risk-based approach to AML, and how do firms identify their risks?

Money laundering and terrorist financing risk is not spread evenly. Some customers, countries, services and financial instruments carry more of it than others. The risk-based approach accepts that and asks the firm to concentrate its effort where the risk appears higher, applying stronger controls there and lighter ones where the risk is lower, so that resources go where they are most needed.

It is not a licence to ignore low-risk business. Every customer still goes through CDD, and every transaction can still be suspicious. What changes with risk is the depth of the checks, the frequency of reviews and the intensity of monitoring.

CySEC's AML Directive adds that the approach lets the board treat customers differently according to the risk of their business, shape policies to the firm's own circumstances, and build a more cost-effective system.

Every obliged entity must have policies, controls and procedures, proportionate to its nature and size, to mitigate and manage its money laundering and terrorist financing risks. It must take appropriate steps to identify and assess those risks, considering at least its customers, countries or geographical areas, products, services, transactions and delivery channels. The assessment must be documented, kept up to date and made available to the supervisor, and senior management must approve the policies and controls.

For CySEC-supervised firms, the approach has four parts: identifying and assessing the risks; documenting the policies, measures, procedures and controls in the risk management and procedures manual so that people appointed by the board apply them uniformly; managing and mitigating the assessed risks with effective controls; and continuously monitoring and improving how those controls work. The firm must always be able to show CySEC that its measures are proportionate to the risks it faces.

Risk assessment has two distinct but linked steps: identifying the risks, then assessing them. The firm first works out which risks it would take on by accepting a customer or carrying out a one-off transaction, looking at who the customer is, where it operates, what it wants and how it is being served. Only then can it judge how serious those risks are.

The work runs at two levels. A business-wide risk assessment shows where the firm's risks lie overall. For each customer, CDD then gathers enough information to identify every relevant risk factor, including terrorist financing factors, and to weigh them together in a holistic view of that relationship. Monitoring afterwards checks that transactions still fit what the firm knows about the customer and its risk.

The starting point is the information the firm gathers during initial CDD, together with its own knowledge and professional expertise. The EBA guidelines add sources that firms should always consider: the EU's supranational risk assessment, the European Commission's list of high-risk third countries, Cyprus's national risk assessment, guidance from regulators and typologies from financial intelligence units. CySEC's Directive also tells the compliance officer to consult information from the FATF, MONEYVAL, the EU and UN sanctions bodies, IMOLIN and the IMF, and firms can add reliable open sources such as reputable newspapers. Open sources count only if they are credible and reliable; unverified forums, blogs or rumours do not meet that test.

From 1 January 2020 the European Banking Authority (EBA) led, coordinated and monitored AML/CFT work across the EU financial sector, including its ML/TF Risk Factors Guidelines, which list factors for all firms and for specific sectors such as wealth management, investment firms and investment funds.

On 1 January 2026 the EBA's AML/CFT mandate passed to the new EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA). The EBA's existing AML/CFT guidelines, including the Risk Factors Guidelines, stay in force until AMLA replaces them.