Screening Glossary
What is a risk-based approach?
A risk-based approach means identifying and assessing the money-laundering, terrorist-financing and sanctions risks a firm faces, then allocating controls in proportion to them. It is not permission to do less; it is a requirement to justify the level chosen.
Updated
The risk-based approach is the organising principle of the FATF standards and of the EU framework, and OFAC applies the same logic in its compliance framework, which sets out management commitment, risk assessment, internal controls, testing and auditing, and training. Documenting why a given control level is appropriate is a higher bar than applying the same procedure to everyone, which is why firms that treat it as a shortcut usually end up doing the work twice.
What this workflow covers
- A written risk assessment drives customer risk tiers, screening cadence, thresholds, EDD triggers and review frequency.
- Revisit it when the business or the environment changes, not only on the anniversary of the last one.
- FATF criticises wholesale termination of customer categories: refusing a class of customers is not a risk-based decision, it is the absence of one.
- Targeted financial sanctions apply regardless of assessed risk. They are a legal prohibition, not a control you can dial down.
Compliance glossary
- Risk appetite
- The level and type of risk a firm's board has decided it is willing to accept in pursuit of its objectives, expressed in policy rather than left implicit.
- De-risking
- Terminating or refusing whole categories of customers to avoid risk rather than managing it; criticised by FATF as contrary to the risk-based approach.
- Internal controls
- The written policies, procedures and system configurations that put the risk assessment into practice.
Authoritative references
Questions
Frequently asked questions
Can we screen lower-risk customers less often?
You can vary the intensity of due diligence, but sanctions obligations are absolute and do not scale with risk. Most firms screen the entire book against sanctions at one cadence and vary the depth of due diligence and review instead.
What has to be in a sanctions compliance programme?
OFAC's framework sets out five components: management commitment, risk assessment, internal controls, testing and auditing, and training. FATF and EU rules describe equivalent elements for AML programmes more broadly.
How often do we redo the risk assessment?
At least annually in most policies, and whenever something material changes: a new product, a new market, an acquisition, a significant regulatory development, or a shift in the counterparty profile.
Start screening in minutes.
Choose a plan and start screening today.