Step 2 - Defining a risk-based approach
Last updated: April 13, 2026
Learning objectives
By the end of this module, you will:
Understand what a risk-based approach to anti-money laundering means in practice,
How to apply it without historical data,
How to avoid over-engineering controls too early.
You’ll wrap up this module with the insights needed to demonstrate why your AML approach is the right fit for your business’s current stage.
Introduction: Why the risk-based approach matters
In our previous module, we talked about how one of the most common misunderstandings about AML is the belief that regulators expect fully mature programs from day one.
Another common mistake early-stage companies make is assuming regulators expect the same controls from every firm. This often leads to over-engineering, unnecessary friction, and compliance programs that are difficult to maintain.
In reality, modern AML regulation is built around a risk-based approach. This means your controls should be shaped by your actual risk exposure, not by a generic checklist.
This module will help you understand how regulators think about risk and how to apply that thinking to your own business, even if you do not yet have customers or transaction history.
Section 1: What a risk based approach means in practice
A risk-based approach means tailoring your AML controls to the level and type of financial crime risk your business faces.
Rather than treating all customers, products, and transactions the same, you assess where the risk is higher and apply stronger controls there. Lower risk areas are managed with simpler measures.
Regulators introduced this approach to encourage better judgment, not to reduce standards. They want firms to focus resources where they matter most and to explain why decisions were made.
Pause and reflect.
If you applied the same controls to every customer today, would you be able to explain why that was necessary?
Section 2: Setting a risk appetite without historical data
Early-stage companies often worry that they cannot take a risk-based approach because they lack data. Regulators do not expect perfect data. They expect thoughtful assumptions.
At this stage, your risk appetite is shaped by what you know about your business model. This includes:
The types of customers you plan to serve,
The products you offer,
The geographies you operate in,
The channels you use to onboard and transact.
A clear risk appetite statement explains what level of risk your business is willing to accept and what risks you intend to avoid altogether. It also signals how conservative or flexible your controls will be as you grow.
Your assumptions should be documented. Regulators are more comfortable with clearly stated assumptions than with undocumented decisions.
Section 3: Avoiding blanket high-risk classifications
A common compliance shortcut is to label entire customer groups or products as high risk without differentiation. While this may feel safer, it often creates unnecessary burden and weakens your ability to demonstrate proportionality.
Regulators generally prefer targeted controls over blanket classifications.
For example, not all customers in the same sector or geography carry the same level of risk. Context matters.
When you apply a high-risk label, you should be able to objectively explain what specific factors drove that decision and what additional controls are triggered as a result.
Pause and reflect.
If asked why a particular customer type is high risk, could you point to specific risk drivers rather than general labels?
Section 4: How regulators evaluate judgment and proportionality
When regulators review AML programs, they do not only look at outcomes. They look at reasoning.
They want to see that your controls align with your risk assessment and that your decisions are internally consistent. A simple control that is clearly justified is often preferable to a complex control that cannot be explained.
This is why documenting your rationale is the most critical step for an early-stage firm; you can see how this "reasoning-first" approach fits into the broader AML maturity curve here.
Proportionality is especially important for early-stage firms. Regulators understand constraints related to size, resources, and maturity. What they expect is a credible approach that can evolve.
Being able to explain why your controls are appropriate today and how they will scale tomorrow is a strong signal of regulatory readiness.
Section 5: Where to apply the risk based approach first
At this stage, you do not need to apply a risk-based approach everywhere at once. Focus on the areas regulators care about most early on.
This typically includes:
Customer onboarding,
Initial risk assessment,
Decisions about which customers or activities you will not support from the get-go.
Getting these foundations right makes later steps easier.
The next module will build on this by guiding you through how to document these decisions in a formal AML risk assessment.
Learning checkpoint: What good looks like after step 2
At the end of this module, you should be able to
Reflect on what a risk based approach means and why it is central to modern AML regulation.
Describe your current risk appetite, even if it is based on assumptions rather than data.
Explain why your controls are proportionate and how they reflect the risks you have identified.
If you can articulate your reasoning clearly and defend it logically, you are aligned with regulatory expectations at this stage.
Preparing for step 3
In the next module, you will take the concepts from this lesson and apply them directly by running your first business-wide AML risk assessment. This is where your assumptions become documented decisions.