Closing the AML Gap in Risk-Based Monitoring

How Does Risk-Based Monitoring Work in AML?

Risk-based monitoring in Anti-Money Laundering (AML) directs compliance resources to customers, transactions, and activities that present higher money laundering or terrorist financing risk. Instead of putting every user through the same workflow, companies assess and route customers to the appropriate verification step based on the risk level.

There are typically four broad risk factors that compliance teams consider:

• Customer and third-party risk: The risks associated with customers and other parties.
• Produkt- und Servicerisiko: The risks associated with the products and services a firm provides.
• Risiken im Vertriebskanal: Risks arising from how an organization delivers its products and services.
• Geographic risk: Risks associated with the jurisdictions connected to a customer or service.

A practical risk-based monitoring framework usually includes Customer Due Diligence (CDD), ongoing monitoring, customer risk assessments, and Enhanced Due Diligence (EDD) when we find higher risks. A well-designed risk-based AML approach can improve the effectiveness of financial crime controls by focusing compliance resources where they are most needed.

However, firms should not treat it as a one-time exercise. Customer risk can evolve as circumstances, transactions, ownership structures, or geographic exposure change, so continuous monitoring is necessary. The goal is not just to create alerts, but to detect and respond to potential risks effectively.

Risk Assessment vs Transaction Monitoring

It is critical to differentiate between customer risk assessment and transaction monitoring. Customer risk assessments consider a customer’s characteristics and activities to assess the level of financial crime risk they present. These risks determine the required levels of CDD, EDD, and ongoing monitoring. Transaction monitoring, by contrast, analyzes transactional activity against scenarios, thresholds, behavioral indicators, and other relevant signals. Compliance teams should integrate the two processes into an overall risk-based AML framework.

Regulatory Drivers Behind a Risk-Based Approach

Regulators rely on a risk-based approach as a fundamental principle of modern financial crime compliance. For instance, the Financial Action Task Force (FATF) Recommendation 1 requires firms to identify, assess, and mitigate money laundering and terrorist financing risks proportionately.

Risk-based monitoring can vary across regulatory agencies, but the direction is consistent:

• Financial Crimes Enforcement Network (FinCEN): In the US, financial institutions are recommended to implement a risikobasierter Ansatz to CDD, including understanding customer relationships and conducting ongoing monitoring to identify and report suspicious activity.
• Financial Transactions and Reports Analysis Center of Canada (FINTRAC): Firms must assess customer risk and apply enhanced measures to high-risk situations. This can include more frequent monitoring and updates to customer information.
• Monetary Authority of Singapore (MAS): Financial institutions must conduct ongoing monitoring of business relationships and scrutinize transactions against their knowledge of the customer, with enhanced measures where higher risks are identified.
• Financial Conduct Authority (FCA) and HM Treasury: Firms subject to the UK Money Laundering Regulations must conduct Risikobewertungen and maintain policies, controls, and procedures proportionate to their money laundering and terrorist financing risks.

The Consequences of Weak Risk-Based Monitoring

Regulators are increasingly assessing how effective risk-based monitoring is, not just whether a firm has an AML monitoring system. A weak risk-based framework can face unintended consequences. Compliance teams may become overwhelmed by false positives, genuine risks can slip through the cracks, and firms can face financial penalties.

For example, in 2024, the UK FCA fined Metro Bank £16.7 million over failures relating to its automated transaction-monitoring system. The FCA said the bank failed to adequately monitor approximately 60 million transactions with a total value exceeding £51 billion. 

Firms are expected to know their risk exposure.

A control can be on paper and still ineffective. Solutions Consultant at ComplyCube, Milosh Caunhye notes, “The expectation is that firms know what their risk exposure is, build their monitoring around that risk, and test to see if those controls actually work.”

Key Challenges in Executing Risk-Based Monitoring

For many organizations, the challenge is not defining a risk-based AML model. It is turning that model into a risk assessment that applies consistently. Compliance teams can spend a lot of time manually translating policies into risk scores, pulling data from different systems, and determining what the resulting risk rating means for the customer.

The organization might document the risk-based monitoring methodology well. At the same time, the information required to apply those rules is dispersed across Kennen Sie Ihren Kunden (KYC) systems, customer records, and external data providers. This creates a mismatch between the methodology approved and the risk assessment applied.

This creates several repeated challenges:

• Disconnected risk factors: An organization has its own risk appetite and internal customer risk methodology. However, many existing systems apply predefined scoring models. This means the final customer rating may not reflect the firm’s risk factors, weightings, and escalation rules.
• Static risk-scoring: A customer’s risk rating can evolve as their information or exposure to money laundering risk materially changes. However, a risk score calculated during onboarding may remain the same unless the firm manually reviewed or recalculates it.
• Inconsistent calculations: Compliance teams using spreadsheets and formulas to apply risk factors may interpret the same methodology differently or produce different outcomes.
• Weak auditability: The best practice is to document all compliance decisions for regulatory reporting clearly. However, this requires firms to explain all factors, weightings, data, and methodology behind a decision. This also includes how that assessment changed over time.
• Limitations in risk model: Changes to a firm’s risk appetite can trigger multiple updates across spreadsheets, workflows, and downstream processes. This can create additional work and increase the chance that new rules are implemented inconsistently.

The gap is thus not a lack of data analytics or effective risk modeling. The organization must translate that methodology into a dynamic, explainable risk model that it can apply automatically, consistently, and at scale.

How Can a Custom Risk Engine Bridge the Risk Scoring Gap?

The solution does not necessarily lie in replacing an existing AML risk methodology. But often the bigger opportunity is to make that methodology easier to execute. A bespoke risk engine takes an organization’s own risk policies and translates them into an automated, configurable risk-scoring model.

Rather than maintaining calculations across spreadsheets and manually combining different sources of information, compliance teams can define the exact factors, weightings and thresholds that determine how customer risk is assessed and let the system apply the findings consistently. This can be particularly useful when an organization already uses established industry risk assessment approaches.

Common risk assessments:

• Business-Wide Risk Assessment (BWRA): Identifies potential risk across products, jurisdictions, and delivery channels. It informs where controls and monitoring should be most sensitive.
• Enterprise-Wide Risk Assessment (EWRA): A broader assessment that may be used by larger or more complex organizations to assess risk across business lines, entities, products, and jurisdictions.
• Institutional Risk Assessment (IRA): Evaluates risk within individual business lines or units. For instance, a crypto business unit carries significantly different potential risk than a retail operation.
• Customer Risk Assessment (CRA): Assesses risk for an individual using factors such as Politically Exposed Person (PEP) status and expected activity to determine the CDD route.
• Risk Management and Compliance Program (RMCP): Brings together broader governance structure, including policies, internal controls, and staff used to manage the risks identified through these assessments.

Ultimately the results of risk assessments must impact how individual customers are assessed and what level of due diligence they are subject to. A Kundenspezifisches Risiko-System helps create that connection. The team translates business-level risk findings into customer-level factors, rules, and thresholds to ensure the organisation’s documented risk appetite is reflected in actual scoring decisions.

Additionally, when relevant information changes, the engine re-evaluates customers and prevents risk ratings from being locked at onboarding. As such, the risk engine becomes the execution layer between an organization’s risk framework and its day-to-day compliance decisions.

The Importance of Governance in Risk-Based Monitoring

Technology is not a substitute for governance. Firms should continue to set their risk appetite, approve their methodology, test changes, monitor effectiveness, and review whether controls continue to reflect their financial crime risk. Therefore, a risk engine must be an enabler of appropriate governance, validation, change management, and oversight, not a replacement.

Firms must show:

• Ownership: Who owns the risk methodology?
• Approval: Who is responsible for approving changes to risk factors, weightings, thresholds and escalation rules?
• Testing: How will changes be tested before implementation?
• Validation: How does the firm ensure the methodology remains appropriate?
• Data Quality: Are the inputs used to calculate risk accurate, complete, and current enough?
• Change Management: Can the firm demonstrate when and why the methodology changed?
• Oversight: Do the right functions review the risk outcomes and control performance?
• Effectiveness: Does testing show that the controls are working as intended?

This is particularly important where automated scoring influences CDD, EDD, monitoring intensity, or other compliance decisions. Consequently, automation should make the methodology more consistent and auditable, not less transparent.

Strengthen Risk-Based AML Controls

Ein AML framework is only as good as its implementation. The challenge for compliance teams is to reflect their risk methodology consistently in the systems, decisions and controls used across the customer lifecycle. A configurable risk engine can help bridge that gap by taking an organization’s approved methodology and turning it into a dynamic, explainable execution layer.

With the right governance, testing, data controls, and ongoing reviews of effectiveness, this can help firms ensure their AML controls align with their actual financial crime risk. Mehr erfahren about how you can build your own custom risk engine today.