How to Build a Risk-Based AML Program from Scratch

"Risk-based approach" is the phrase at the centre of almost every AML regime in the world, and also one of the most misunderstood. It doesn't mean doing less. It means putting your effort where the risk actually is — and being able to explain to a supervisor why you made the choices you did.

This guide explains what a risk-based AML program is, the building blocks every program needs regardless of jurisdiction, and the order in which to build them if you are starting from scratch.

What "risk-based" actually means

The FATF Recommendations — the international standard that national AML laws are built on — open with Recommendation 1: countries, and the firms they regulate, should identify, assess and understand their money laundering and terrorist financing risks, and apply measures that are proportionate to those risks.

In practice, that means three things:

You start with a risk assessment, not a policy template. Your controls should follow from the risks you have identified, not the other way round.
Controls scale with risk. Higher-risk customers, products and countries get more scrutiny. Lower-risk ones can, where the law allows, get simplified measures.
You document your reasoning. A supervisor may disagree with a judgement call, but an undocumented judgement call is indefensible.

What a risk-based approach does not mean is that some legal requirements become optional. Mandatory obligations — identifying customers, reporting suspicion, keeping records — apply regardless of how low you rate a risk. The risk-based approach governs how much you do, not whether you do it.

The building blocks of an AML program

Different regimes use different structures — US practitioners talk about the "five pillars" of a BSA/AML program, for example — but the same core components appear everywhere.

1. Governance and senior management oversight

Senior management is accountable for the AML program, not just the compliance team. Supervisors expect to see that the board or senior management approves the risk assessment and key policies, receives regular management information, and provides adequate resources.

2. A designated compliance officer

FATF Recommendation 18 calls for compliance management arrangements, including a compliance officer at management level. Depending on the jurisdiction, this person may be called the MLRO, the BSA officer or the AML compliance officer. They need sufficient seniority, independence and resources to do the job — and access to the board when needed.

3. A business-wide risk assessment

This is the foundation everything else rests on. It identifies the money laundering and terrorist financing risks your firm faces across customers, products and services, geographies, transactions and delivery channels, and evaluates how well your controls mitigate them. We cover it in depth in our guide to the AML business-wide risk assessment.

4. Policies, procedures and internal controls

Written policies set out what the firm will do; procedures set out how staff do it day to day. They should map directly to the risks in your risk assessment. A common supervisory finding is a policy copied from a template that describes controls the firm doesn't actually operate.

5. Customer due diligence

Identifying and verifying customers and their beneficial owners, understanding the purpose of the relationship, rating each customer's risk and applying enhanced measures where the risk is higher. See CDD vs EDD: a practical guide for how the levels fit together.

6. Ongoing monitoring

Due diligence doesn't stop at onboarding. Ongoing monitoring has two parts: scrutinising transactions to make sure they are consistent with what you know about the customer, and keeping customer information up to date through periodic and trigger-based KYC reviews.

7. Sanctions screening

Screening customers, beneficial owners and, where relevant, transactions against applicable sanctions lists. Sanctions obligations are often strict liability and don't benefit from a risk-based approach in the same way — a match is a match.

8. Suspicious activity reporting

A clear internal route for staff to raise concerns with the compliance officer, a documented process for investigating them, and timely reporting to the financial intelligence unit when the threshold is met. Staff must also understand the prohibition on tipping off.

9. Record keeping

FATF Recommendation 11 requires records of customer due diligence and transactions to be kept for at least five years. Your records also have to be retrievable — a supervisor or law enforcement request is not the time to discover that files are scattered across email inboxes. See our guide to AML record keeping.

10. Training

Staff need training that is relevant to their role, delivered when they join and refreshed regularly. Front-line staff need to recognise red flags; senior management needs to understand their accountability. See AML training requirements.

11. Independent testing

An independent audit function — internal audit or an external provider — should periodically test whether the program is designed well and operating effectively. Findings should be tracked through to remediation.

Building a program from scratch: the order that works

If you are setting up a program for the first time — a new firm, a newly regulated business, or a firm whose program has been found wanting — sequence matters.

Map your obligations. Identify which laws and supervisors apply to you, and whether you are a financial institution or a designated non-financial business or profession. This determines the scope of everything else.
Appoint the compliance officer. Someone has to own the build. Make sure their appointment and responsibilities are documented and approved.
Do the business-wide risk assessment. Don't write policies before you understand your risks. Even a first version based on limited data is better than none — you will refine it.
Write policies and procedures that follow from the risk assessment. Keep them specific to how your firm actually operates.
Design your customer risk rating methodology. Decide which factors drive a customer's rating and what each rating means for due diligence and review frequency.
Implement CDD, screening and monitoring. This is where systems and data come in. Start with what's proportionate — a small firm doesn't need an enterprise monitoring platform on day one.
Set up reporting, record keeping and training. Make sure every member of staff knows how to raise a concern.
Set the calendar. Many obligations recur — risk assessment reviews, training refreshers, audits, management reporting. Put them on an AML compliance calendar with named owners.
Commission independent testing. Once the program has run long enough to produce evidence, have it tested.

Common pitfalls

Template policies. Supervisors read hundreds of policies. They recognise a template that hasn't been tailored, and they will test whether you actually do what it says.
A risk assessment that doesn't drive anything. If your risk assessment identifies a high-risk product but your monitoring and due diligence treat it like any other, the assessment is decorative.
Rating everything "medium". A distribution with almost no high-risk customers often signals a methodology problem, not a low-risk business.
No management information. If senior management never sees backlogs, alert volumes or overdue reviews, they can't exercise oversight — and supervisors will notice. The MLRO annual report is the minimum.
Treating the program as a one-off project. Your business, your customers and the rules change. A program that isn't maintained decays.

Key takeaways

A risk-based approach means controls proportionate to your risks — not fewer controls.
Every program needs governance, a compliance officer, a risk assessment, policies, CDD, monitoring, screening, reporting, record keeping, training and independent testing.
Build in order: obligations, owner, risk assessment, then everything else.
Document your reasoning. It's what turns a judgement call into a defensible decision.

Regpin is built to help compliance teams manage exactly this: the risk assessment, policies, customer risk ratings and controls that make up an AML program. Get in touch to see how it works.

This article is general information, not legal advice. AML obligations vary by jurisdiction, sector and firm, so confirm the specific requirements that apply to you with your supervisor's guidance or a qualified adviser.