The risk-based approach (RBA) is a foundational principle of FATF standards. It requires countries, regulators, and financial institutions to identify, assess, and understand their money laundering and terrorist financing risks.
Once risks are understood, entities must apply proportionate mitigation measures. Higher risks require stronger controls, while lower risks may justify simplified measures. However, no risk is ignored or exempted from mitigation.
Regulators do not expect all residual risks to be reduced to low; rather, risks must be managed within an acceptable risk appetite. Resource allocation under an RBA prioritizes AML/CFT activities, not unrelated tasks.
Therefore, the correct definition of an RBA focuses on understanding and managing risk proportionately.

When developing and maintaining AML policies, standards, and procedures, banks should rely on the National Risk Assessment, regulatory guidance or publications, and guidance issued by international bodies to ensure their frameworks align with both domestic and global best practices and risk considerations.

Shared contact information across unrelated accounts may indicate synthetic identities, account takeover schemes, or mule networks used for money laundering. Criminals often control multiple accounts to move funds rapidly while obscuring transaction trails. Institutions should investigate account relationships, transaction patterns, and onboarding documentation for inconsistencies.