5.2 Risk-Based Approach, Risk Assessment, Risk Appetite, and Types of Risk
Key Takeaways
FATF Recommendation 1 requires countries and firms to identify, assess and understand ML/TF risks and to apply a risk-based approach.
A business-wide risk assessment scores inherent risk by customer, product, geography and channel, then subtracts control effectiveness to find residual risk.
A risk appetite statement is board-approved and combines qualitative limits with measurable metrics, tolerances and escalation triggers.
Since an April 2026 final rule, the OCC and FDIC no longer criticise banks on the basis of reputation risk, though reputation remains a real business risk.
CAFCA sub-topic 1.6 asks for the definitions and key components of the risk-based approach (RBA), risk assessment and risk appetite, why they exist, and when to review them. Sub-topic 1.10 adds the types of risk a FinTech faces. The exam often frames these as decisions. Should the firm accept a new customer segment? Is a control proportionate? What happens when a metric breaches appetite?
The risk-based approach
FATF Recommendation 1 requires countries, and through national law financial institutions, to identify, assess and understand their money laundering and terrorist financing risks. Resources and controls should be matched to those risks: enhanced measures where risk is higher, and simplified measures where risk is demonstrably lower and the law allows it. The RBA is not a licence to accept any risk, and it does not demand zero risk. It is a disciplined way to allocate limited controls and to explain those choices to supervisors and partner banks.
The business-wide risk assessment
Most regimes call it the business-wide or enterprise-wide risk assessment (BWRA or EWRA). It has three layers:
- Inherent risk: the risk before controls, scored by factor:
- Customers: retail versus business, PEPs, MSB or crypto clients, high-risk industries, non-resident customers.
- Products and services: instant P2P, cross-border payouts, cash loading, virtual cards, crypto on- and off-ramps, credit.
- Geographies: where customers live and where funds come from and go, including FATF-listed and sanctioned jurisdictions.
- Delivery channels: fully remote onboarding, embedded partners, agents, API access.
- Transactions: volumes, values, velocity and anonymity features.
- Control effectiveness: how well CDD, screening, monitoring, training and governance reduce each risk. Use evidence such as QA error rates, testing results and audit findings, not opinion.
- Residual risk: what remains after controls. Compare it with appetite. Residual risk above appetite needs action: stronger controls, product limits, exiting a segment, or formal acceptance by the right authority.
Good assessments use both quantitative data (customer mix, volumes by corridor, alert and SAR statistics, fraud losses) and qualitative judgement (national risk assessments, FIU alerts, typology reports). They document the methodology so that the result can be repeated and challenged.
Risk appetite
A risk appetite statement (RAS) is the board's statement of the type and amount of risk the firm is willing to accept in pursuit of its objectives. For financial crime it usually combines:
| Element | Example |
|---|---|
| Zero-tolerance statements | No shell banks; no unlicensed money transmitters; no sanctioned-country business |
| Qualitative limits | Crypto ramps only for verified customers in approved countries |
| Quantitative metrics | High-risk customers no more than 8% of the active base; payouts to grey-listed countries below a set share of volume |
| Tolerances and triggers | Alert backlog older than 30 days above a set number escalates to the risk committee |
Risk appetite is not the risk assessment. The assessment measures risk. The appetite states what is acceptable. Monitoring compares the two and drives decisions.
When to review
Refresh the assessment and appetite:
- On a fixed cycle, often annually for the business-wide assessment. Some laws, such as the EU AML package, specify review expectations.
- When a trigger occurs: a new product or feature, entry into a new country, a new delivery channel or partner, a major change in customer mix, an enforcement action or audit finding, a new national risk assessment or FATF listing, or a significant incident. Chapter 18 covers triggers in detail.
Types of risk (sub-topic 1.10)
| Risk type | Meaning | FinTech example |
|---|---|---|
| Regulatory / compliance | Breach of laws, rules or licence conditions | Fines or licence restrictions after a weak onboarding programme |
| Legal | Litigation, contract disputes, liability | Claims by scam victims or by the partner bank under indemnities |
| Operational | Failed processes, people, systems or external events | Screening outage; vendor failure; insider fraud |
| Financial | Direct losses and capital or liquidity effects | Chargebacks, fraud write-offs, penalties, reserve shortfalls |
| Business / strategic | Threat to the business model or growth plan | Partner bank exits the programme; payment network suspends the FinTech |
| Reputational | Loss of trust among customers, partners and investors | Media coverage of mule accounts on the platform |
These risks are linked. A single financial crime failure can produce all six. In the US, the OCC and FDIC adopted a final rule in April 2026 under which they no longer criticise or take adverse action against banks on the basis of "reputation risk" as a separate supervisory category. For a FinTech, reputation still affects partners, investors and customers, so it stays in the firm's own assessment.
Realistic exam scenario
A payments FinTech's annual assessment shows that payouts to two grey-listed jurisdictions have grown from 6% to 19% of volume. Monitoring alert volumes on those corridors have also doubled. The board's appetite metric caps such corridors at 10%. Compliance should report the breach to the risk committee, propose options with their trade-offs, and document the decision. The options include corridor limits, enhanced due diligence for those payees, temporary caps, or exiting the corridor. Ignoring the breach because "revenue is strong" is not a risk-based approach.
Common exam traps
- RBA means "no controls for low risk". Wrong. Low-risk customers still get core CDD, screening and monitoring.
- Confusing inherent and residual risk.
- A static assessment. It must change when the business changes.
- Appetite set by the product team alone. Appetite is a board-level decision.
Which statement correctly distinguishes risk assessment from risk appetite?
The assessment measures inherent and residual risk; the appetite sets how much risk the board accepts
The risk assessment is written by internal audit, while the partner bank sets the appetite for the FinTech
They are the same document, simply given different names by different teams
Risk appetite is calculated each night by the transaction monitoring system from alert data
A FinTech's controls are judged strong, but its customer base is dominated by non-resident businesses sending cross-border payouts. What does this describe?
A risk appetite breach by definition
Low inherent risk and low residual risk, because controls are judged strong
Zero residual risk because controls are strong
High inherent risk that controls may reduce to a lower residual risk
When should a FinTech refresh its business-wide risk assessment outside the normal annual cycle?
Only when the partner bank demands a refresh in writing during its review
Never; the annual cycle is the only review point
Whenever it launches a new cross-border product or enters a new country
Only after an enforcement action
Sections you finish are checked off in the contents.