Risk Assessment and the Risk-Based Approach
From risk to controls
The risk-based approach means calibrating controls to the level of risk rather than applying a uniform checklist. Candidates must understand inherent risk (before controls), residual risk (after controls), and the three risk drivers: customer, product/service, geography, and delivery channel - often called the four risk factors.
At institutional level, a business-wide risk assessment (BWRA) identifies and documents the firm's exposure across these factors, informs policy, and is reviewed periodically. At customer level, customer risk assessment (CRA) drives the CDD tier: simplified, standard, or enhanced due diligence.
Know the concept of risk appetite - the level of risk the firm is willing to accept - and how it translates into thresholds, monitoring scenarios, and escalation criteria. Understand country risk indicators (FATF listings, corruption indices, conflict zones, secrecy), product risk (cash-intensive, cross-border, anonymous, high-value), and channel risk (non-face-to-face, agents, introducers).
Traps and rule of thumb
A frequent trap is treating a low-risk rating as a permanent exemption from CDD - it is not; CDD is still required, only the intensity varies. Another trap is confusing inherent and residual risk, or assuming a low-risk customer needs no monitoring. Also watch for the misconception that EDD is required for every politically exposed person regardless of context - PEP status is a high-risk factor, but the control should be proportionate and risk-based.
Rule of thumb: the risk assessment is a living document - it must be documented, approved, and refreshed when products, customers, or the external environment change.
Worked example: A firm launches a non-face-to-face crypto product for customers in a grey-listed jurisdiction. Inherent risk is high; with enhanced onboarding, source-of-funds verification, and heightened monitoring, residual risk may be brought to an acceptable level - but it cannot be eliminated.