The risk-based approach has long been at the core of the FATF Recommendations, and Recommendation 1 puts it first. The idea is simple: those with limited resources should deploy them where the risk lies. A local family with a transparent source of wealth does not need the same review depth as a structure with companies in three countries and a politically exposed person.
Typical risk criteria
Residence and nationality of the persons involved, seat of the companies, nature and location of business activity, complexity of the structure, status as a politically exposed person, size of assets, nature and volume of expected transactions, source of funds, and findings from sanctions and media screening. Each organisation decides which criteria apply and how they are weighted; its self-regulatory organisation or supervisor sets the framework.
How a classification arises
The criteria produce a classification, usually in three levels: low, normal, higher. What matters is less the number of levels than the consequence: what does the classification concretely mean for review depth, approval and review frequency? A classification from which nothing follows is a label. For higher risk, enhanced due diligence applies.
The classification lives
Risks change. A new company in the structure, a change of residence, a political office, a negative media report — each of these can shift the classification. Re-assessment therefore belongs in the periodic review and, in addition, in defined triggers that start an extraordinary review.
Why the method must be documented
The risk-based approach grants discretion, and discretion requires reasons. In an audit by the SRO or an audit firm, the question is not only how a relationship is classified but why. The method — criteria, weighting, consequences — belongs in a directive; its application per relationship belongs in the file.
Since the 2026 revision of the Swiss AMLA
With the revision of the Swiss Anti-Money Laundering Act in force since 1 October 2026, certain advisory activities are now subject to due diligence duties. The risk-based approach applies to these advisers too; their SRO specifies the scope of the duties. Anyone newly subject therefore needs their own risk method first, not just forms. Our article on the 2026 AMLA revision explains who is affected.