Risk-based approach (RBA)
A risk-based approach (RBA) in anti-money laundering means a financial firm matches the depth of its checks to the risk each client, product and payment carries. Higher risk gets enhanced due diligence and closer monitoring; lower risk can get simplified checks. EU AML law and FATF standards require it.
Why rules are risk-based
Checking every client the same way wastes effort on low-risk businesses and misses what matters in high-risk ones. Since 2012, FATF Recommendation 1 has asked countries and firms to identify, assess and understand their money laundering risks and to put resources where the risk is. EU law turns this into obligations for banks, e-money institutions and other obliged entities.
The four steps
- Identify the risks the business is exposed to: client types, products, countries, delivery channels.
- Assess how likely and how serious each one is, in a documented business-wide risk assessment.
- Mitigate with controls in proportion: onboarding checks, limits, monitoring rules.
- Monitor and update, because client behaviour and threats change.
What it looks like for a client
At onboarding, each client gets a risk score built from factors such as industry, ownership structure, jurisdiction risk, expected volumes and payment corridors. The score sets the level of KYB:| Risk level | Typical due diligence |
|---|---|
| Low | Simplified: core identity and ownership checks |
| Medium | Standard: identity, ownership, business purpose, expected activity |
| High | Enhanced: extra documents, source of funds and wealth, senior approval, closer monitoring |
Risk-based, not risk-averse
An RBA is meant to manage risk, not avoid it. Regulators, including the EBA, have warned that dropping whole categories of clients instead of assessing them is de-risking, which the risk-based approach is supposed to prevent.FAQ
Yes, for obliged entities in the EU under the AML Directive and, from July 2027, the AML Regulation.
Enhanced due diligence adds checks for higher-risk clients. Simplified due diligence reduces them where risk is demonstrably low. Both are part of an RBA.
Yes. Providers review ratings periodically and when something changes, such as new owners, new markets or unusual activity.
Last reviewed October 21, 2026Disclaimer
This publication is provided for general information purposes and does not constitute legal, tax, or other professional advice from Narvi Payments Oy Ab or its affiliates, and it is not intended as a substitute for obtaining advice from a financial advisor or any other professional.
This publication is provided for general information purposes and does not constitute legal, tax, or other professional advice from Narvi Payments Oy Ab or its affiliates, and it is not intended as a substitute for obtaining advice from a financial advisor or any other professional.
What We Offer
IBAN Accounts For Your Business
Support & Compliance
Narvi Knowledge Center
Alternative Investment Funds [whitepaper]Family Offices [whitepaper]Shipping Industry [whitepaper]How to Open a Business Account in FinlandNarvi vs. Wise, Revolut, N26, and other alternativesNarvi vs. Stable.comNarvi vs. payabl.Narvi vs. ConnectPayNarvi vs. IBAN4UNarvi vs. GenomePayments BlogPayments Glossary
Narvi Payments Oy Ab is an Authorized Electronic Money Institution (EMI). Narvi’s EMI license is granted by the Finnish Financial Supervisory Authority (FIN FSA) with the registration number 3190214-6. Narvi’s license is passportised to all European Union countries.
Built and regulated in Finland© 2026 Narvi. All Rights Reserved.
v1.322.0