The risk-based approach is the principle that a firm should identify and assess its risks, then apply stronger controls where risk is higher and lighter ones where it is lower, rather than treating every customer, product or transaction the same. It underpins the FATF standard for anti-money laundering. It also applies to the AI agents a firm deploys.
Why does the risk-based approach matter once agents act?
Two ways. First, agents are now used to apply it: scoring customer risk, setting monitoring thresholds, deciding which files need a closer look. If those agents are not tested well, the firm's risk-based approach rests on judgements nobody has checked.
Second, the agents themselves need a risk-based approach. An agent that reads policy documents and an agent that releases payments do not deserve the same scrutiny. We argue in FATF risk-based approach applied to AI agents that the depth an agent may act at, and the evidence required for it, should rise with the harm it could do.
How does the approach work in practice?
The pattern is the same whether the subject is customers or agents:
| Step | For customers | For agents |
|---|---|---|
| Identify risks | Customer type, geography, products, channels | What the agent can read, change or move |
| Assess them | Score and band each customer | Rate each capability by harm and reversibility |
| Scale controls | Simplified, standard or enhanced due diligence | Read, draft, execute or move money, each earned |
| Review | Periodic and event-driven reviews | Recertification and checks after any failure |
A customer risk rating matrix puts the customer side into practice.
An example from a payments firm
Take a payments firm deciding how much evidence it needs before agents do three jobs. An agent that summarises policy for staff is low risk: a wrong answer is caught by the reader. It gets a light test and read depth. An agent that drafts customer replies about disputed payments is medium risk: it gets tested on past disputes and every reply is approved. An agent that prepares refunds needs the strongest evidence: replay against hundreds of past refunds, with every refusal and escalation rule tested, before it earns any authority to execute within limits.
Same firm, same platform, three different bars. That is the approach applied to agents.
How is it different from a rules-based approach?
A rules-based approach sets the same prescribed checks for everyone: every customer provides the same documents, every transaction above a fixed amount gets the same review. It is predictable and easy to audit but spends effort evenly, including where risk is low.
The risk-based approach asks the firm to think, document its reasoning and justify where it spends effort. It is more efficient and more demanding: if a supervisor disagrees with the firm's assessment, the firm must show why it judged as it did. The UK's principles-based approach to AI is a related idea at the level of regulation rather than controls.
Which terms sit next to the risk-based approach?
- Risk appetite: how much risk the board is willing to accept, which sets where the bars are.
- Enhanced due diligence: what the approach requires at the high end for customers.
- Compliance agents in the second line help test whether the approach is working.
Questions people ask
Does a risk-based approach allow us to skip checks on low-risk customers?
It allows lighter checks where national law permits and the firm can justify the low rating. It does not allow no checks, and the justification must be documented.
Who decides how risky an agent's capability is?
The process owner, with risk and compliance, before the agent is built. The assessment should be written down and revisited when the capability changes.