Application of the risk-based approach (RBA) for financial crime risk management by banks

The application of a risk-based approach (RBA) to managing financial crime risk has been a long-standing requirement and rhetoric of the Financial Action Task Force (FATF), filtering into national legislative requirements, regulatory expectations, and the private sector management of financial crime risk. The RBA concept can be deconstructed at a micro level by analysing how banks—a subset of regulated firms—define, manage, and attempt to mitigate financial crime(s) risk(s) in practice. The authors conclude that there are some serious challenges for the conceptualisation, and variations in the application, of the RBA from an operational perspective. There are also limitations for intelligence gathering and of the measurement of ‘effectiveness’ for financial crime control, where risk assessment methodologies informing the RBA differ between organisations. Given that the outputs of these RBAs are relied upon so heavily by national Financial Intelligence Units (FIUs) and by Regulatory Supervisors, there is a need for increased transparency in such methodologies. An understanding of the practical challenges and limitations faced by regulated entities in their interpretation and application of the RBA is critical if there is a legitimate desire to improve, and to make more consistent, private sector participation within the financial crime control landscape.