Talk to usTry the demo

The Risk-Based Approach: How FATF Standards Set Verification Steps

KYC, AML and digital identification

For: Compliance officer or product owner who has to decide which verification steps a customer receives

How the risk-based approach of the FATF Recommendations decides how much identity verification a customer gets, and how EU, UK, UAE and US texts turn it into concrete steps.

For information; not legal advice.

You run or design identity verification for a regulated institution, and you have to decide which customer gets which steps: one document and a selfie, a second document, a call, a source-of-funds question, or a stop. The anti-money-laundering standard answers that with one phrase, the risk-based approach. This guide reads that phrase in the primary texts and asks one question: what exactly does the standard let risk change, what does it leave fixed, and how do the European Union, the United Kingdom, the United Arab Emirates and the United States turn it into steps that a product can implement?

The sources are the FATF Recommendations with their interpretive notes, the EU Anti-Money Laundering Regulation, the European Banking Authority guideline on remote onboarding, the UK Money Laundering Regulations, the Central Bank of the UAE guidance on digital identification, and the US digital identity guidelines as a method for choosing assurance. The wording of each is quoted or described as published, and where this article offers its own reading it says so.

What the standard means by the approach

The FATF Recommendations are the global anti-money laundering and counter-terrorist financing standard. The text used here is the update of June 2026, as published by the Eurasian Group, a FATF-style regional body. Recommendation 1 starts the whole structure with a duty on countries to identify, assess and understand their risks, and then to apply a risk-based approach so that the measures taken are proportionate to those risks. It describes the approach as an essential foundation for allocating resources and for the implementation of risk-based measures throughout the Recommendations.

The two sides of the principle are stated in one pair of sentences in Recommendation 1.

Where countries identify higher risks, they should ensure that their AML/CFT regime adequately addresses such risks. Where countries identify lower risks, they should allow and encourage simplified measures as appropriate.

The interpretive note to Recommendation 1 says what the approach is for. It calls the approach an effective way to combat money laundering and terrorist financing, and it says that by adopting it competent authorities and institutions should be able to ensure that preventive measures are proportionate to the risks identified, and should be able to decide how to allocate their own resources in the most effective way. The same note adds a limit that is easy to miss: the discretion the approach gives to institutions does not exempt them from the requirement to apply enhanced measures when they identify higher-risk scenarios.

The Recommendations define the word that carries the idea. In the glossary to the note, a proportionate measure is one that appropriately corresponds to the level of identified risk and effectively mitigates the risks.

Three layers of risk work

The standard does not leave the work to one party. It distributes it over three layers, and a verification designer meets all three.

The country

Paragraph 5 of the interpretive note to Recommendation 1 asks countries to assess their money laundering and terrorist financing risks on an ongoing basis, in order to inform changes to the regime, to allocate resources, and to make information available for the risk assessments that institutions conduct. Countries should keep the assessments up to date and have mechanisms to share the results with institutions. Paragraph 6 says that where countries identify higher risks they should either prescribe enhanced measures for institutions or ensure that the information is incorporated in institutions' own risk assessments. Paragraph 7 says that countries should allow and encourage simplified measures where a lower risk has been identified with due regard to the country's own assessment.

The institution

The institution carries the second layer. Paragraph 12 of the note requires institutions to take appropriate steps to identify and assess their money laundering and terrorist financing risks for customers, for countries or geographic areas, and for products, services, transactions or delivery channels. Institutions should document those assessments in order to demonstrate their basis, keep them up to date, and provide the information to competent authorities.

Paragraph 13 turns the assessment into controls. Institutions should have policies, controls and procedures that enable them to manage and mitigate the identified risks effectively. The policies, controls and procedures should be approved by senior management, and the measures taken, whether for higher or for lower risk, should be proportionate to the risks identified. Paragraph 16 asks institutions to consider all relevant risk factors before deciding the overall level of risk and the level of mitigation, and it allows the extent of measures to differ by risk factor. Its example is useful for verification design: in a particular situation an institution could apply normal customer due diligence for customer acceptance, but simplified or enhanced customer due diligence for ongoing monitoring, or the reverse.

The supervisor

Paragraph 9 gives the third layer to supervisors. They should ensure that institutions implement their obligations effectively and proportionately, and they should review the risk profiles, risk assessments and mitigation measures of institutions and take the result into account.

Where verification sits: customer due diligence

Identity verification is one part of customer due diligence, which Recommendation 10 sets out. The Recommendation lists the situations in which customer due diligence is required: establishing business relations, carrying out occasional transactions above the designated threshold or certain payments, a suspicion of money laundering or terrorist financing, and doubts about the veracity or adequacy of previously obtained identification data. It then lists the measures, and the first is the one a verification flow implements.

Identifying the customer and verifying that customer's identity using reliable, independent source documents, data or information.

The other measures are identifying the beneficial owner and taking reasonable measures to verify that person's identity, understanding the purpose and intended nature of the business relationship, and conducting ongoing due diligence. The sentence that connects these measures to risk is the one a designer should know by heart.

Financial institutions should be required to apply each of the CDD measures under (a) to (d) above, but should determine the extent of such measures using a risk-based approach (RBA) in accordance with the Interpretive Notes to this Recommendation and to Recommendation 1.

Two things follow from that sentence. First, all of the measures are applied. An institution's own risk view does not remove identification or verification. Second, the extent is what varies, and the extent is decided by a risk-based approach and not by convenience.

A footnote in the interpretive note to Recommendation 10 states the same limit from the other side. It says that the risk-based approach does not apply to the circumstances in which customer due diligence should be required, but may be used to determine the extent of the measures. In plain terms, an institution cannot use its own view of risk to switch off a customer due diligence measure that applies to it. Its risk view changes how much is done and when. The standard does allow lower-risk treatment in two defined forms, both covered below: simplified measures where lower risk is identified, and exemptions that a country, not an institution, may decide on in limited and justified circumstances. Paragraph 8 of the interpretive note to Recommendation 1 says that countries may decide not to apply some of the Recommendations that require financial institutions or designated non-financial businesses and professions to take certain actions, provided there is an assessed low risk, the exemption occurs in limited and justified circumstances, and it relates to a particular type of institution or activity. It gives a second case, a financial activity other than the transferring of money or value that is carried out by a natural or legal person on an occasional or very limited basis, such that there is low risk.

What happens when verification fails

The Recommendation also fixes the consequence of failure. Where an institution is unable to comply with the applicable measures, subject to appropriate modification of the extent on a risk basis, it should not open the account, commence business relations or perform the transaction, or should terminate the relationship, and should consider making a suspicious transaction report. A verification flow therefore needs a defined outcome for the case in which the evidence cannot be validated, and that outcome is a refusal and not a silent downgrade.

Timing

The Recommendation expects identity to be verified before or during the establishment of the relationship, but it allows countries to permit completion as soon as reasonably practicable where the risks are effectively managed and where this is essential not to interrupt the normal conduct of business. The interpretive note names non face-to-face business as an example of a circumstance in which later verification may be permissible. It then adds a condition: institutions need risk management procedures for the conditions under which a customer may use the relationship before verification, such as a limitation of the number, types or amount of transactions and the monitoring of large or complex transactions outside the expected norms.

The risk factors that move the dial

The interpretive note to Recommendation 10 gives examples of factors in three groups. It labels the examples as guidance only, not mandatory elements of the standard, and it says they are not comprehensive and may not be relevant in all circumstances.

Higher risk

Among customer risk factors for higher risk, the note lists a business relationship conducted in unusual circumstances, such as significant unexplained geographic distance between the institution and the customer, non-resident customers, companies with nominee shareholders or bearer shares, and an ownership structure that appears unusual or excessively complex. Among product, service, transaction or delivery channel factors, it lists private banking, anonymous transactions, payments from unknown third parties, and the item that matters most to remote onboarding.

Non-face-to-face business relationships or transactions where appropriate risk mitigation measures have not been implemented.

The condition at the end of that item is the point. The note does not say that remote onboarding is high risk. It says that a non-face-to-face relationship is a higher-risk factor where appropriate mitigation measures have not been implemented.

Enhanced and simplified measures

Enhanced

Where the risks are higher, the note requires enhanced customer due diligence consistent with the risks identified. The examples it gives that touch the verification layer directly are obtaining additional information on the customer, updating the identification data of the customer and the beneficial owner more regularly, obtaining the approval of senior management to start or continue the relationship, and requiring the first payment to be carried out through an account in the customer's name with a bank subject to similar standards. The examples that touch other layers are information on the source of funds or wealth, information on the reasons for transactions, and enhanced monitoring.

Simplified

Where the risks are lower, institutions should be allowed and encouraged to apply simplified measures that take into account the nature of the lower risk. The possible measures include verifying the identity of the customer and the beneficial owner after the establishment of the relationship, for example when transactions rise above a defined monetary threshold, reducing the frequency of identification updates, and reducing the degree of ongoing monitoring. The note closes the topic with a sentence that works as a guardrail for any rule engine.

Simplified CDD measures are not acceptable whenever there is a suspicion of money laundering or terrorist financing, or where specific higher-risk scenarios apply.

Paragraph 18 of the note adds a point that designers often miss. A lower risk for identification and verification purposes does not automatically mean that the same customer is lower risk for all types of customer due diligence, in particular for ongoing monitoring of transactions.

Assessing a new technology before launch

Recommendation 15 asks institutions to identify and assess the risks that may arise from new products and business practices, including new delivery mechanisms, and from the use of new or developing technologies. For institutions the assessment should take place prior to the launch. A new remote verification flow is a new delivery mechanism, and this Recommendation is the reason the later texts ask for an assessment before a flow goes live.

How the EU turns it into rules

The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027, with a later date for some categories of obliged entities. It makes the approach concrete in four places.

The business-wide assessment

Article 10 requires obliged entities to take appropriate measures, proportionate to the nature of their business, to identify and assess the risks to which they are exposed. The assessment takes into account at least the risk variables in Annex I, the risk factors in Annexes II and III, the Union and national risk assessments, and information on the customer base. It must be documented, kept up to date and regularly reviewed, and it is made available to supervisors on request. The article also contains a rule for change. Before launching new products, services or business practices, including new delivery channels and new or developing technologies, obliged entities must identify and assess the related risks and take appropriate measures to manage and mitigate them.

The individual analysis

Article 20 lists the customer due diligence measures, and its second paragraph ties their extent to risk.

Obliged entities shall determine the extent of the measures referred to in paragraph 1 on the basis of an individual analysis of the risks of money laundering and terrorist financing having regard to the specific characteristics of the client and of the business relationship or occasional transaction, and taking into account the business-wide risk assessment by the obliged entity pursuant to Article 10 and the money laundering and terrorist financing variables set out in Annex I as well as the risk factors set out in Annexes II and III.

Two other parts of Article 20 matter to a flow designer. Where an increased risk is identified, obliged entities shall apply enhanced due diligence, and where lower risk is identified they may apply simplified due diligence. Obliged entities shall at all times be able to demonstrate to their supervisors that the measures taken are appropriate in view of the risks identified.

Factors that bear on verification

Annex I lists the extent to which the business relationship is conducted on a non-face-to-face basis as a delivery channel risk variable. Annex III lists new products and new business practices, including new delivery mechanisms and the use of new or developing technologies, among the factors of potentially higher risk.

What stays fixed

Article 22 lists what obliged entities obtain to identify a customer, with the exception of lower-risk cases under Section 3 and irrespective of additional measures in higher-risk cases. Article 22(6) lets them verify identity through an identity document, passport or equivalent plus reliable independent sources, or through electronic identification means that meet the Regulation on electronic identification at the assurance levels substantial or high, together with relevant qualified trust services as set out in that Regulation. Article 23 requires verification before the business relationship is established, with exceptions for lower-risk situations where the lower risk justifies postponement, and for cases where it is necessary not to interrupt the normal conduct of business and there is little risk.

Simplified and enhanced measures in the Regulation

Article 33 lists the simplified measures. They include verifying the identity of the customer and the beneficial owner after the establishment of the relationship, provided that the specific lower risk justified the postponement, and in any case no later than 60 days after the relationship is established. The Regulation attaches conditions: risk management procedures for what may be done before verification, a regular check that the conditions for simplification still exist, and monitoring sufficient to detect unusual or suspicious transactions. It also lists situations in which simplified measures must not be used: doubts about the veracity of the information provided at identification or detected inconsistencies, factors indicating lower risk that are no longer present, monitoring that excludes a lower-risk scenario, a suspicion of money laundering or terrorist financing, and a suspicion of an attempt to circumvent targeted financial sanctions.

Article 34 covers enhanced due diligence. In higher-risk cases, obliged entities shall apply measures proportionate to the higher risks, which may include additional information on the customer and the beneficial owners, additional information on the intended nature of the relationship, information on source of funds and source of wealth, approval of senior management, enhanced monitoring, and a first payment through an account in the customer's name with a credit institution subject to customer due diligence standards that are not less robust than those of the Regulation.

How the EBA guideline reads on a remote flow

The European Banking Authority guideline on the use of remote customer onboarding solutions applies the same logic to the design of the flow itself. Its fourth section asks institutions to put in place policies and procedures that are risk-sensitive. Among other things the policies set out the situations where the remote solution can be used, taking into account the identified risk factors and the business-wide risk assessment, including the category of customers, products and services eligible for remote onboarding. The policies also state which steps are fully automated and which need human intervention, and which controls ensure that the first transaction with a newly onboarded customer happens only after the initial customer due diligence measures have been applied.

The guideline asks for a pre-implementation assessment before a solution is adopted. The assessment covers the adequacy of the solution regarding the completeness and accuracy of the data and documents collected and the reliability and independence of the information sources, the impact on the institution's business-wide risks, mitigating measures for each risk identified, tests of fraud risks including impersonation fraud, and an end-to-end test targeting the customers, products and services in scope. The institution has to be able to show its competent authority which assessments it carried out, the outcome, and how use of the solution is appropriate in light of the risks identified for the customers, services, geographies and products in scope.

The guideline also contains a risk-commensurate toolbox. Where commensurate with the risk associated with the relationship, institutions should use one or more of a list of controls to increase the reliability of verification. The list includes a first payment drawn on an account in the customer's name with a regulated institution, a randomly generated single-use, time-limited passcode sent to the customer to confirm presence, capture of biometric data compared with data from independent and reliable sources, telephone contact, and direct mailing.

How the UK turns it into rules

The UK regulations take a similar two-step path. Regulation 18 requires a relevant person to take appropriate steps to identify and assess the risks to which its business is subject, taking into account risk factors relating to customers, countries or geographic areas, products or services, transactions and delivery channels, and the size and nature of the business. It requires an up-to-date written record of the steps taken, unless the supervisor notifies that a record is not required, and it requires the assessment to be provided to the supervisor on request.

Regulation 28 sets out the customer due diligence measures and then states the link to risk. Regulation 28 says that the ways in which a relevant person complies with the customer due diligence requirement, and the extent of the measures taken, must reflect the risk assessment carried out under regulation 18 and the person's assessment of the level of risk in the particular case, and may differ from case to case.

The same regulation requires the person to be able to demonstrate to its supervisory authority that the extent of the measures is appropriate in view of the risks. It also contains a rule written for remote verification. Information may be regarded as obtained from a reliable source which is independent of the person whose identity is being verified where it is obtained through an electronic identification process, and that process is secure from fraud and misuse and capable of providing assurance that the person claiming an identity is the person with that identity, to a degree that is necessary for effectively managing and mitigating the risks.

Regulation 33 lists the cases in which enhanced measures are mandatory. One of them bears directly on verification. Enhanced measures apply in any case where the relevant person discovers that a customer has provided false or stolen identification documentation or information and the relevant person proposes to continue to deal with that customer. The regulation also allows additional enhanced measures, among them seeking additional independent, reliable sources to verify information provided.

How the UAE central bank frames it

The Guidance of the Central Bank of the UAE for licensed financial institutions on digital identification for customer due diligence contains a two-part assessment that fits the risk-based logic. The first part is an assurance level assessment, through which the institution understands the assurance levels the digital identity system provides and determines its reliability and independence. The second is an appropriateness assessment, a risk-based determination of whether the system is appropriately reliable and independent for customer due diligence in light of money laundering, terrorist financing, fraud and other illicit financing risks. The Guidance says the two assessments should be performed sequentially, and that an institution which cannot assess the assurance level, or finds the system not sufficiently reliable and independent, should not proceed with it for customer due diligence unless it can be adequately strengthened or supplemented.

Where several systems with different assurance levels are available, institutions should match the robustness of identity proofing or authentication to the type of potential illicit activity and the level of risk.

The US method for choosing assurance

The US Digital Identity Guidelines are not an anti-money-laundering text. They are included here because they describe, in more detail than the financial texts, a method for choosing how strong identity proofing should be for a given service. The base volume of Revision 4 sets out a digital identity risk management process with two dimensions. The first is the risk that results from operating the online service and might be addressed by an identity system, and it informs the initial assurance level. The second is the additional risk introduced by implementing the identity system itself, and it informs a tailoring step.

The process has five steps: define the online service, conduct an initial impact assessment, select initial assurance levels, tailor and document the assurance level determinations, and continuously evaluate and improve.

A way to structure the decision

The sources describe principles and examples. They do not prescribe a single decision table, and none of them gives numeric score bands. The structure below is this article's own reading of how the texts fit together, offered as a way to organise a design discussion and not as a requirement of any of them.

  1. Write down the risk factors that apply to the customer segment, the geography, the product and the channel, using the lists in the interpretive note and the annexes as prompts.
  2. State the baseline verification for the least risky customers you will accept, and record the reason that lower risk was assessed.
  3. Name the signals that move a customer from the baseline to a step-up: for example a document that cannot be validated, an inconsistency between data sources, a geography that your assessment marks as higher risk, or a product that allows value to move quickly.
  4. For each step-up, name the control it adds, drawn from the examples in the guideline and the interpretive note, and record why that control addresses the risk.
  5. Name the signals that stop the process and send the case to refusal or to a human reviewer, and fix in advance what the reviewer may decide.
  6. Fix the guardrails that no rule may override: no simplification when there is suspicion, and no continuation after a failure of the required measures.
  7. Decide how you will show a supervisor, later, why a given customer received a given path.

Step seven is where many designs fail. The EU Regulation, the UK Regulations and the UAE Guidance each ask the institution to be able to demonstrate that the measures were appropriate.

Common misreadings

The risk-based approach does not let an institution do less than the rules that apply to it require. The rules themselves allow lower-risk treatment in defined forms, namely simplified measures where lower risk is identified and limited country-level exemptions, and those forms carry their own conditions. The EU Regulation says this in its recitals: the risk-based approach is not an unduly permissive option for obliged entities and involves evidence-based decision-making to target risks more effectively. The FATF note says that the discretion the approach gives institutions does not exempt them from enhanced measures where higher risk is identified.

For an institution, its own risk view does not decide whether the identification and verification that apply to it happen. The footnote to the interpretive note to Recommendation 10 says that the approach determines the extent of measures and not whether they are required.

Suspicion overrides the label. The FATF note lists suspicion among the reasons simplified measures must not be used. The EU Regulation does the same in Article 33, which lists a suspicion of money laundering or terrorist financing among the situations in which simplified measures must not be applied.

Questions to put to your own design

  • Which risk factors from your written assessment apply to this customer segment, and where is that recorded?
  • What is the baseline verification, and what lower-risk reasoning justifies it?
  • Which signals trigger a step-up, and which control does each step-up add?
  • Is the remote channel itself treated as a factor in the assessment, and which mitigation measures are named?
  • If a customer may use the service before verification is complete, what limits apply and who set them?
  • What is the defined outcome when evidence cannot be validated?
  • Can you show, for a given customer, which rule version produced which path?
  • Was the flow assessed before launch, and is it reassessed when the technology or the threat changes?

Where this sits in a verification flow

A verification flow built on NeuroVision KYC places the identity part of the process in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. Because the scenario is assembled in an editor, the team that owns the risk assessment chooses which steps a given segment receives. The document step detects, classifies and reads IDs, and document anti-fraud checks are included in every package. The liveness step is active: the person moves the face closer through two ovals. The dashboard provides a session log, reports and export, manual decision, roles and a user list. To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us