When to File a SAR
A bank files a SAR within 30 days of initial detection, or 60 days if no suspect was identified that day.
TL;DR: A risk-based approach to AML is the requirement to identify, assess, and mitigate money laundering and terrorist financing risk in proportion to that risk: enhanced measures where risk is higher, and simplified measures only where risk is lower and the rules allow it. The approach is not the written BSA/AML risk assessment. FATF's April 2022 effectiveness report found that over 80 percent of FATF member countries were substantially or highly effective on risk understanding and response, against 19 percent of FATF-style regional body members.
Proportion Is the Whole Standard
A risk-based approach to AML is the rule that preventive measures scale with money laundering and terrorist financing risk. The FATF Recommendations, last updated in June 2026, place that rule in Recommendation 1. Countries apply the approach so that measures to prevent or mitigate money laundering and terrorist financing are proportionate to the risks identified. Financial institutions have to identify, assess, and take effective action to mitigate their own risks. Higher risk calls for enhanced measures. Lower risk, where a country permits it, calls for simplified measures. The same product does not have to carry the same control at every institution, or for every customer inside one institution.
The interpretive note to Recommendation 1 sets the sequence institutions actually run. They keep processes to identify, assess, monitor, manage, and mitigate money laundering and terrorist financing risks. Senior management approves the policies, controls, and procedures. The measures, enhanced or simplified, stay proportionate to the risks identified and consistent with national requirements. One intensity for every relationship is not the approach. Dropping a control because a file was labeled low is not the approach either.
In the United States the same rule already sits inside the program regulation. 31 CFR 1020.210 requires internal controls, independent testing, a designated compliance officer, training, and risk-based procedures for ongoing customer due diligence. The five pillars of an AML compliance program are the container. The risk-based approach is how the work inside that container is sized.
The Document Is Not the Approach
The written BSA/AML risk assessment is the analysis. The risk-based approach is what the institution does after the analysis. The FFIEC BSA/AML Examination Manual says banks structure compliance programs to be risk-based, and that a written assessment, while not a specific legal requirement, is how a bank identifies money laundering, terrorist financing, and other illicit finance risks and builds internal controls to match. Documenting the assessment is sound practice. Filing the PDF and leaving the controls untouched is a different act.
The BSA/AML risk assessment covers how that document is built: products and services, customers, geographies, and delivery channels, read from inherent risk through control effectiveness to residual risk. This article does not repeat that method. The approach starts when a residual-risk conclusion changes customer due diligence, screening, monitoring, or independent testing. A conclusion that changes none of them is an assessment without an approach.
FATF's April 2022 report, drawing on mutual evaluations through December 2021, separates the document from the result. More than 90 percent of the 59 countries in its sample had completed a risk assessment by the on-site visit. On Immediate Outcome 1, which tests whether a jurisdiction understands its risks and acts on them, 3 percent of FATF member countries reached the top rating of high effectiveness. Among members of FATF-style regional bodies, 81 percent were rated low or moderate. Writing the risks down did not, by itself, produce a risk-based regime.
Where the Approach Changes the Work
Four controls absorb the approach. Each one has a margin that risk is allowed to move, and a floor that risk is not allowed to remove. Institutions that treat "risk-based" as a sentence in the policy move neither.
Customer due diligence
Customer due diligence is where proportion is easiest to assert and hardest to show. Under 31 CFR 1020.210 the profile comes from the nature and purpose of the relationship, and customer information, including beneficial owners, is updated on a risk basis. Customer risk rating is how the score is produced. The approach is what the score is allowed to trigger: collection beyond the baseline, the events that force a refresh, and whether enhanced due diligence is a reviewed file or a sentence in a procedure.
FATF's interpretive note lets the intensity differ by stage. An institution can apply ordinary due diligence at acceptance and enhanced monitoring afterward, or the reverse, when the risk factors point that way. A lower rating can lengthen the refresh cycle. A higher rating can require source of funds, a closer look at ownership, and a named reviewer. The rating does not authorize the institution to skip the identification the rule already requires, and simplified measures stop being available once money laundering or terrorist financing is suspected.
Screening
Screening moves with risk at the margin. Match sensitivity, supplemental lists, the rescreening cycle, and the order in which hits are cleared can follow the book and the customer. A domestic payroll portfolio and a cross-border payments book should not share one rescreening calendar. The legal floor does not move with the label. Recommendation 1 still requires full implementation of the targeted financial sanctions in Recommendation 7 where proliferation-financing risk is assessed as lower.
Transaction monitoring
Monitoring is the approach made mechanical. Under 31 CFR 1020.210, ongoing monitoring has two jobs: identify and report suspicious transactions, and, on a risk basis, keep customer information current. Thresholds, scenario coverage, and review speed are the levers. A correspondent account and a consumer checking account can sit on the same platform and still justify different scenarios and a different clock for review. A segment the assessment rates high, and that still shares the retail threshold, is a control that ignored the assessment. A wider band on a lower-risk segment is defensible when the institution can show the risk it relied on. The wider band is not a device for shrinking the queue.
Independent testing
Independent testing is risk-based in scope and cadence, not in whether it happens. The FFIEC manual sets no regulatory frequency. Testing should be commensurate with the institution's risk profile. The manual's example is every 12 to 18 months, with another test when the risk profile, systems, compliance staff, or processes change. AML independent testing requirements cover independence, the report, and the workpapers. A test that samples the quietest product and skips the one the assessment calls high has not followed the approach.
Simplified Measures Have a Floor
Simplified measures are a permission, not a discount on the legal minimum. The interpretive note to Recommendation 1 withholds them whenever there is a suspicion of money laundering or terrorist financing. Proliferation-financing risk can be assessed as lower without any relaxation of targeted financial sanctions. In the United States, the duty in 31 CFR 1020.210 to monitor for suspicious transactions and report them does not step down because a customer risk rating is low. The rating changes how much attention the relationship receives before suspicion arises. Once suspicion arises, the measure has already been selected.
Proportion runs in the other direction with the same discipline. Rating a segment high is an instruction to resource it: enhanced due diligence, tighter monitoring, and a testing sample that includes the segment. Exiting the class to avoid that work is a business decision. Recommendation 1 describes a calibration of controls, not a substitute for having them.
FinCEN's AML/CFT Priorities, issued June 30, 2021, name eight threats, in no particular order: corruption; cybercrime, including cybersecurity and virtual currency; foreign and domestic terrorist financing; fraud; transnational criminal organization activity; drug trafficking organization activity; human trafficking and human smuggling; and proliferation financing. FinCEN said not every priority will touch every covered institution, and that incorporation waited on program regulations. The approach is the decision about which of the eight the institution's products, customers, and corridors actually present.
A Proposal Would Write the Principle Into the Rule
On April 7, 2026, FinCEN proposed an AML/CFT program rule that would make the principle explicit and withdraw its July 2024 proposal. The proposal would require effective, risk-based, and reasonably designed programs, direct more attention and resources to higher risks than to lower ones, and tell examiners and auditors not to replace an institution's risk-based design with a preference of their own. Comments closed on June 9, 2026. The text of 31 CFR 1020.210, last amended in the Federal Register on September 15, 2020, has not been revised to adopt it. The binding standard remains the rule examiners already apply.
Where Sphinx Fits
Sphinx's agents work the cases a risk-based program produces. They apply the institution's own risk ratings and procedures, review the evidence an analyst would review, and record the basis for each disposition, so a higher-risk file does not leave the same write-up as a lower-risk file. Sphinx reports 87 percent fewer false positives, an 80 percent reduction in case review time, and 98 percent of cases resolved the same day. The approach stays with the institution. An agent does not rewrite the assessment, and it does not retire a control the assessment still requires.
Frequently Asked Questions
What is a risk-based approach to AML?
A risk-based approach to AML requires an institution to identify, assess, and mitigate money laundering and terrorist financing risk in proportion to that risk. Higher risk receives enhanced measures, and lower risk may receive simplified measures where the rules allow them. FATF Recommendation 1 sets the international standard, and 31 CFR 1020.210 builds risk-based customer due diligence into the U.S. bank program rule.
Is a risk-based approach the same as a BSA/AML risk assessment?
No. The BSA/AML risk assessment is the written analysis of products, customers, geographies, and channels. The FFIEC manual calls that written assessment sound practice and not, by itself, a specific legal requirement. The risk-based approach is the set of decisions that analysis produces across due diligence, screening, monitoring, and testing.
Can a low-risk customer receive simplified due diligence?
Yes, where the rules allow simplified measures and the institution has assessed the risk as lower. FATF's interpretive note to Recommendation 1 bars simplified measures whenever money laundering or terrorist financing is suspected. A low rating can change refresh frequency and file depth, and it does not remove the identification the program rule already requires.
Does a risk-based approach allow weaker sanctions screening?
It allows the margin to move, not the floor. Rescreening cadence, supplemental lists, and the order in which hits are worked can follow risk, while targeted financial sanctions still have to be fully implemented where proliferation-financing risk is assessed as lower. A low customer rating is not a reason to drop a required list.
How should independent testing follow a risk-based approach?
The FFIEC manual sets no fixed testing frequency. Frequency and sample should match the institution's risk profile, with every 12 to 18 months offered as an example and a further test when the risk profile, systems, staff, or processes change. A risk-based test concentrates on the higher-risk products and segments, and the tester's independence does not scale down with the rating.
