The Fourth Anti-Money Laundering Directive (MLD4) puts the risk-based approach at the centre of Europe’s anti-money laundering and countering the financing of terrorism (AML/CFT) regime and recognises that the risk of money laundering and terrorist financing (ML/TF) can vary. It requires Member States, competent authorities and ‘obliged entities’ to take steps to identify and assess that risk with a view to deciding how best to manage it.

Article 48(10) of the MLD4 requires the European Supervisory Authorities (ESAs) to issue joint guidelines to Member State competent authorities (NCAs) on the characteristics of a risk-based approach to AML/CTF supervision, and the steps supervisors should take when conducting AML/CFT supervision on a risk-sensitive basis.

The ESAs have now published these joint guidelines noting that the risk-based approach to AML/CFT supervision is characterised as an on-going and cyclical process that includes the following steps:

• the identification of ML/TF risk factors, whereby NCAs obtain information on both domestic and foreign ML/TF threats affecting the relevant markets;
• the risk assessment, whereby NCAs use this information to obtain a holistic view of the ML/TF risk associated with each credit or financial institution (‘firm’), or group of firms, including the inherent risk to which the firm or group of firms is exposed and the risk mitigants a firm or group of firms have in place;
• the allocation of AML/CFT supervisory resource based on this risk assessment, which includes decisions about the focus, depth, duration and frequency of on-site and off-site activities, and supervisory staffing needs, including technical expertise; and
• monitoring and review to ensure the risk assessment and associated allocation of supervisory resource remains up to date and relevant.

The guidelines make recommendations on the above steps.

The guidelines state that NCAs should incorporate the guidelines into their supervisory processes and procedures by one year after issue.

View Joint Committee of ESAs final version of guidelines on risk-based supervision under MLD4, 16 November 2016