---
title: "Risk-Based Monitoring"
url: "https://mahouse.world/glossary/risk-based-monitoring"
type: "glossary term"
topic: "Financial crime"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-09-09"
---

# Risk-Based Monitoring

Risk-based monitoring is the practice of scrutinising customers and transactions in proportion to the risk each presents — tighter thresholds, more frequent review and deeper questions for the higher-risk, lighter and automated controls for the rest — rather than applying one rule to everyone. It is what the FATF standards and every anti-money-laundering regime require, and the difference between a compliance function that finds cases and one that drowns in alerts.

**Also known as:** Risk-based approach, Risk-based transaction monitoring

## Key facts

- **Used at:** transaction monitoring, customer risk rating, periodic review cycles, screening, and the allocation of compliance staff
- **Binding:** yes — the FATF's first recommendation is the risk-based approach, and national law (the EU's AML directives, the UK's Money Laundering Regulations, the US Bank Secrecy Act regime) requires a documented risk assessment behind the controls
- **Typical mechanism:** a customer risk rating (low, medium, high) from factors such as geography, product, channel, occupation and PEP status; monitoring rules and review frequency set per rating
- **Typical result:** alerts fall, cases found per alert rise, and the regulator gets a document explaining why each threshold is where it is
- **Parties:** the firm's compliance function, its money-laundering reporting officer, the regulator, and the auditors who test the model

## How risk-based monitoring works in practice

The starting point is a risk assessment: what money-laundering and terrorist-financing risks the firm's products, customers, countries and channels create, in writing, reviewed yearly. From it comes a customer risk model — each customer scored on the factors that matter for this business — and from the score come the controls. A low-risk salaried customer with a domestic current account is monitored by a few automated rules and reviewed every three years; a high-risk customer — a cash-intensive business, a politically exposed person, a company with owners in a high-risk jurisdiction — gets enhanced due diligence at onboarding, tighter thresholds, senior-management approval and annual review.

Monitoring rules then differ by segment. A €9,000 cash deposit is unremarkable for a restaurant and an alert for a student; a rule set that cannot tell them apart produces false positives on one and misses on the other. Segmented thresholds, calibrated on each segment's actual behaviour and tested against known cases, are what "risk-based" means in the monitoring system.

The cost of doing this well is a model that must be governed: documented, validated, tuned on evidence and explained to the regulator. The cost of not doing it is either a backlog of alerts nobody can clear or a system so loose it catches nothing — and enforcement actions against fintechs have described both.

## Example

A payments company rates its 400,000 customers: 88% low, 10% medium, 2% high. Before segmentation, one rule set produced 12,000 alerts a month and 210 suspicious activity reports. After: low-risk customers get four automated rules with thresholds set at the 99.5th percentile of their own behaviour; medium get twelve; the 8,000 high-risk customers get twenty rules, tighter thresholds and quarterly review by a named analyst. Alerts fall to 6,800 a month and reports rise to 245, of which 190 come from the 2% of high-risk customers. The team of 25 analysts clears the queue for the first time, and the firm can show its regulator a threshold document for every rule.

## Common mistakes

- A risk assessment written for the regulator and never used to set a threshold.
- Rating customers once at onboarding and never again, so the student who became a cash business is still low-risk.
- Thresholds set by round numbers rather than by the segment's behaviour.
- Calling a system risk-based because it has three risk ratings, while every rating shares the same rules.
- Tuning to cut alerts without a back-test against the cases that were found.

## Related terms

- [Transaction Monitoring](https://mahouse.world/glossary/transaction-monitoring.md)
- [False Positives](https://mahouse.world/glossary/false-positives.md)
- [Customer Due Diligence](https://mahouse.world/glossary/customer-due-diligence.md)
- [Enhanced Due Diligence](https://mahouse.world/glossary/enhanced-due-diligence.md)
- [AML](https://mahouse.world/glossary/aml.md)
- [Politically Exposed Person](https://mahouse.world/glossary/politically-exposed-person.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov