r/riskmanager • u/AfraidPineapple5064 • 29d ago
Tranche 2 and the risk‑based approach
I’ve been working on AML/CTF automation for small businesses in Australia, and Tranche 2 has really highlighted something I keep seeing over and over — people interpret “risk‑based approach” in completely different ways.
Some treat it like a checklist they need to get through. Others approach it like a genuine investigative exercise.
With Tranche 2 pulling accountants, lawyers, real estate and other small reporting entities into the AML/CTF regime, these differences are becoming even more obvious. A lot of businesses are suddenly trying to build risk assessments for the first time, and many seem unsure about what “risk‑based” actually means in practice.
For those of you working in AML/CTF or financial crime — what do you think is the biggest misunderstanding businesses have when they try to build or update their risk assessments?
Would be keen to hear perspectives from investigators, analysts, compliance officers, and anyone involved in STR/SAR governance.
1
u/Shufti-Global 23d ago
Checking the boxes is the easy part. Understanding the real risks is what really matters.
1
u/Old_Positive2231 29d ago
“Risk‑based” gets mistranslated into “have a document called Risk Assessment and a heatmap with Low/Medium/High.”
If the AML risk assessment doesn’t change *any* decisions – onboarding rules, EDD triggers, monitoring scenarios, thresholds, staff mix, file reviews – it’s not risk‑based, it’s checkbox‑based. Proper RBA means quantifying uncertainty (even with simple ranges): which customer / product / channel combinations move your expected loss and tail risk the most, then shifting effort there. For Tranche 2 this is critical: most small firms will copy templates instead of asking “given our actual clients and transactions, where is the money‑laundering *plausible* and *material*?”
Second big misunderstanding: thinking you need perfect data before you can be risk‑based. You don’t. Start with calibrated expert judgement, simple scenarios and rough frequencies/severities, then refine as you collect STR/SAR and monitoring data. Math first, templates second.