The RBA: origin and definition

There is now a global AML regime that Member States have enacted following the recommendations of Financial Action Task Force (FATF),^[1] as well as standards set out by the European Union (EU).^[2] Prior to the RBA, there was a focus on complying with the rule-based approach. The rule-based approach set out clear criteria on what constituted a suspicious transaction - for example, a list of prohibited activities or specific transactions that required customer due diligence.^[3]

The rule-based approach was quick to falter due to reasons that may now seem obvious. Rules were considered too prescriptive, which meant that there was no freedom left for regulated entities^[4] to use their own initiative.^[5] It also tailed in the very objective of combatting the crime, as the money launderer was often one step ahead and devised new strategies to circumvent the rules. One such example is depositing sums of money just below the threshold that would require the reporting of that transaction, therefore avoiding the trigger to generate a suspicious transaction report.^[6]

From the regulated entity’s point of view, the rule-based approach encouraged a ‘tick-box’ exercise,^[7] whereby if the rules had been applied, which was required equally in all instances, not much else needed to be done.^[8] The rule-based AML regulatory system resulted in an ‘information overload’ by way of over-reporting of suspicious transactions and thereby reducing the investigative capacity of law enforcement agencies.^[9] As a result, the large number of SARs generated under this system became a recognised problem.^[10] The regulated entities were clearly not proving to be discerning partners in the fight against money laundering, and law enforcement was failing as well.

In this stifling environment, the introduction of the RBA was seen as a breath of fresh air. This new approach was intended to result in SARs that would lead to a ‘productive regulatory or law-enforcement response,’^[11] with regulated entities recognising ‘existence of the risk(s), undertaking an assessment of the risk(s) and developing strategies to manage and mitigate the identified risks.’^[12]' However, it, nonetheless, brought similar problems as the rule-based approach.^[13]

The RBA does not have a set definition, as the very essence of the approach is to provide flexibility to the regulated entities. In following the RBA, entities are expected to group customers into high-, standard-, and low-risk categories. This decision is based on variables such as country or geographic risk, customer risk, and product or service risk,^[14] all of which may increase or decrease the perceived risk posed by a particular customer or transaction. Thus a reporting officer is required to group a customer into one of the three categories depending on the information provided by the customer and the documents received. However, these categories are not well defined and the decision where to place the customer is a complex one. A ‘one-size-fits-all’ approach will not apply as the risk assessment for each bank should be based on a holistic view of the information obtained in the context of their application of customer due diligence (CDD) measures through the RBA, thereby preparing a customer risk profile. This will determine the level and type of ongoing monitoring and support the bank’s decision whether to enter into, continue, or terminate the business relationship.^[15] Whilst recognising that banks are at a high risk of money laundering, the Home Office and HM Treasury have also placed the RBA at the heart of AML compliance, necessitating the requirement for relevant persons subject to Money Laundering Regulations 2017 (‘ML Regs’) to identify, assess, manage, and mitigate risk for the purposes of preventing and detecting money laundering and terrorist financing.^[16]

[1] FATF, International Standards on Combatting Money Laundering and the Financing of Terrorism and Proliferation (FATF/OECD, 2012). For further discussion of the global AML regime, see Bergstrom, M., ‘The global .AML regime and the EU AML directives: Prevention and control’ in King, C., Walker, C., and Guruli, J. (eds.), The Palgrave Handbook of Criminal and Terrorism Financing Law (Palgrave MacMillan, 2018).
[2] Directive 2015/849 (fn 2).
[3] FATF, The Forty Recommendations of the Financial Action Task Force on Money Laundering (1990).
[4] In this chapter, regulated entities or regulated organisations refer to those with obligations to disclose suspicions of criminal property or money laundering.
[5] Ai, L., Broome, J. and Yan, FL, ‘Carrying out a risk-based approach to AML in China: Partial or full implementation?’ (2010) 13(4) Journal of Money Laundering Control 394.
[6] Takats, E., ‘A theory of “Crying Wolf”: The economics of money laundering enforcement’ (2011) 27( 1) Journal of Law, Economics & Organization 32.
[7] Harvey, I. and Lau, S., 'Crime-money, reputation and reporting’ (2009) 52 Crime Law and Social Change 57.
[8] Ross, S. and Hannan, M., 'Money laundering and risk-based decision-making’ (2007) 10 Journal of Money Laundering Control 106.
[9] Levi, M. and Reuter, P., “Money laundering’ (2006) 34(1) Crime and Justice 289.
[10] KPMG (Professional Services Network), Review of the Regime for Handling Suspicious Activity Reports (2003).
[11] Harvey and Lau (fn 12).
[12] FATF, Guidance on the Risk-Based Approach to Combating Money Laundering and Terrorist Financing: High Level Principles and Procedures (2007).
[13] Challenges posed by the risk-based approach are discussed in section 3 of this chapter.
[14] FATF, Specific Risk Factors in Laundering the Proceeds of Corruption (2012).
[15] FATF, Risk-Based Approach Guidance for the Banking Sector (2014).
[16] Home Office & HM Treasury, National Risk Assessment of Money Laundering and Terrorist Financing 2017(2017).