A risk-based approach (RBA) means that countries, competent authorities, and financial institutions:

The risk-based approach (RBA) is a foundational principle of FATF standards. It requires countries, regulators, and financial institutions to identify, assess, and understand their money laundering and terrorist financing risks.

Once risks are understood, entities must apply proportionate mitigation measures. Higher risks require stronger controls, while lower risks may justify simplified measures. However, no risk is ignored or exempted from mitigation.

Regulators do not expect all residual risks to be reduced to low; rather, risks must be managed within an acceptable risk appetite. Resource allocation under an RBA prioritizes AML/CFT activities, not unrelated tasks.

Therefore, the correct definition of an RBA focuses on understanding and managing risk proportionately.