AML Risk Appetite Statements: What the FCA Expects

A risk appetite statement tells everyone in a firm which money laundering risks it is willing to take on, which it will only take on with extra controls, and which it will turn away. Many firms write one, but it is easy to produce a document that sits in a folder and never changes a decision. This guide looks at what the Financial Conduct Authority (FCA) has said about how risk appetite should connect to risk assessment, using its multi-firm review of risk assessment processes and controls, published on 11 November 2025, and the financial crime guide in the FCA Handbook (FCG 3.2, last updated 29 November 2024).

A note on scope. The FCA's 2025 review covered building societies, platforms, custody and fund services, e-money payments firms and wealth managers. It was not aimed at accountancy firms, which are supervised for AML by bodies such as HMRC and the professional bodies. The principles still travel well, because every firm in scope of the Money Laundering Regulations must carry out a risk assessment. Read the FCA material as a picture of what good looks like rather than as rules for your firm.

Does the FCA require a risk appetite statement?

Not in so many words. FCG 3.2 does not use the term "risk appetite" at all. It focuses on the risk assessment itself, which regulation 18 of the Money Laundering Regulations requires, with proliferation financing risk assessment covered separately by regulation 18A. What the guide does say is that a firm's financial crime controls must be comprehensive and proportionate to the nature, scale and complexity of its activities, and that the risk assessment should be reviewed regularly so that it stays current.

Risk appetite appears in the November 2025 review. There, the FCA describes some firms that can show how their risk appetite, their business-wide risk assessment (BWRA) and their customer risk assessment (CRA) processes work together. In its good practice, the BWRA feeds into risk appetite, controls testing and the overall risk-based approach. So the regulator's interest is less in whether a statement exists and more in whether it is connected to everything else.

What the FCA found about the BWRA

The review does not give percentages. It says that most firms have a BWRA, few tailor it to their own business, and very few document the actions that follow from it. Those three observations matter for risk appetite, because a statement can only be as good as the assessment behind it.

The FCA's examples of good practice for the BWRA include:

• using both quantitative and qualitative assessment, weighted, and drawing on internal and external factors
• covering inherent risk, control effectiveness and residual risk
• carrying out a formal annual review rather than a simple refresh
• tailoring the assessment to the firm's own products and customers, with documented management of those risks
• senior oversight, including documented challenge and approval

Its examples of poor practice include a focus on fraud or generic risks while overlooking money laundering, sanctions, bribery and corruption, proliferation financing and terrorist financing; purely qualitative assessments; unclear methods for assessing inherent risk; concluding that risk is low or controls effective without enough evidence; not recording actions or assigning owners; and failing to update the assessment as the business grows. The FCA also saw little evidence that risk assessment, decision-making and monitoring were joined up.

Where risk appetite goes wrong: lessons from FCG 3.2

The FCA Handbook guide lists poor practices that are, in effect, failures of risk appetite in action. They include a risk classification system that makes a "high risk" rating almost impossible, higher-risk countries being scored low to avoid enhanced due diligence, relationship managers overriding customer risk scores without enough evidence, risk assessments being unduly influenced by the potential profitability of a relationship, and a firm being unable to evidence why customers are rated high, medium or low. A UK branch or subsidiary relying on group risk assessments without checking UK compliance is also listed.

Each of these is a case where the stated appetite and the real behaviour have drifted apart. If your statement says you will not take certain risks but a commercially important client can override the score, the statement is not doing its job.

What a useful statement could contain (our suggestions)

The FCA does not prescribe a format, so the following is our own practical framework, not a regulatory template. A statement that links to your assessment might cover:

• Risks you accept: the customer types, services and geographies your BWRA shows you can manage with standard controls.
• Risks you accept only with conditions: for example, which situations always need senior approval or enhanced due diligence.
• Risks you will not accept: clear decline or exit triggers, written so that two people reach the same answer.
• Who decides: who can approve exceptions, and how overrides are recorded and reviewed.
• How it is tested: which management information shows whether the firm is operating within appetite.
• When it is reviewed: at least at each annual BWRA review and after any material change.

Linking appetite to day-to-day decisions

The test of a statement is whether it changes outcomes. One way to check is to follow a single client through the process. Does the customer risk rating use the factors your BWRA identified? Does a high rating trigger the controls the statement promises? Is an exit decision traceable to a written trigger? Our guides on client risk rating, acceptance and exit and on doing a firm-wide AML risk assessment cover the mechanics behind those links.

Reporting upwards

A statement also needs a feedback loop. Senior management should see regular information on how the firm is performing against its stated appetite, including exceptions and overrides. The MLRO's annual report is a natural place for this, and our guide to what to include in an MLRO annual report explains the FCA's expectations. For a wider view of how the FCA is testing firms' controls, see our summary of the FCA review of asset management and private markets firms.

Frequently asked questions

Is a risk appetite statement a legal requirement?

The Money Laundering Regulations require a risk assessment, and FCG 3.2 requires controls proportionate to the firm's activities. Neither, on the pages we reviewed, uses the phrase "risk appetite statement" as a requirement. Check your own supervisor's guidance, as expectations can differ.

How often should it be reviewed?

The FCA's good practice describes a formal annual review of the BWRA, not a simple refresh, and FCG 3.2 says firms should regularly review their risk assessment. Aligning the statement with that cycle is a sensible approach.

Who should approve it?

The FCA's good practice for the BWRA includes senior oversight with documented challenge and approval. Applying the same standard to the risk appetite statement is our suggestion.