Wolfsberg Group Risk-Based Approach Guidance (June 2026) Explained

In June 2026 the Wolfsberg Group published updated Guidance on the Risk-Based Approach (RBA). The Group is an association of thirteen global banks, based in Basel, that develops frameworks and guidance for managing financial crime risk. Its guidance is industry guidance, not legislation or a regulator's rule, but supervisors and compliance teams read it closely because it shows how large banks are being encouraged to think about proportionality. This guide sets out what the guidance says, using the Group's own description of it. If you build or review a firm-wide risk assessment, our guide to the firm-wide AML risk assessment is a natural companion.

A note on sourcing: we read the Wolfsberg Group's own page for the guidance, which describes the document in detail. We could not open the PDF itself because the site blocks automated access to it, so the quotations and structure below follow that page. Read the full PDF before you cite it.

Where the guidance comes from

The Group first addressed the risk-based approach in 2006 with its Guidance on an RBA for Managing Money Laundering Risks. The June 2026 version updates that work and draws on the Group's Statement on the RBA. It describes how financial institutions can design and maintain a financial crime risk management programme covering risk appetite, policies, measures and controls. It defines the RBA as identifying, understanding and assessing financial crime risks and taking proportionate action, in line with the FATF definition. It uses the term financial crime rather than only anti-money laundering, and treats references to AML as including counter-terrorist and counter-proliferation financing.

The three elements: proportionality, prioritisation, effectiveness

The Group recommends that firms be able to demonstrate three things.

1. Proportionality

The programme should fit the firm's size, scale, footprint, customers and risk appetite. The guidance says a one-size-fits-all approach is not risk-based. The tools it points to include national risk assessments, dialogue with public authorities and law enforcement, a financial crime risk appetite set by senior management, and business-wide and targeted risk assessments covering customers, industries, countries and products. It describes risk assessment as a dynamic, business-as-usual process rather than an annual document. For more on risk appetite, see our guide to the AML risk appetite statement and business-wide risk assessment.

2. Prioritisation

Resources should go to higher-risk customers and activities. The guidance says measures that are redundant, duplicative or unproductive should be stopped, reduced or redesigned. It groups risk variables into two questions:

• Who the customer is: customer type (for example non-resident customers, nominee shareholders or bearer shares), industry (for example cash-intensive businesses or money service businesses), legal structure and formation date, public listing status, and exposure to higher-risk countries.
• What the customer does: changes in profile, transactional behaviour measured against the stated purpose, unusual use of products, and insights from screening and monitoring.

3. Effectiveness

The focus is on outcomes rather than rules alone. The guidance draws on the Wolfsberg Factors, which cover compliance with AML and counter-terrorist financing laws, reasonable risk-based controls, and providing useful information to government agencies in priority areas. It also stresses traceable governance that avoids unnecessary complexity.

What it says about supervisors and auditors

The guidance asks supervisors and auditors to focus on outcomes and to tailor testing to each firm's risk profile. It warns against "zero-failure" expectations and "no SAR left behind" approaches, which it says can drive over-alerting, cost and customer friction. A commentator on the guidance reported the Group's wider message as moving away from a tick-box approach towards outcomes-based monitoring, and noted that the Group stresses financial crime cannot be reduced to zero. That summary is the commentator's, not ours.

Training and culture

Training should be risk-based in frequency, delivery and focus, with targeted training for higher-risk roles. It should build critical thinking, encourage staff to escalate concerns, and be supported by leadership setting the tone from the top. Our guide to the Wolfsberg correspondent banking questionnaire shows another Wolfsberg tool in practice.

What this means for smaller firms

The guidance is written for financial institutions, not accountancy practices or law firms, so none of it is a requirement for them. The underlying idea does carry over, and these are our suggestions rather than anything the guidance says:

• Ask of each control whether it is aimed at a risk you have actually identified.
• Write down the risk factors you use for clients, such as structure, industry and geography, so reviewers can see the logic.
• Review controls that produce a lot of work and little useful output, and record what you changed and why.
• Escalate unusual client behaviour against the stated purpose, not only against a checklist.

For training on risk assessment and customer due diligence, see the Learnsignal CPD courses.

What we could not confirm

We could not read the PDF, so we cannot quote its section numbering, examples or tables. The publication date is shown on the Wolfsberg page as June 2026, and one commentary gave 23 June 2026, which we have not confirmed from the Group. We also did not check how any regulator has responded to the guidance.

Frequently asked questions

Is the Wolfsberg guidance legally binding?

No. It is guidance from an association of banks. It is useful because it shows how large banks are encouraged to apply a risk-based approach.

What are the three elements?

Proportionality, prioritisation and effectiveness.

Does it apply to accountants?

It is written for financial institutions. Accountancy firms are not its audience, but the approach to proportionality and prioritisation is relevant when you design client risk assessments.

Does it say risk can be eliminated?

No. It warns against zero-failure expectations and stresses focusing on the highest risks.

Learnsignal publishes this guide for general education only. It is not legal or compliance advice.