The EBA's ML/TF Risk Factors Guidelines help institutions assess money-laundering and terrorist-financing risks. Customer, country, product and channel risk inform due diligence and ongoing monitoring, with documented decisions supporting controls and suspicious-transaction reports.
TL;DR:
- Institutions assess customer, country, product and channel risks to adapt due diligence.
- Sector guidance covers newer payment and account-access services.
- Risk factors support documented judgement and review, rather than automatic customer conclusions.
Summary
Guidance for risk-based customer due diligence
The EBA's Guidelines on ML/TF risk factors help credit and financial institutions assess risk and select appropriate customer-due-diligence measures. They address the circumstances of a relationship or occasional transaction, rather than supplying a single universal risk score. The general guidance is paired with sector-specific material. This structure recognises that the same customer characteristic can have a different significance when combined with a particular product, geography, delivery channel or business model.
Combining factors instead of using a checklist
Relevant considerations include the customer and beneficial owner, countries or regions involved, the product or service and how it is delivered. The institution needs to consider their combined effect and document its reasoning. A risk indicator should lead to an assessment, not an unsupported assumption that all customers in a category are suspicious. Higher-risk circumstances and lower-risk situations require different treatment within the conditions of the governing AML framework, with the rationale kept clear.
Guidance for payment and account-access models
Revisions include sectoral guidance for payment-initiation and account-information providers, currency-exchange activity and other financial business models. These additions matter because access to information, control over funds and customer interaction differ between services. A provider that initiates a payment and a provider that only aggregates account information do not necessarily see the same data or occupy the same role. The guidelines help relate due diligence to those actual risks instead of relying only on a sector label.
A maintained supervisory reference
The EBA publishes versions, final reports and consolidated documentation, so the version used should be identified. The guidelines support implementation of AML/CFT law and supervisory expectations; they are not a standalone authorisation to conduct a service. Customer information, ownership and activity can change, requiring the original assessment to be reviewed. Effective use therefore connects the onboarding decision, monitoring and later escalation, with current legal requirements and the applicable version of the guidance.
Keywords
- EBA AML
- risk factors
- customer diligence
- geographical exposure
- delivery channels
- payment services
- documented decisions
- ongoing review
- sector guidance
- proportionate controls