Risk-Based AML only works if the C-suite agrees what ‘risk’ means

There is a palpable tension that governs most financial crime programs in the United States. Banks build their AML programs on the principle of risk-based compliance. They say it to regulators, write it into policies, and showcase it in governance decks. Yet inside most institutions, the way risk is actually treated often tells a different story.

Ask a compliance officer what the AML program’s mission is, and you’ll get the same answer almost every time: stop financial crime. Ask the C-suite what the institution’s risk appetite is, and you’ll likely hear some variation of make this work, grow responsibly, take smart risks, manage exposure, and keep the business moving. Neither is inherently wrong. But in practice, the distance between those two mindsets is where risk-based AML programs begin to fail.