“Risk-based” is the most important phrase in your AML/CTF obligations, and the one I get asked about most.
Usually like this: just tell me what I have to do.
Fair question, and I understand why it gets asked that way. In most venues this lands on one person who is also doing the roster, the renovation and the AGM. A checklist would be easier.
The honest answer is that there deliberately isn’t one. The requirement is for policies, procedures, systems and controls proportionate to the nature, size and complexity of your business, and the legislation stops short of specifying the measures themselves. That’s by design, not by omission: a local bowling club and a major leagues club don’t carry the same risk and shouldn’t run the same program.
Which is better news than it first sounds. You aren’t expected to operate a bank’s compliance function.
But it does put something on you. Risk-based means your controls should match the risk your venue actually carries, and that you can show why you landed where you did. The reasoning is the obligation, as much as the control is.
That’s the part I see venues miss. Not the control itself. The record of why.
Three things that help, and none of them cost anything.
Write down the why, not just the what. Your program says what you do. Add a line on why that’s appropriate for your venue: your patron base, your cash volumes, your location, what you’ve actually seen. In twelve months nobody will remember the reasoning, and it’s the first thing you’ll be asked.
Test it against your own floor. Pick a staff member and ask what they’d do if something didn’t look right. If their answer doesn’t resemble your program, you’ve found the gap before anyone else did.
Revisit it when the business changes. New machines, a renovation, a change in trade, a different crowd. The risk moved, so the assessment should move with it. A risk assessment that hasn’t changed in three years is telling you something.
None of that is about doing less. It’s about being able to explain what you did and why you did it. That’s what risk-based actually asks for, and most venues are closer to it than they think.