An article based on Compliance Café Connect’s session in partnership with FAI Comply.
How many of your high-risk clients are genuinely high risk?
This is the kind of question that sounds simple but carries real weight. In many compliance functions, a substantial portion of the client book sits in the high-risk category, not because of demonstrated behaviour, but because of assumptions baked into frameworks that were designed for a different era.
In a recent Compliance Café Connect session, hosted in partnership with FAI Comply, compliance and risk professionals from across multiple jurisdictions gathered to explore exactly this challenge: how institutions can move from static, assumption-driven risk classification towards a more dynamic, defensible approach.
Remonda Kirketerp-Møller, CEO of Muinmos, shared what she sees working, and what she sees failing, across the institutions she works with globally.
The Problem with Periodic Reviews
Traditional AML risk categorisation frameworks were built for a world with slower regulatory change, more face-to-face client interaction and less available data. Risk was assessed at onboarding, refreshed at fixed intervals, and managed largely through predefined scoring rules.
That model is breaking down, and the consequences are practical, not just theoretical. An inflated high-risk population dilutes attention, overwhelms compliance teams, and paradoxically makes it harder to identify genuinely suspicious activity. It also creates commercial friction: high-risk classifications trigger additional document requests, longer onboarding timelines and service restrictions. For legitimate clients, the experience is frustrating enough to drive them elsewhere.
The most effective AML frameworks are not those that apply the most controls — they are those that apply the right controls, to the right clients, at the right time.
Regulators are catching up to this reality. FATF, the Basel Committee and supervisory bodies across the UK and EU are aligned on the same principle: AML must be risk-based, outcomes-focused and proportionate. The question has shifted from ‘how many controls do you have?’ to ‘can you demonstrate that your decisions were reasonable, proportionate and consistently applied?’
Risk Is Not Static and Neither Should Your Framework Be
One of the most important ideas discussed in the session is what might be called temporal risk: the fact that a client’s risk profile can change even when the client does nothing. New sanctions regimes can be introduced overnight. Geopolitical developments can alter indirect exposure. Ownership structures can change without triggering an immediate review.
Remonda was direct on this point: the periodic refresh model will become meaningless. The data needed to assess risk is increasingly available in real-time. Continuous monitoring, not six-monthly or annual reviews, is where the industry needs to go.
“If you work with providers that enable continuous monitoring, you don’t need to think about it again. Focus your attention on the areas that require genuine human judgement — and let technology handle what it can handle reliably.” – Remonda Kirketerp-Møller
Sanctions screening is a clear example. The legal requirement in many jurisdictions is not only to screen once at onboarding but also to monitor on an ongoing basis. A name that appeared clean at onboarding may not remain so. A client who was determined to mislead you at the point of entry will have known exactly what you were looking for. The real picture often emerges later, through behaviour and transaction patterns.
The Copy-and-Paste Problem
Remonda identified a pattern she sees repeatedly across the market: institutions copying a compliance framework from another organisation and assuming it will work for them. It never does because a framework is only as good as its fit with the specific client base, product set, jurisdictional footprint and counterparty ecosystem of the institution deploying it.
The same logic applies to technology. Remonda’s advice to compliance leaders looking to modernise: understand your own logic before you go looking for a provider to support it. Know your clients. Know your risks. Love your data. Turn that knowledge into a framework you can see, test and explain and then look for technology that can give that framework operational scale.
A RegTech platform is a medium, not a solution. The logic has to come from the institution.
Automating the Routine to Elevate the Human
Technology’s role in this shift is not to replace compliance professionals. Its role is to free them from the work that machines can do reliably, so they can focus on the judgement calls that only humans can make.
Manual passport review, spreadsheet-based sanctions checks, tick-box onboarding processes: these are not just inefficient, they are risky, because they leave human error in processes where consistency matters most. Automating straight-through processing for routine, rules-based decisions is not a threat to compliance teams. It is what allows them to become genuine analysts rather than process-followers.
“If your role is entirely repetitive, that should concern you — because it means it could be done better by a machine. The compliance professionals who will thrive are those who embrace what technology enables and focus their energy on genuinely complex judgement calls.” – Remonda Kirketerp-Møller
Reducing Over-Classification: A Practical Starting Point
One of the most common questions in the session:
My firm has a large high-risk client population. How do we reduce over-classification without increasing regulatory risk?
The answer starts with understanding why that population is so large. In many cases, a single default attribute — operating in crypto, or operating fully remotely is pushing every client into the same risk band. When everyone is high risk, the category loses all meaning.
The approach Remonda recommends was clear: identify your baseline default attributes, define the mandatory responses to them, and then focus your risk management on the factors that are genuinely variable. That is where differentiation and real risk intelligence lives. A regulator reviewing your framework would want to see exactly this: not a uniform high-risk population, but a calibrated approach that reflects the actual distribution of risk in your client base.
Auditability: The New Non-Negotiable
Across the session, one theme recurred consistently: whatever framework an institution builds, it must be explainable. Regulators increasingly expect compliance decisions to be traceable end-to-end, what information was used, what logic was applied, and who approved the outcome.
This applies just as much to the technology supporting those decisions. Institutions cannot point to a piece of software and say ‘this is what we use.’ They need to be able to articulate how the software is configured, why those parameters were chosen, and how the outputs align with the institution’s own risk appetite and client profile.
Regulators are not concerned about whether you use ten tools or one. They are very concerned if your risk decisions cannot be traced end to end.
The compliance leaders who are getting this right are those who treat technology as an enabler of explainable, auditable, consistently applied decisions and not as a substitute for having a coherent framework in the first place.
The Road Ahead
AML compliance is not getting simpler. Sanctions regimes are expanding and accelerating. Digital onboarding is the norm, not the exception. Regulatory data expectations are rising. The institutions that will navigate this landscape most effectively are not those with the most controls, but those with the clearest thinking.
As Remonda put it: “The future of AML risk is not stricter. It is smarter.”
Watch the full session below.
If you would like to explore how Muinmos can support your institution’s approach to client risk categorisation, get in touch.