Wolfsberg’s New Risk-Based Playbook

On 22 June 2026, the Wolfsberg Group published updated Guidance on the Risk-Based Approach, representing the collective view of its twelve member banks. The guidance states its central argument in eight words: “a focus on everything is a focus on nothing.”

For compliance teams still running country-wide screening lists, that is a direct instruction to stop. It also lands squarely inside the argument the main piece makes. Risks that move as a network should not be assessed one jurisdiction at a time.

What the Guidance Actually Says

The guidance is built on three principles. Proportionality requires a financial crime programme sized to an institution’s actual footprint, not a generic template.

Prioritisation means directing resources at the highest-risk customers and activities and stopping or redesigning controls that add little value.

Effectiveness means judging a programme by demonstrable outcomes, not by the number of checks completed.

None of this is a first draft. Wolfsberg’s original risk-based approach guidance dates to 2006. This update revises that framework rather than replacing it.

Why Now

The timing is not incidental. FATF’s own reforms to Recommendation 1 push in the same direction, explicitly rejecting what the industry calls a “zero failure” approach to financial crime compliance.

FATF has separately and repeatedly warned against a related failure mode. Terminating business relationships with entire regions or classes of customer, rather than assessing risk individually, is exactly that mistake.

Wolfsberg’s guidance gives banks a practical framework for acting on both pressures at once.

What Changes for a Risk Committee

For a risk committee, the guidance is a mandate to review three specific documents. They are correspondent due diligence questionnaires, country-risk rating models and the criteria used to exit a relationship altogether.

Each should be tested against a single question. Does this control target actual risk, or does it exist because removing it feels harder to defend than keeping it?

A country-risk model that scores every customer in a jurisdiction identically is the kind of blanket control the guidance singles out for redesign. It ignores individual transaction behaviour entirely.

Proportionality means the model should reflect the customer, not just the country on their file.

Where the Discipline Has a Limit

That discipline cuts both ways. Wolfsberg’s own language leaves room for stopping a relationship entirely when it no longer earns its cost. But FATF has been explicit for over a decade that this discretion is not licence for wholesale de-risking.

FATF defines that practice as cutting loose entire countries or classes of customer without individual assessment.

The distinction echoes in the main analysis, An Organised Crime Economy That Ignores Borders. That piece makes the same point about jurisdiction-wide screening.

Treating a category as the unit of risk, instead of the behaviour inside it, is the same mistake. This guidance and that argument was both built to correct it.