Compliance
The risk-based approach in a family office
Updated: · Leutrim Miftaraj, FLIORE · Editorial standards · Deutsche Fassung
Short answer
The risk-based approach requires a family office to scale its due diligence to the risk of each business relationship: simplified measures for low risk, enhanced measures for higher risk. It rests on documented risk factors such as country links, structure, PEP status, source of wealth and the type of transactions. Switzerland, Germany, Austria and Liechtenstein anchor it in their anti-money-laundering law; it goes back to FATF Recommendation 1.
What the approach means
Instead of treating every relationship the same, the family office deploys its resources where the risks lie. A family resident in Switzerland with a single holding and wealth traceable to a company sale requires different checks from a structure with trusts in several countries and a politically exposed family member.
The approach works on two levels: in the risk analysis of the office itself, which sets the criteria and measures, and in the classification of each individual relationship. Both levels must fit together and be documented in writing.
Legal basis in German-speaking Europe
- Switzerland: Art. 6 AMLA requires the type and purpose of the business relationship to be clarified according to risk; the FINMA Anti-Money Laundering Ordinance lists criteria for higher risks.
- Germany: section 3a GwG expressly prescribes the risk-based approach; sections 14 and 15 GwG govern simplified and enhanced due diligence.
- Austria: the Financial Markets Anti-Money Laundering Act (FM-GwG) requires an enterprise-wide risk assessment and risk-dependent due diligence.
- Liechtenstein: the Due Diligence Act (SPG) follows the same principle under supervision of the FMA Liechtenstein.
- EU: from 10 July 2027 the Anti-Money Laundering Regulation (EU) 2024/1624 applies directly in Germany and Austria.
From classification to measures
- Set criteria and weighting in internal directives.
- Classify every relationship at onboarding and record the reasons.
- Apply measures per level: evidence, review interval, senior management approval for high risk.
- Reclassify on events such as a new beneficiary, a screening hit or a move to a high-risk country.
- Review periodically – for example annually for high risk and every two to three years for low risk; the office sets the interval itself.
Common mistakes
Audits repeatedly find the same patterns: a classification at onboarding that is never revisited; criteria nobody wrote down; "medium" as a convenient default; an internal rating that softens objective factors instead of tightening them. Reviewers ask not only for the result but for the reasoning – without it, the duty is considered unfulfilled.
In FLIORE
FLIORE assesses each mandate by country (all 249 ISO countries with FATF status and date), industry, PEP flag and further country links of the linked persons. The highest band applies; an internal rating can only tighten, never soften. Due reviews appear in the compliance calendar. The classification supports decisions – responsibility stays with the person in charge.
At a glance
| Origin | FATF Recommendation 1 |
|---|---|
| Levels | Risk analysis of the office and classification of each relationship |
| Result | Graduated due diligence: simplified, standard, enhanced |
Frequently asked questions
May a family office classify all relationships as low risk?
Only if the criteria support it. A blanket classification without reasons does not survive an audit; country links, multi-layer structures or PEP status often require a higher level.
How many risk classes are needed?
The law prescribes no number. Three or four levels are common, such as low, medium, high and prohibited. What matters is that each level is linked to concrete, verifiable measures.
Does the approach apply to a single family office?
Yes, if the single family office is subject to anti-money-laundering law, which depends on country and activity. Even without being subject to it, banks request risk-related information that can be answered cleanly with the same system.
What changes with the EU regulation from 2027?
It harmonises due diligence across the EU and applies directly from 10 July 2027, including in Germany and Austria. Switzerland is not an EU member but also aligns its law with FATF standards.
Sources
- FATF Recommendations – Financial Action Task Force
- German Money Laundering Act (GwG), section 3a – Risk-based approach
- Swiss Anti-Money Laundering Act (AMLA/GwG, SR 955.0) – Fedlex
- Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation) – EUR-Lex
This page provides orientation and does not replace legal or tax advice. The cited legal sources in their applicable version are authoritative.
Read more
FLIORE in your family office
See structures, compliance and consolidated wealth with your own questions – in a personal demo.