On 26 June 2015, Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (ML/TF) entered into force. It recognised that the risk of ML/TF can vary and that Member States, competent authorities and obliged entities have to take steps to identify and assess that risk with a view to deciding how best to manage it. It also required the European Supervisory Authorities (ESAs) to issue guidelines on key aspects of the risk-based approach. In June 2017, the three ESAs issued Guidelines on risk factors and simplified and enhanced customer due diligence (JC 2017 37). These guidelines set out factors firms should consider when assessing the ML/TF risk associated with a business relationship or occasional transaction. They also set out how firms can adjust the extent of their customer due diligence measures in a way that is commensurate to the ML/TF risks they have identified.

Since then, the applicable legislative framework in the EU has changed, and new risks have emerged. On 9 July 2018, Directive (EU) 2018/843 entered into force. This directive amended Directive (EU) 2015/849 and introduced a number of changes that warranted a review of the Risk Factors Guidelines to ensure their ongoing accuracy and relevance; this was the case in particular in relation to the provisions on enhanced customer due diligence related to high-risk third countries.

Furthermore, the ESAs' 2019 Joint Opinions on the ML/TF risk affecting the EU's financial sector highlighted ongoing concerns, by competent authorities across the EU, about firms' identification and assessment of both business-wide risk and the risk associated with individual business relationships, and the application of CDD measures.