Sector Risk Lens for AML/KYC/KYB

A sector risk lens helps analysts ask better questions about how a customer, counterparty, product or transaction can be exposed to ML/TF/PF and broader financial-crime risk. The same customer profile can carry different risk depending on the sector, product, delivery channel, geography and evidence available.

1. Why sector risk matters #

AML/KYC/KYB review is not only about who the customer is. It also depends on where value can enter, move, change form or exit. Sector context changes:

• which documents are meaningful;
• which counterparties matter;
• what normal activity looks like;
• which sources are relevant;
• which red flags need senior review;
• which controls are proportionate.

2. Sector risk map #

3. Detailed sector profiles#

3. Banking and payments profile#

Business model and typical flows#

Banks, payment institutions, e-money firms and similar providers may hold accounts, execute transfers, issue payment instruments or connect customers to wider financial networks.

Primary vulnerabilities#

• high transaction volume can hide unusual activity;
• nested, correspondent or intermediary relationships reduce visibility;
• rapid movement can separate value from its source;
• third-party and merchant flows may not match the stated customer;
• digital onboarding can introduce identity and device uncertainty.

Evidence and monitoring#

Review expected account use, counterparties, countries, payment types, source of funds, merchant or business model, linked accounts, device/IP context where lawful, and changes from expected activity.

Escalation questions#

• Is the customer acting for another person?
• Does the payment route have a credible purpose?
• Are intermediary institutions and beneficiaries understood?
• Is unusual activity a one-off event or a repeated network?
• Do monitoring and CDD tell a consistent story?

4. Crypto and VASP profile#

Business model and typical flows#

VASPs may provide exchange, transfer, custody or other services involving virtual assets. Customers may interact with hosted and unhosted wallets, other VASPs, protocols and fiat payment channels.

Primary vulnerabilities#

• identity and wallet ownership may be uncertain;
• cross-border service location and regulatory status may be unclear;
• value can move rapidly between assets and services;
• high-risk services, obfuscation and sanctions exposure may reduce traceability;
• Travel Rule data can be incomplete or inconsistent.

Evidence and monitoring#

Review VASP status, customer and wallet relationship, transaction references, fiat funding/withdrawals, counterparty information, attribution confidence, transaction purpose, sanctions results and geographic/service exposure.

Escalation questions#

• What does the blockchain record show and what does it not prove?
• Who controls the wallet?
• Is the counterparty a regulated or higher-risk service?
• Can SoF be followed across fiat and virtual-asset legs?
• Which gaps require specialist blockchain, sanctions or MLRO review?

See Crypto / VASP AML.

5. Real estate and property intermediaries profile#

Business model and typical flows#

Property transactions may involve buyers, sellers, developers, lenders, brokers, lawyers, practitioners, special-purpose companies and trusts.

Primary vulnerabilities#

• opaque beneficial ownership;
• high-value transactions and subjective valuation;
• unrelated third-party funding;
• rapid resale or unexplained ownership transfer;
• multiple intermediaries and cross-border funds.

Evidence and monitoring#

Review title, buyer/seller/UBO, purchase agreement, valuation, mortgage, completion, payment records, SoW/SoF and intermediary authority.

Escalation questions#

• Who ultimately owns and benefits from the property?
• Does the customer have the wealth and specific funds to transact?
• Why is the price or structure unusual?
• Are payer, buyer, owner and occupant consistent?
• Does a professional intermediary clarify or obscure the relationship?

See Real Estate, Luxury Assets & Art Risk.

6. Legal, accounting and TCSP profile#

Business model and typical flows#

Professionals may form and administer entities, provide legal or tax advice, maintain records, act as trustee/director, manage client accounts or support transactions.

Primary vulnerabilities#

• the real client or beneficiary may be obscured;
• legal privilege or confidentiality may be misunderstood;
• nominees and layered entities may reduce transparency;
• client accounts or invoices may create an appearance of legitimacy;
• third-party reliance can weaken direct understanding.

Evidence and monitoring#

Review engagement and authority, underlying client, beneficial owner, service purpose, structure rationale, payment role, regulatory status, SoW/SoF and recurring networks.

Escalation questions#

• Who instructs and who benefits?
• Why is the structure or professional account needed?
• Is the adviser independent, regulated and acting within the stated role?
• Are documents supported by the underlying facts?
• Does the intermediary facilitate transparency or prevent it?

See Professional Enablers.

7. Trade, logistics and import/export profile#

Business model and typical flows#

Trade connects buyers, sellers, manufacturers, brokers, freight forwarders, carriers, insurers, banks, customs and end users. Payments and goods may follow different routes.

Primary vulnerabilities#

• documents can be inconsistent or incomplete;
• price, quantity or quality can be difficult to assess;
• intermediaries and transshipment reduce visibility;
• goods may have sanctions, export-control or dual-use relevance;
• payment may come from or go to unrelated parties.

Evidence and monitoring#

Review contract, invoice, purchase order, goods description, quantity, price, shipping, customs, origin/destination, end user, insurance, payment route and counterparties.

Escalation questions#

• Do goods, documents and payments describe one transaction?
• Is the route commercially reasonable?
• Are all intermediaries necessary and understood?
• Does the end user and use make sense?
• Are TBML, sanctions or PF specialist checks required?

See TBML and Sanctions Evasion Typologies.

4. Defensive typology questions#

A safe typology lens asks review questions rather than teaching misuse mechanics:

• What value is moving?
• Who controls it?
• What source explains it?
• What documents support it?
• Does the commercial story make sense?
• Which facts are verified, unsupported or inconsistent?
• Which risk indicators remain unresolved?
• Which reviewer should decide next?

5. What not to do#

AML Bible materials should not convert sector typologies into operational misuse instructions. Avoid:

• step-by-step laundering sequences;
• threshold-avoidance guidance;
• instructions for bypassing screening, monitoring or verification;
• procedural recipes for hiding ownership, source of funds or transaction purpose;
• tactical guidance on exploiting a specific product, bank, VASP or jurisdiction.

6. Analyst output#

A sector-risk note should be short and evidence-linked:

Sector / activity:
Relevant product or service:
Normal activity expected:
Observed activity:
Key sector risk indicators:
Evidence reviewed:
Unresolved questions:
Control or escalation recommendation:

7. Source basis#

• FATF Recommendations for risk-based approach, CDD, ongoing due diligence, record-keeping and internal controls.
• FATF typology and methods reports for safe red-flag and risk-indicator framing.
• AUSTRAC and FinCEN public typology/advisory materials for defensive indicators and monitoring context.
• Practitioner and academic references in the Source Register for professional framing and historical perspective.