Your compliance team faces a resource allocation problem. You've got hundreds, maybe thousands, of third-party relationships: vendors, distributors, agents, consultants, joint venture partners. Financial crime risks lurk in any of them. Do you apply the same rigorous due diligence to every relationship, or do you tier your approach based on risk?
This isn't an academic debate. The UK's Failure to Prevent Fraud criminal offense shifts liability directly to your organization for third-party misconduct. Money laundering regulations in the EU and UK are tightening. Sanctions regimes are expanding to cover cryptocurrency exchanges, creating new opacity in the financing chain. Geopolitical upheavals, such as wars in Iran and Ukraine and shifting political dynamics in Venezuela, are redirecting criminal activity through new channels.
You can't ignore any third party, but you can't investigate everyone like they're a high-risk intermediary in a sanctioned jurisdiction. Where do practitioners actually draw the line?
The Case for Comprehensive Due Diligence
Some compliance leaders argue you can't afford to tier your approach anymore. The "low-risk" vendor you barely screened becomes the conduit for sanctions evasion or the shell company laundering proceeds. Criminal networks specifically target organizations that rely on risk segmentation, probing for the gaps in your second and third tiers.
The comprehensive approach applies a baseline standard across all third parties: beneficial ownership verification, sanctions screening, adverse media checks, and periodic re-screening. You don't skip steps based on relationship size or perceived risk. You build a uniform process and scale it through technology.
This model offers defensibility. When regulators or law enforcement ask why you missed red flags in a particular relationship, you can't say "we categorized them as low-risk." You can say every third party went through the same verification protocol. That consistency matters when you're defending against a Failure to Prevent offense, where the burden sits with you to prove adequate procedures.
It's also operationally simpler. You don't need governance around risk-tiering decisions. You don't create exceptions processes or document why a particular vendor got lighter screening. You build one workflow and apply it uniformly.
The technology exists to make this viable. Automated screening platforms, beneficial ownership registries, and continuous monitoring tools can process high volumes without proportional staff increases. The marginal cost of screening one more entity has dropped significantly.
The Case for Risk-Based Due Diligence
The counter-argument: comprehensive due diligence creates compliance theater. You spend resources verifying beneficial ownership for your office supplies vendor while under-resourcing the deep investigation your sales agents in emerging markets actually need. You generate thousands of screening alerts that desensitize your team to genuine risk signals.
Risk-based advocates point to the principle embedded in most regulatory frameworks: you allocate resources proportional to risk. A low-value, domestic vendor with transparent ownership and no sanctions exposure doesn't warrant the same scrutiny as an intermediary operating in a jurisdiction with weak anti-corruption enforcement.
This approach lets you go deeper where it matters. Instead of surface-level checks on everyone, you can fund enhanced due diligence on high-risk relationships: on-site visits, detailed financial analysis, reference interviews, periodic audits. You can afford specialized investigators for cryptocurrency-related counterparties or relationships in geopolitically volatile regions.
Risk-based models also acknowledge resource constraints. Compliance teams aren't infinite. If you mandate the same process for 5,000 third parties, you either automate to the point of missing nuance or create backlogs that delay legitimate business. Risk segmentation lets you clear low-risk relationships quickly while investing time in substantive investigation.
The regulatory environment supports this. Most anti-money laundering and anti-bribery frameworks explicitly endorse risk-based approaches. They expect you to assess and categorize risk, then tailor your controls accordingly. A purely comprehensive model might actually indicate you haven't done the risk assessment regulators expect.
Where Practitioners Actually Land
Most organizations don't choose one approach exclusively. They build a hybrid: baseline standards for all third parties, with enhanced procedures triggered by risk factors.
The baseline typically includes automated sanctions screening, basic beneficial ownership verification, and adverse media searches. Every third party gets this minimum, regardless of size or sector. It's the floor, not the ceiling.
Then you define escalation criteria. Geographic risk factors (operations in high-risk jurisdictions), relationship characteristics (agents with discretionary authority, joint venture partners, cryptocurrency exchanges), transaction patterns (high-value contracts, cash-intensive businesses), and ownership structures (complex beneficial ownership, shell companies, politically exposed persons) all trigger enhanced procedures.
The challenge is governance. You need clear, documented criteria for what triggers enhanced due diligence. You need approval workflows for exceptions. You need periodic review of your risk factors as geopolitical conditions shift. When wars redirect criminal financing routes or new regulations extend to cryptocurrency platforms, your risk model must adapt.
Technology helps, but it doesn't solve the judgment problem. Automated screening catches known sanctions targets and obvious adverse media. It doesn't catch the sophisticated layering of beneficial ownership or the agent who's technically compliant but operates in ways that create fraud risk. You still need experienced investigators making calls on ambiguous situations.
Our Take
Risk-based due diligence is the right framework, but only if you define "baseline" rigorously and update your risk factors continuously.
The mistake isn't tiering your approach. It's setting the baseline too low or letting your risk categories ossify. If your baseline is just a name-match sanctions check, you've created the gaps criminal networks exploit. If your high-risk criteria still focus on traditional money laundering vectors while ignoring cryptocurrency channels or emerging geopolitical risks, you're fighting yesterday's threats.
Build your baseline to address the most common financial crime vectors: verify beneficial ownership to at least one natural person, screen against current sanctions lists, check for adverse media in the past three years, and confirm the business purpose makes commercial sense. That's not comprehensive due diligence, but it's substantive enough to catch obvious red flags across your entire third-party population.
Then define your enhanced triggers with specificity. Not just "high-risk jurisdiction" but which jurisdictions and why. Not just "complex ownership" but what level of layering triggers deeper investigation. Document these criteria and review them quarterly, because geopolitical upheavals and regulatory changes (like the UK's Failure to Prevent Fraud offense) shift the risk landscape faster than annual policy reviews capture.
The tradeoff you're accepting: you'll apply lighter scrutiny to some relationships that might later prove problematic. That's inherent in resource allocation. But if your baseline is robust and your escalation criteria are current, you've built defensible procedures that focus investigative resources where financial crime risk is genuinely concentrated.
