The risk-based approach is at the core of the international AML/CTF regime. It requires governments to adopt regulations taking account of the money laundering and terrorist financing risks within their particular jurisdictions and, similarly, tailor enforcement of those regulations to the ML/TF risks facing individual businesses therein. Yet under the risk-based approach, businesses are responsible for determining what risks they face, and how best to mitigate them; with regulators retaining the power to oversee such decisions and, most importantly, question them. This leads to a tension in which businesses must decide what are their own levels of risk, but are subject to such being second-guessed. This issue has notably arisen in the Cayman Islands decision of Maples Corporate Services Ltd and MaplesFS Ltd v Cayman Islands Monetary Authority, in which the Maples entities successfully challenged the Cayman Islands Monetary Authority’s assessment that they had failed to meet their obligations with respect to Customer Due Diligence. This was on that basis that Maples was permitted to exercise its own judgment in making risk assessments of customers, and their transactions, and in deciding the appropriate CDD measures to be deployed. The judgment, and what it represents, is an important case study which calls into question the differing roles held by businesses and regulators under the risk-based approach. Accordingly, this chapter examines the decision, and its reasoning, to determine what lessons it can teach. The chapter argues that the challenges raised by the case are inherent to the risk-based approach, but that it is still superior to more prescriptive methods. As such, in order for the risk-based approach to be properly implemented, the decision in Maples militates in favour of greater guidance from regulators, and cooperation between them and businesses, elsewise we can expect to see more of the like.