Customer Risk Assessment & Risk Rating

Customer risk assessment is the point where AML/KYC facts become a risk understanding. It brings together identity, ownership, geography, product use, delivery channel, source evidence, screening results and expected activity.

Boundary: this page explains risk-based thinking. It does not provide a universal scoring model, risk appetite, threshold table or automatic customer decision.

1. What risk assessment means #

AML risk assessment is not a label placed on a customer after one search. It is a reasoned view of whether the relationship, transaction or counterparty creates higher ML/TF, sanctions, proliferation financing or financial crime exposure.

A useful customer risk profile answers:

who the customer or counterparty is;
what they want to do;
where the exposure sits;
who owns or controls the structure;
whether the activity makes sense;
whether risk indicators are explained, unresolved or escalating.

2. Common risk-factor groups #

Risk-factor group	Typical questions	Evidence examples
Customer type	Individual, legal entity, trust, VASP, financial institution, intermediary?	ID evidence, registry records, legal form, licences.
Geography	Which countries are relevant to residence, incorporation, operations, transaction routes and counterparties?	FATF status, NRA context, sanctions exposure, shipment routes.
Product / service	What product or service is being used and how easily can it be abused?	Account purpose, payment rails, wallet use, trade activity.
Delivery channel	Is the customer remote, introduced by a third party or handled through intermediaries?	Onboarding channel, introducer records, verification method.
Ownership / control	Is ownership transparent and does control make sense?	UBO chart, registry filings, shareholder records, LEI data.
Screening results	Are there sanctions, PEP, adverse media or close-match issues?	Screening logs, identifiers, source screenshots, match rationale.
Behaviour	Does actual or expected activity fit the profile?	Transaction history, invoices, contracts, expected activity statement.

3. Risk rating is not arithmetic only #

Some firms use scorecards. Others use qualitative categories such as low, medium and high. Either way, a risk rating should be explainable. A high score without rationale is weak; a low score with unresolved adverse information is also weak.

Good risk-rating language is specific:

Medium risk due to cross-border activity and multi-jurisdictional ownership.
No sanctions or PEP match identified. UBO evidence is sufficient for initial review.
Ongoing monitoring should focus on transaction routes and changes in ownership.

Weak risk-rating language is generic:

Customer is medium risk. No issues found.

4. Initial risk vs ongoing risk #

Risk can change after onboarding. A customer that looked low risk at entry may become higher risk because of new ownership, new products, unexpected transaction behaviour, new geography, adverse media or sanctions-list changes.

Risk assessment should therefore support both:

initial onboarding risk;
ongoing monitoring and periodic review.

5. When risk should be refreshed #

Risk should be reviewed when material facts change. Examples include:

new beneficial owner or director;
new high-risk geography;
new product, service or transaction type;
material adverse media;
new PEP exposure;
sanctions proximity or close-match concern;
unusual activity compared with expected profile;
expired or inconsistent CDD evidence.

6. Analyst output #

A useful risk assessment output should include:

Customer / counterparty:
Relationship or transaction purpose:
Key risk factors:
Risk factors cleared or mitigated:
Unresolved issues:
Proposed risk rating:
Rationale:
Recommended controls / review frequency:
Evidence references:
Escalation status:

7. Value Trail vs Money Trail #

AML review should not focus only on visible bank payments. A money trail follows funds through accounts and payment rails. A value trail follows how economic value moves, changes form or becomes legitimised through goods, services, assets, invoices, ownership structures, wallets, loans or professional intermediaries.

This matters because some cases are not explained by a payment alone. The reviewer may need to understand:

what value moved;
who owned or controlled it;
what document claims to explain it;
whether the commercial story is plausible;
whether goods, services, invoices, assets and payments align;
whether the value trail creates unresolved risk even when the payment trail looks ordinary.

8. Source basis #

FATF Recommendations for risk-based approach, CDD, ongoing due diligence and internal controls.
FFIEC BSA/AML Examination Manual for customer risk and programme-risk concepts.
Wolfsberg Group resources for practitioner risk-based financial crime control framing.

Jurisdiction indicators inside customer risk rating#

Country and jurisdiction indicators are supporting variables, not customer outcomes. FATF status, mutual-evaluation findings, NRAs and the Basel AML Index (SRC-BASEL-INDEX-001) should be combined with the customer's actual ownership, activity, products, routes, counterparties and evidence.

A model should not automatically assign a final customer rating from a country score. The case file must show which geographic exposure is relevant and why it changes, or does not change, the control response.

Jurisdiction overlays: Before setting local scope, approvals, reporting, retention or sanctions handling, apply the EU, US or UK framework.