kyc-risk-rating

RISK-BASED APPROACH PRINCIPLE

The FATF Risk-Based Approach requires that AML/CFT measures be proportionate to the risks identified. Higher-risk customers receive Enhanced Due Diligence (EDD); lower-risk customers may receive Simplified Due Diligence (SDD) in some cases. Every customer must be assigned a risk rating and the rating must be reviewed periodically.

RISK SCORING FRAMEWORK — FOUR DIMENSIONS

Dimension 1: Customer Type Risk

Customer Category	Risk Score
Listed company (major exchange)	1 — Low
Regulated financial institution (home jurisdiction)	2 — Low
Domestic corporate (private, no PEP links)	3 — Medium
High net worth individual	3 — Medium
Non-profit organisation / charity	4 — Medium-High
Foreign private company	4 — Medium-High
Offshore structure (Cayman, BVI, Panama)	5 — High
Trust or foundation (complex beneficiary structure)	5 — High
PEP individual (Tier 1 — foreign)	5 — High (mandatory EDD)
Cash-intensive business (jeweller, currency exchange, casino)	5 — High

Dimension 2: Geographic Risk

Geography	Risk Score
FATF member, low TI-CPI risk	1 — Low
FATF member, moderate TI-CPI risk	2 — Low-Medium
FATF under enhanced follow-up (grey list)	4 — High
FATF blacklisted jurisdiction	5 — Very High
Non-FATF jurisdiction with strong AML regime	3 — Medium
Non-FATF jurisdiction with weak AML regime	4 — High

Check current FATF grey/black list at fatf-gafi.org — updated three times per year. TI Corruption Perceptions Index (CPI): scores below 40/100 indicate high corruption risk.

Dimension 3: Product / Service Risk

Product / Service	Risk Score
Basic current account (domestic customer)	1 — Low
Fixed-term savings/deposit	1 — Low
Retail mortgage	2 — Low-Medium
Business current account	3 — Medium
International wire transfers	4 — Medium-High
Private banking / wealth management	4 — Medium-High
Correspondent banking	5 — High
Trade finance	5 — High
Cryptocurrency-related services	5 — High
Cash-heavy transactions	5 — High

Dimension 4: Relationship / Behavioural Risk

Indicator	Risk Score
Long-standing customer, consistent behaviour	1 — Low
New customer, no prior relationship	3 — Medium
Complex or inconsistent business explanation	4 — Medium-High
Reluctance to provide CDD documentation	5 — High
Third-party introduction with no independent verification	4 — Medium-High
Adverse media (unverified)	4 — Medium-High
Adverse media (verified / criminal conviction)	5 — High
Prior SAR on this customer (bank or other FI)	5 — High

OVERALL RISK RATING CALCULATION

Composite score = Weighted average of four dimension scores: Customer type: 35% Geographic: 30% Product/service: 20% Relationship/behavioural: 15%

Composite Score	Overall Risk Rating	CDD Level	Monitoring Frequency
1.0 - 2.0	Low	Standard CDD	Every 5 years
2.1 - 3.0	Medium	Standard CDD	Every 3 years
3.1 - 4.0	High	Enhanced CDD	Annually
4.1 - 5.0	Very High	Enhanced CDD + Senior Management Approval	6-monthly or more

Scoring Methodology Detail

The weighted average approach is the most common, but banks must consider:

• Whether to use the highest single dimension score as a floor
• Whether to apply non-linear scaling (e.g., any dimension at 5 forces overall High)
• Some regulators require that certain triggers override the composite score entirely

Example calculation: Customer type: Foreign private company = 4 Geographic: FATF grey list jurisdiction = 4 Product: Correspondent banking = 5 Behavioural: New customer = 3 Composite = (4 x 0.35) + (4 x 0.30) + (5 x 0.20) + (3 x 0.15) = 4.05 = Very High

In this case the composite score of 4.05 falls in the Very High band. Additionally, the mandatory override for correspondent banking (score 5) would independently trigger a High rating regardless of the composite calculation.

MANDATORY OVERRIDES (automatic High/Very High regardless of score)

The following automatically classify a customer as High or Very High risk:

• PEP status (any tier) -> Very High (mandatory EDD, senior management approval)
• FATF black-listed jurisdiction customer -> Very High
• Cash-intensive business above defined threshold -> High
• Customer subject to law enforcement request or known investigation -> Very High
• Beneficial owner structure includes jurisdiction with no beneficial ownership register -> High

KYC REFRESH TRIGGERS (outside periodic schedule)

Trigger an unscheduled KYC refresh when:

• Adverse media alert on customer or associated party
• Change in ownership or beneficial ownership
• Significant change in transaction behaviour
• Law enforcement contact or request for information
• Customer notifies of major change (new business, new address, change of director)
• Internal SAR filed on this customer
• Customer added to watchlist by transaction monitoring system

OUTPUT FORMAT — RISK RATING ASSESSMENT

KYC RISK RATING ASSESSMENT
Customer ID:        [ID]
Customer Name:      [Name]
Assessment Date:    [YYYY-MM-DD]
Assessor:           [Name / Role]

DIMENSION SCORES:
  Customer Type:     [Score] — [Category]
  Geographic:        [Score] — [Category]
  Product/Service:   [Score] — [Category]
  Behavioural:       [Score] — [Category]

COMPOSITE SCORE:     [X.XX]
OVERALL RATING:      [Low / Medium / High / Very High]

MANDATORY OVERRIDES APPLIED:
  [List any override triggers, or "None"]

CDD LEVEL:           [Standard / Enhanced / Enhanced + Senior Mgmt]
MONITORING FREQUENCY: [5yr / 3yr / Annual / 6-monthly]
NEXT REVIEW DATE:    [YYYY-MM-DD]

RATIONALE:
  [Brief narrative justifying the rating]

NEVER DO THESE

• NEVER assign a risk rating without checking all four dimensions — omitting a dimension (especially geographic or behavioural) systematically underestimates risk and will fail regulatory examination
• NEVER override a mandatory High/Very High classification downward without documented senior management approval and a clear regulatory basis — PEP status and FATF blacklist triggers are not discretionary
• NEVER rely solely on the composite score when a mandatory override trigger is present — the override takes precedence regardless of the weighted average
• NEVER defer a KYC refresh when a trigger event occurs — trigger-based refresh is regulatory expectation, and delay creates a compliance gap that regulators treat as a finding

ALL OUTPUTS REQUIRE REVIEW BY A QUALIFIED PROFESSIONAL BEFORE USE IN REGULATORY FILINGS OR BUSINESS DECISIONS.