Customer risk rating
CRRAlso called customer risk assessment, customer risk score, customer risk profile
A customer risk rating is the score a regulated firm gives each customer for money laundering and terrorist financing risk. It is usually low, medium or high. The rating decides how much due diligence the firm applies, how closely it monitors the account and how often it reviews the customer.
How it works
Firms build a risk model from factors set out in their business-wide risk assessment. Typical inputs are customer type, ownership structure, occupation or industry, countries involved, products used, delivery channel and PEP or adverse media hits. Each factor is weighted and combined into a score, and analysts can override it with a documented reason.
The rating drives the rest of the AML programme. High-risk customers get enhanced due diligence, senior approval and more frequent reviews. Low-risk customers may qualify for simplified measures. Supervisors test whether models are documented, calibrated and applied consistently, and whether ratings change when a customer's behaviour or circumstances change.
The rules
Requires due diligence to reflect the firm's risk assessment and the risk in each case, considering purpose, size and duration of the relationship.
Banks, payment firms, cryptoasset firms and other relevant personsArticle 20(2) requires an individual assessment of each customer's money laundering and terrorist financing risks, taking account of the business-wide risk assessment.
Credit and financial institutions and other obliged entities in the EUSet out customer, country, product and channel risk factors firms should weigh when assessing risk in individual business relationships.
EU credit and financial institutionsRequires covered institutions to understand the nature and purpose of customer relationships to develop a customer risk profile, and to conduct ongoing monitoring.
Banks, broker-dealers, mutual funds and futures firmsCommon questions
What factors go into a customer risk rating?
Common factors are the type of customer, its ownership and control, occupation or industry, countries of residence and operation, products and channels used, expected activity, and screening results such as PEP status, sanctions links or adverse media.
How often should a customer risk rating be reviewed?
Firms set review cycles by rating, often more frequent for high-risk customers. Ratings should also be refreshed after trigger events, such as a change of ownership, unusual transactions or new adverse media, rather than only on a fixed calendar.
Can a firm use a machine learning model to rate customers?
Yes, if the firm can explain and validate it. Supervisors expect firms to document the factors, show why a customer received a rating and test that the model performs as intended. Many firms combine rules with statistical scoring.
