Customer Risk Rating and Assessment

Why Customer Risk Rating and Assessment Matters

Customer risk rating is the engine that drives a risk-based anti-financial crime (AFC) program. Global standards from the Financial Action Task Force (FATF), the Wolfsberg Group, the Basel Committee and virtually every national regulator require that institutions understand who their customers are and how much money laundering, terrorist financing, sanctions and fraud risk each one presents. Without a reliable customer risk rating, an institution cannot decide how much due diligence to perform, how closely to monitor transactions, how often to refresh information, or where to deploy scarce compliance resources.

For the CAMS exam, this topic sits inside the AFC Program Governance and Risk Management domain. The examiners expect you to understand that customer risk rating is not a one-time onboarding formality but a living, documented, governed process that feeds into the enterprise-wide risk assessment (EWRA), Customer Due Diligence (CDD), Enhanced Due Diligence (EDD), transaction monitoring and suspicious activity reporting. Weak customer risk rating has been a root cause in numerous enforcement actions, where regulators found institutions treating high-risk customers as low risk, failing to update ratings when behaviour changed, or using methodologies no one could explain.

What Customer Risk Rating and Assessment Is

Customer risk rating is the process of evaluating an individual customer or relationship against a defined set of risk factors and assigning a risk score or category (for example Low, Medium, High, or numeric bands). Customer risk assessment is the broader analytical process that includes gathering information, applying the methodology, documenting the rationale, and determining the appropriate level of due diligence and ongoing monitoring.

Key characteristics:
- It is risk-based: effort is proportionate to the risk presented, not applied uniformly.
- It is dynamic: ratings change as new information, behaviour or external events emerge.
- It is documented and defensible: the methodology, weightings and overrides must be explainable to auditors and regulators.
- It is linked to controls: the rating determines CDD depth, EDD requirements, review frequency, monitoring thresholds and approval levels.
- It is governed: the methodology is approved by senior management or the board, independently validated, and periodically reviewed.

How Customer Risk Rating Works

1. Core Risk Factor Categories
Most methodologies evaluate customers across four to five pillars, aligned with the FATF risk-based approach:

Customer type and characteristics: legal form (individual, corporation, trust, foundation, non-profit), ownership complexity, bearer shares or nominee arrangements, politically exposed person (PEP) status, adverse media, sanctions nexus, occupation or industry (cash-intensive businesses, money services businesses, casinos, precious metals dealers, virtual asset service providers, arms dealers, correspondent banks), length of relationship, and source of wealth or funds.

Geographic risk: country of residence, incorporation, citizenship, and where the customer conducts business. Higher risk attaches to jurisdictions on FATF grey or black lists, countries subject to sanctions, those with high corruption perception, weak AML regimes, significant drug production or transit, tax secrecy, or terrorist activity. Institutions typically maintain a country risk model that feeds the customer rating.

Products and services: products offering anonymity, high liquidity, cross-border movement or layering potential carry more risk, such as private banking, correspondent banking, trade finance, international wires, prepaid cards, cash services, trust and company services, and crypto-related products.

Delivery channel: non-face-to-face onboarding, reliance on third-party introducers or intermediaries, and online or mobile-only relationships increase risk compared with in-person relationships where identity is directly verified.

Expected activity and behaviour: anticipated transaction volume, value, frequency, cash intensity, and counterparties. Deviations from expected activity discovered through monitoring are often a trigger for re-rating.

2. Scoring Methodology
Institutions typically assign points or weights to each factor. Weightings reflect the institution's own risk appetite and EWRA findings, so a factor weighted heavily by one bank may be weighted lightly by another. Common approaches include:
- Additive scoring: points for each factor are summed and mapped to bands.
- Weighted scoring: factors are multiplied by importance weights before summing.
- Highest-factor or knock-out rules: certain attributes (for example sanctions hits, PEP status, cash-intensive business in a high-risk jurisdiction) automatically force a High rating regardless of other scores.
- Matrix or decision-tree models: combinations of factors determine the category.

Whatever the design, the exam expects you to know that the methodology must be documented, consistently applied, tested and approved. Overrides (manual adjustments up or down) must be justified, recorded and subject to review, and downgrades in particular require strong rationale and appropriate approval.

3. Initial Rating at Onboarding
At account opening, the institution collects CDD information, including identification, beneficial ownership (typically individuals owning 25 percent or more, or a lower threshold for higher-risk cases, plus a controlling person), nature and purpose of the relationship, and expected activity. Screening against sanctions, PEP and adverse media lists is performed. The information is run through the risk model to produce an initial rating, which dictates whether standard CDD, simplified due diligence (where permitted) or EDD applies, and whether senior management approval is needed before onboarding.

4. Ongoing and Dynamic Re-Rating
Ratings must be refreshed through:
- Periodic reviews on a risk-based cycle (commonly annual for high risk, every two to three years for medium, every three to five years for low, though regulators increasingly favour event-driven over purely calendar-driven refresh).
- Trigger events: a sanctions or PEP hit, adverse media, a suspicious activity report filing, unusual transaction patterns, a change in ownership or control, a new high-risk product, a change of address to a high-risk country, law enforcement inquiry, or subpoena.
- Perpetual or continuous KYC using automated data feeds and monitoring outputs to update ratings in near real time.

5. Consequences of the Rating
- Low risk: standard CDD, standard monitoring, longer review cycles.
- Medium risk: standard CDD with possible additional verification and more frequent review.
- High risk: EDD including verification of source of wealth and source of funds, senior management approval, enhanced monitoring with tighter thresholds, more frequent reviews, and potentially relationship restrictions or exit if risk exceeds appetite.
- Certain relationships (foreign PEPs, foreign correspondent banking, shell banks) are mandated as high risk or prohibited under many laws regardless of model output.

6. Governance and Model Validation
Customer risk rating models, whether spreadsheets or sophisticated software, are subject to model risk management. This means documented design rationale, data quality controls, periodic back-testing against SAR filings and investigation outcomes, independent validation (often by internal audit or a second-line model validation function), change management for weighting adjustments, and reporting of model performance to the AML compliance officer and board or risk committee. Regulators criticise institutions whose models produce implausible results (for example 98 percent of customers rated Low) or that have never been tuned.

7. Relationship to the Enterprise-Wide Risk Assessment
Customer risk ratings aggregate upward: the distribution of customer ratings is a core input to the EWRA, which identifies inherent risk, evaluates control effectiveness and determines residual risk. In turn, EWRA findings should flow back down to refine the customer rating methodology. The exam frequently tests this two-way relationship.

Common Weaknesses Examiners and Regulators Identify
- Static ratings never updated after onboarding.
- Over-reliance on customer self-declared information without verification.
- Ignoring beneficial owners and controlling persons in the rating.
- Unjustified manual downgrades to avoid EDD workload.
- Methodology not aligned with the institution's actual product and geographic footprint.
- No feedback loop between transaction monitoring alerts and the risk rating.
- Poor data quality (missing occupation, country or ownership fields) producing artificially low scores.

How to Answer Exam Questions on Customer Risk Rating and Assessment

CAMS questions in this area are usually scenario-based. You will be given facts about a customer, a change in circumstances, or a compliance program and asked for the best or most appropriate action. The following reasoning framework helps:

Step 1: Identify the risk factors in the scenario. Scan for customer type, PEP status, jurisdiction, product, channel and expected versus actual activity. List which pillars are elevated.

Step 2: Determine what the rating should be and what that rating requires. If multiple high-risk indicators appear, the answer will almost always involve EDD, senior management approval, enhanced monitoring, or a more frequent review cycle.

Step 3: Recognise trigger events. If the scenario describes new information after onboarding (adverse media, ownership change, unusual wires), the correct answer typically involves reassessing or updating the customer risk rating and then applying corresponding controls, rather than immediately filing a SAR or closing the account without analysis.

Step 4: Apply the risk-based principle. Answers that treat every customer identically, apply EDD to everyone, or refuse all high-risk customers are generally wrong. The exam rewards proportionate, documented, defensible decisions.

Step 5: Think about governance. For program-level questions, the best answers involve documented methodology, board or senior management approval, independent validation, periodic review, and alignment with the EWRA.

Exam Tips: Answering Questions on Customer Risk Rating and Assessment

1. Dynamic beats static. Whenever an option mentions updating or reassessing the risk rating in response to new information, it is usually a strong candidate. A rating assigned only at onboarding is a textbook deficiency.

2. Look for the mandatory high-risk categories. Foreign PEPs, foreign correspondent banking relationships, customers from FATF-listed jurisdictions, and shell companies with opaque ownership should be treated as high risk; any answer that rates them Low or applies simplified due diligence is wrong.

3. EDD follows High risk. Remember the EDD package: source of wealth and source of funds verification, senior management approval, enhanced ongoing monitoring, and more frequent reviews. If a question asks what a high rating requires, choose the answer containing these elements.

4. Do not jump to exit or SAR too quickly. A higher risk rating does not automatically mean suspicious activity. The sequence is: identify the factor, reassess the rating, apply appropriate due diligence and monitoring, investigate if activity is unusual, then decide on SAR or exit. Choose answers that reflect this disciplined order unless the scenario clearly describes suspicious activity.

5. Beneficial ownership counts. The risk of a legal entity customer includes the risk of its beneficial owners and controllers. If a scenario reveals a hidden PEP owner or an owner in a sanctioned country, the entity's rating must rise.

6. Overrides need justification. Manual adjustments, especially downgrades, must be documented, approved and reviewed. An option describing a relationship manager lowering a rating without compliance approval is a red flag, not a solution.

7. Methodology is institution-specific but must be defensible. Questions about program design favour answers that tie weightings to the institution's own EWRA, risk appetite and business profile rather than copying another bank's model or adopting an untested vendor default.

8. Validation and tuning are governance expectations. If asked how to strengthen a rating program, look for independent model validation, back-testing against SAR data, data quality remediation, and periodic recalibration.

9. Watch the distribution clue. A scenario stating that nearly all customers are rated Low, or that the model has never been reviewed, signals a methodology problem; the best answer addresses the model, not individual customers.

10. Connect to the EWRA. When a question links customer risk to the enterprise-wide assessment, remember the flow is bidirectional: customer ratings inform the EWRA, and EWRA results refine the rating methodology.

11. Eliminate absolutes. Answers containing words like always, never, all customers, or no exceptions tend to contradict the risk-based approach and are usually distractors.

12. Choose the most complete, process-oriented answer. When two options seem correct, the one that reflects a documented, approved, repeatable process with appropriate escalation is usually the examiners' intended answer.

Illustrative Scenario

A bank onboarded a domestic import-export company three years ago as Medium risk. Transaction monitoring now shows frequent wires to a jurisdiction recently added to the FATF grey list, and adverse media links a newly appointed director to a bribery investigation. What should the compliance officer do first?

The best answer: reassess and update the customer risk rating to reflect the geographic and reputational factors, which will likely result in a High rating, then apply EDD including verification of the new director, source of funds for the wires, senior management review of the relationship, and enhanced monitoring. Only after that analysis should the officer determine whether a suspicious activity report or relationship exit is warranted. Answers that immediately close the account, file a SAR without review, or leave the rating unchanged until the next scheduled refresh are inferior.

Key Takeaways
- Customer risk rating converts information into proportionate controls.
- It rests on customer, geographic, product, channel and behavioural factors.
- Ratings must be dynamic, triggered by events and refreshed on a risk-based cycle.
- High ratings drive EDD, senior approval and enhanced monitoring.
- The methodology must be documented, validated, governed and linked to the EWRA.
- On the exam, favour risk-based, documented, process-driven answers that reassess risk before taking drastic action.