Customer-Type Risk Indicators

Why Customer-Type Risk Indicators Matter

Every anti-money laundering (AML) program rests on a simple truth: not all customers present the same level of risk. The risk-based approach, which is the backbone of the FATF Recommendations, the Wolfsberg Principles, and the Basel Committee's guidance on customer due diligence, requires financial institutions to identify, assess, and mitigate the money laundering and terrorist financing risks posed by the people and entities they serve. Customer type is one of the four classic risk pillars, alongside geographic risk, product/service risk, and delivery channel risk.

For the CAMS exam, this topic sits inside the Financial Crime Risks and Methods domain. It is heavily tested because it connects directly to real-world compliance work: onboarding decisions, enhanced due diligence (EDD), ongoing monitoring, and suspicious activity reporting. If a compliance officer cannot recognize which customer categories warrant deeper scrutiny, the institution's controls will be miscalibrated, regulators will find deficiencies, and criminals will exploit the gaps. Understanding customer-type risk indicators is therefore both an exam skill and a core professional competency.

What Customer-Type Risk Indicators Are

Customer-type risk indicators are characteristics inherent to a category of customer that make that customer more (or less) likely to be used for money laundering, terrorist financing, sanctions evasion, or other financial crime. They are not accusations; they are signals that call for a proportionate response. The key insight is that the nature of the customer itself, independent of any specific transaction, can elevate risk because of factors such as cash intensity, opacity of ownership, political exposure, exposure to corruption, or the ease with which the customer can be used as a conduit for third-party funds.

The main higher-risk customer categories you must know for the exam include:

1. Politically Exposed Persons (PEPs)
Individuals who hold or have held prominent public functions: heads of state, senior politicians, senior government, judicial or military officials, senior executives of state-owned enterprises, and important political party officials. Their family members and close associates are also covered. The risk stems from potential involvement in bribery, corruption, embezzlement of public funds, and the ability to abuse power. FATF requires EDD for foreign PEPs and a risk-based approach for domestic PEPs and those in international organizations. Remember: a PEP relationship requires senior management approval, establishing source of wealth and source of funds, and enhanced ongoing monitoring.

2. Cash-Intensive Businesses
Restaurants, bars, convenience stores, car washes, parking garages, vending operations, laundromats, casinos, retail stores, and similar businesses that legitimately handle large volumes of cash. The risk is that illicit cash can be commingled with legitimate receipts during the placement stage, making it difficult to distinguish criminal proceeds from genuine revenue.

3. Money Services Businesses (MSBs) and Non-Bank Financial Institutions
Currency exchangers, check cashers, money transmitters, prepaid access providers, and informal value transfer systems (such as hawala). These entities move value quickly, often for walk-in customers with minimal relationships, and may themselves be poorly regulated or operate across borders. Banks providing accounts to MSBs face elevated risk because they inherit the MSB's customer exposure.

4. Shell Companies, Shelf Companies, and Legal Entities with Opaque Ownership
Shell companies have no significant assets or operations; shelf companies are pre-formed entities left dormant and then sold. Both can conceal beneficial ownership. Complex structures involving multiple layers, nominee directors, nominee shareholders, bearer shares, and trusts across jurisdictions are classic layering tools. Beneficial ownership identification is the critical control.

5. Trusts, Foundations, and Other Legal Arrangements
These can separate legal ownership from beneficial interest, making it difficult to identify who ultimately controls the assets. Discretionary trusts, private foundations, and arrangements in secrecy jurisdictions are particularly high risk.

6. Non-Resident and Offshore Customers
Customers with no apparent connection to the jurisdiction where the account is opened, or who are based in offshore financial centers, tax havens, or jurisdictions with weak AML regimes. The question is always: why does this customer need an account here?

7. Correspondent Banking Relationships
A bank providing services to another bank, particularly a foreign respondent bank, is exposed to the respondent's customers without direct knowledge of them. Nested correspondent relationships (where the respondent's own customers are banks) and payable-through accounts amplify the risk. Shell banks (banks with no physical presence and no affiliation with a regulated group) must never be served.

8. Gatekeepers and Professional Intermediaries
Lawyers, accountants, notaries, trust and company service providers (TCSPs), and real estate agents who can act on behalf of clients, form entities, hold client funds in pooled or escrow accounts, and lend legitimacy to transactions. The risk is that the gatekeeper's professional standing masks the underlying client's identity or intent.

9. Dealers in High-Value Goods
Precious metals and stones dealers, art and antiquities dealers, luxury car and yacht dealers, and real estate professionals. Such goods are portable stores of value, prices can be subjective, and transactions are frequently settled in cash or through intermediaries.

10. Casinos and Gaming Businesses
Casinos handle large cash volumes, can issue checks or wire transfers for winnings, and allow chips to be purchased and redeemed with minimal play, which can transform illicit cash into apparently legitimate gaming proceeds.

11. Charities and Non-Profit Organizations (NPOs)
Legitimate charities can be abused for terrorist financing, particularly when they operate in or send funds to conflict zones, lack transparency in governance, or have unclear programs. FATF Recommendation 8 specifically addresses this sector. Not all NPOs are high risk; the risk-based approach must be applied.

12. Virtual Asset Service Providers (VASPs)
Cryptocurrency exchanges, wallet providers, and related businesses. Risks include pseudonymity, cross-border speed, mixing services, and inconsistent global regulation. The FATF "travel rule" extends wire transfer information requirements to VASPs.

13. Arms Dealers, Defense Contractors, and Import/Export Businesses
Exposure to trade-based money laundering, sanctions evasion, proliferation financing, and corruption. Trade finance involving dual-use goods warrants particular scrutiny.

14. Customers Who Are Themselves Suspicious at Onboarding
Beyond categorical risk, individual customer behavior can be an indicator: reluctance to provide information, use of forged or inconsistent documents, insistence on secrecy, unusual interest in reporting thresholds, business purpose that does not make economic sense, or an occupation inconsistent with expected activity levels.

Lower-Risk Customer Types
The exam also expects you to recognize categories that generally present lower risk: publicly listed companies on regulated exchanges subject to disclosure requirements, regulated financial institutions in well-supervised jurisdictions, government entities and public administrations, and long-standing retail customers with predictable, low-value activity. Simplified due diligence may be permitted for these, but never where there is a suspicion of money laundering.

How Customer-Type Risk Indicators Work in Practice

Step 1: Risk Assessment and Categorization. At onboarding, the institution gathers information on the nature of the customer (individual, legal entity, legal arrangement), its business or occupation, its ownership structure, its geographic footprint, and the products it intends to use. The customer is then assigned a risk rating (commonly low, medium, high) based on a scoring methodology that weights customer type alongside the other risk pillars.

Step 2: Proportionate Due Diligence. Standard customer due diligence (CDD) applies to all customers: identification, verification, understanding the purpose and intended nature of the relationship, and identifying beneficial owners (typically at a 25% ownership threshold or less, plus control). Higher-risk customers trigger EDD: additional information on source of wealth and source of funds, adverse media screening, senior management approval, more frequent periodic reviews, and tighter transaction monitoring thresholds. Lower-risk customers may qualify for simplified due diligence.

Step 3: Ongoing Monitoring. Risk ratings are not static. A customer's rating must be revisited when triggers occur: a change in ownership, a new line of business, relocation to a higher-risk jurisdiction, becoming a PEP, or being named in adverse media. Transaction monitoring scenarios are calibrated to the expected behavior of each customer type; a cash-intensive business will have different alert thresholds than a salaried employee.

Step 4: Escalation and Reporting. When monitoring reveals activity inconsistent with the customer's profile, the institution investigates, and where suspicion is formed, files a suspicious activity or transaction report with the financial intelligence unit. Customer-type knowledge is essential here: knowing what is normal for a category is the only way to spot what is abnormal.

Step 5: Exit Decisions. Where risk cannot be mitigated to within the institution's risk appetite, the relationship may be declined or terminated. However, regulators discourage wholesale "de-risking" of entire categories (such as all MSBs or all charities) without individual assessment, because it pushes legitimate activity into less transparent channels.

Connecting Customer Type to the Money Laundering Cycle

The exam frequently links customer types to the three stages of money laundering. Cash-intensive businesses, casinos, and MSBs are most associated with placement. Shell companies, trusts, correspondent accounts, and professional intermediaries are most associated with layering. Real estate, luxury goods, and investment vehicles are most associated with integration. Being able to map a customer type to the stage it most commonly facilitates will help you eliminate wrong answers.

Exam Tips: Answering Questions on Customer-Type Risk Indicators

Tip 1: Identify the customer type first, then ask what makes it risky. CAMS questions are often scenario-based. Read the stem and immediately classify the customer: Is this a PEP? A shell company? An MSB? A charity? Once classified, recall the specific inherent risk for that category (corruption for PEPs, commingling for cash businesses, opacity for shells). The correct answer will almost always align with that inherent risk.

Tip 2: Look for the most indicative factor, not just any risk factor. Many answer choices will contain plausible risk indicators. The exam wants the strongest or most specific one. For example, a foreign PEP opening an account through a trust in an offshore jurisdiction with a lawyer as nominee director combines multiple indicators; the question may ask which single factor most warrants EDD, and the PEP status is usually the primary driver.

Tip 3: Remember that PEP status alone is not a crime. A common distractor suggests refusing all PEPs or filing a suspicious report simply because a customer is a PEP. The correct approach is EDD, senior management approval, source of wealth verification, and enhanced monitoring. Only suspicious activity, not status, triggers a report.

Tip 4: Know the difference between shell companies and shell banks. A shell company may be legitimate (for example, a holding vehicle) and requires beneficial ownership identification and EDD. A shell bank must never be banked under FATF standards and most national laws. Questions that blur these terms are testing whether you know the distinction.

Tip 5: Beneficial ownership is the recurring theme for legal entities. Whenever a question involves a company, trust, or foundation, the correct answer almost always involves identifying and verifying the natural persons who ultimately own or control the entity. Answers that accept the stated legal owner at face value, or that rely solely on registration documents, are typically wrong.

Tip 6: Watch for the "no apparent business purpose" signal. Questions about non-resident customers, foreign corporations with no local operations, or individuals whose occupation does not match their transaction volume are testing whether you recognize that an unexplained reason for the relationship is itself a red flag.

Tip 7: Apply the risk-based approach, not blanket rules. Answer options that say "all customers of type X must be rejected" or "all customers of type X require identical controls" are usually incorrect. The CAMS exam rewards proportionate, risk-based responses. Similarly, answers endorsing indiscriminate de-risking of whole sectors are typically wrong.

Tip 8: Correspondent banking questions focus on knowing the respondent's controls. Expect questions about assessing the respondent bank's AML program, its regulatory environment, its ownership, its customer base, and whether it permits nested relationships or payable-through accounts. The correct answer emphasizes understanding the respondent, not its individual underlying customers.

Tip 9: Gatekeeper questions test whether you look past the professional. When a lawyer or accountant acts for an undisclosed client, the risk is the hidden client. Correct answers involve identifying the underlying principal and understanding the source of funds flowing through pooled or escrow accounts, while respecting that some professional privilege rules may apply.

Tip 10: Charities and NPOs require nuance. The exam will not accept "all charities are high risk." Look for specific indicators: operations in conflict zones, lack of financial transparency, cash-based disbursements, unclear beneficiaries, or links to designated individuals. The right answer is usually risk-based assessment and enhanced monitoring of those specific indicators.

Tip 11: Eliminate answers that skip steps or jump to extremes. If an option suggests immediately closing an account, immediately reporting to law enforcement, or taking no action at all, be cautious. The typical correct sequence is: gather more information, apply EDD, escalate internally, monitor, and report if suspicion is formed.

Tip 12: Use the money laundering stages to sanity-check your answer. If a question asks how a particular customer type facilitates laundering, match the type to its stage. A casino converting cash to a check is placement; a chain of shell companies wiring funds across jurisdictions is layering; purchasing real estate with laundered funds is integration.

Tip 13: Manage your time and read every option. CAMS questions often include one clearly wrong answer, two plausible answers, and one best answer. Do not stop at the first reasonable option. Compare the two strongest candidates against the specific wording of the question (for example, "most likely," "best," "first step").

Tip 14: Practice with realistic scenarios. Create your own mini-cases: a car wash depositing round cash amounts daily, a foreign official's spouse opening a private banking account, a newly formed company with bearer shares requesting a correspondent account. For each, write down the customer type, the inherent risk, the required due diligence, and the red flags that would trigger escalation. This builds the pattern recognition the exam rewards.

Quick Reference Summary

PEPs: corruption and abuse of office; EDD, senior approval, source of wealth.
Cash-intensive businesses: commingling at placement; monitor deposits against expected revenue.
MSBs: rapid value transfer, inherited customer risk; verify registration and AML program.
Shell/shelf companies, trusts: opaque ownership at layering; identify beneficial owners.
Non-resident/offshore customers: unexplained purpose; document rationale for relationship.
Correspondent banks: indirect exposure; assess respondent's controls, prohibit shell banks.
Gatekeepers: hidden principals; look through to the underlying client.
High-value goods dealers and casinos: portable value and cash; scrutinize settlements and redemptions.
Charities/NPOs: terrorist financing exposure; risk-based, indicator-driven review.
VASPs: pseudonymity and speed; travel rule compliance and exchange licensing.

Master these categories, understand why each is risky, know the proportionate control for each, and apply the risk-based approach consistently. With that foundation, customer-type risk indicator questions on the CAMS exam become highly predictable and answerable.