A foreign politically exposed person opens an account at a branch. The customer is salaried, resident in Kenya, expects low monthly values and uses a basic product through a branch. Five low-risk factors and one high one. A weighted model adds them up and returns Medium.
The law does not average. For a foreign PEP, regulation 26 of the Proceeds of Crime and Anti-Money Laundering Regulations 2023 requires senior management approval, source of wealth and funds, and enhanced ongoing monitoring, whatever else is true about the customer. A model that can produce Medium for that customer is wrong by design.
Gates first, scores second
This guide’s position: a customer risk model runs in two stages. First, a small set of gates that decide the outcome or set a floor on their own. Only then, for customers no gate has caught, a weighted score across the usual factors. A weighted score must never be able to dilute a gate.
The second half of the position: a rating is re-run when the facts change, not only when the review calendar comes round.
| Gate | What it does | Basis |
|---|---|---|
| Identity or beneficial owner cannot be verified | Stop: do not open or continue the relationship; file an STR where identity evidence is not supplied | POCAMLA Regulations 2023, reg 25(2) |
| Confirmed match to a sanctions list | Stop: freeze and report under the targeted financial sanctions regulations; no rating applies | TFS regulations |
| Foreign PEP, as customer or beneficial owner | Floor of High: enhanced measures and senior management approval are mandatory | Reg 26(1) |
| Domestic PEP or international organization PEP | Mandatory documented assessment; High where the relationship is higher risk | Reg 26(2) |
| Suspicion already formed on the customer | Floor of High; simplified measures barred | Reg 21 |
| Your institution’s own list (for example, a customer linked to a jurisdiction FATF has called for action on, or an activity your risk assessment puts outside appetite) | Floor of High, or stop | Your institutional risk assessment |
The first five rows come from the regulations. The last row is where the institution’s own risk assessment speaks. Keep it short: a gate list that grows to twenty items becomes a second scoring model.
The score, for everyone else
For customers no gate catches, a weighted score across customer type, geography, product, channel, transaction profile and source of funds is a reasonable way to rank risk. Three rules keep it honest:
- Score on evidence, not declarations. Expected activity is a declaration until transactions confirm it. Re-score when they do not.
- Publish the weights. Every factor weight is approved and documented, so a reviewer can rebuild any rating by hand.
- Control overrides one way. Raising a rating needs a reason. Lowering one needs a reason and second-line approval, and every downward override is reported to the MLRO each month.
When a rating must be re-run
Regulation 35 requires ongoing due diligence: transactions consistent with what the institution knows of the customer, and records kept up to date, particularly for higher-risk customers. A periodic review cycle meets part of that. Trigger events meet the rest. Re-rate the customer when:
- Transactions depart materially from the declared profile, in value, channel, counterparties or geography.
- Ownership, control or directors change, or a new beneficial owner appears.
- The customer, an owner or a close associate becomes a PEP or appears in adverse media.
- An STR is filed, or an internal escalation is closed without filing but with concerns recorded.
- The customer adds a product or channel the original rating did not cover.
- A country the customer deals with moves onto, or up, a FATF list.
A rating that only moves at the scheduled review is a record of the past.
What an examiner can rebuild
An illustrative example, not a real case. An examiner picks twenty customer files and asks for one thing: rebuild each rating from the documents on file. In six, the stored rating cannot be reproduced. Two were overridden downward with no recorded reason. Three still show the rating from onboarding, although the customers’ transactions have changed completely. One is a company whose new beneficial owner, recorded after onboarding, is a foreign PEP; no one re-ran the rating.
None of these files lacks a rating. Every one lacks a rating that holds up.
What the ratings did not show
A customer risk rating can look precise while resting on assumptions that stopped being true long ago. Across customer risk assessment reviews, I have seen a model rate a complex customer low because heavily weighted product and transaction factors diluted ownership opacity and geographic exposure. The calculation worked; the weighting failed the risk. I have also seen low ratings that reflected missing data, outdated ownership records or untested weights rather than low exposure, and high ratings that triggered enhanced measures mechanically, with no view of the specific risk they were meant to address. When the frontline has pushed for a lower rating, I have taken the discussion back to evidence rather than onboarding urgency, and the rating has held where the rationale, the override and the approver were on record. The ratings that hold up are the ones an institution can explain: how the score was reached, why the classification is still reasonable, and what proportionate controls it triggered.
Five tests for your model
- Run the foreign-PEP example above through your model. If it can return anything below High, fix the model before anything else.
- Pull every downward override from the last quarter and check each has a reason and an approver.
- Take ten customers rated at onboarding more than a year ago and compare their actual transactions with the declared profile.
- Rebuild five ratings by hand from the documents on file.
- Give the same three files to two assessors and compare their ratings. Where they differ, the factor definitions are too loose.
For what examiners request in an AML inspection, see Preparing for a CBK AML inspection.
A rating is a decision
A customer risk rating decides how much the institution will know about a customer, who approves the relationship and how closely it is watched. Treat it as a decision with an owner and evidence, not a score a system produced. A High rating should name the specific risk its enhanced measures address; otherwise the measures run on autopilot.
Riskill’s Customer Risk Assessment Tool applies gates before weighted factors, records overrides and their approvers, and separates the frontline assessment from the second-line review: riskilled.com/toolkits. The CDD, EDD & Customer Risk Pack adds the enhanced due diligence and periodic review material around it. For an independent review of your customer risk model, talk to the advisory desk: riskilled.com/engage.