Customer Risk Rating Methodology Template (AML/KYC)

Customer Risk Rating Methodology: [Institution name]

The documented method an institution uses to give every customer a money laundering and terrorist financing (ML/TF) risk rating: scope and rating points, risk factors and weights, scoring formula, automatic triggers and prohibited relationships, rating bands and the due diligence level each band requires, overrides, review frequency, data lineage, validation and change control. Based on public law and guidance as of 2026-10: national law transposing Directive (EU) 2015/849 (Art. 13 and Annexes I to III), Regulation (EU) 2024/1624 (AMLR) Art. 20(2), Art. 26 and Annexes I to III from 2027-07-10, the EBA Guidelines on ML/TF risk factors (EBA/GL/2021/02, as amended), the US customer due diligence requirement to develop a customer risk profile (31 CFR 1020.210(a)(2)(v)(A)) and UK MLR 2017. FATF Recommendations 1 and 10 are cited by number and title only. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, regulatory or financial advice. Obtain the law or standard for the normative text and check local law.

Document control

Approvals

Revision history

Contents

• 1. Purpose, scope and legal basis
• 2. Customer segments and rating points
• 3. Risk factors and weights
• 4. Scoring model
• 5. Automatic triggers and prohibited relationships
• 6. Rating bands and due diligence levels
• 7. Worked examples
• 8. Overrides
• 9. Review frequency and re-rating
• 10. Data, lineage and quality
• 11. Governance, validation and performance monitoring
• 12. Glossary and references
• Standard and licence note

1. Purpose, scope and legal basis

The customer risk rating expresses, on one scale, how likely it is that a customer relationship is used for ML, TF, proliferation financing or sanctions evasion, given who the customer is, where it operates, what it uses and how it deals with the institution. The rating decides the due diligence level at onboarding, the approval authority, the maximum interval between periodic reviews, and the monitoring segment the customer falls into. It does not decide whether a suspicious activity report is filed; that decision always rests on the facts of a case.

Every customer of the entities in scope receives a rating, including customers onboarded before this methodology took effect. A customer shared between entities carries one group rating, the highest of the entity ratings.

2. Customer segments and rating points

The model uses two scorecards, because the information available and the relevant risks differ: one for natural persons (retail and private customers) and one for legal entities and arrangements (companies, partnerships, trusts, foundations, non-profit organisations). Financial institution respondents are not rated with this model; they are assessed with the Correspondent Banking Due Diligence (compliance/correspondent-banking-due-diligence) template under the correspondent methodology; respondents established outside the EU are High by default (TRG-03), and EU respondents take the rating that template produces.

Check: 400,000 + 11,200 + 500 + 300 = 412,000 (400,000 retail and 12,000 corporate).

A rating is computed at the following rating points: at onboarding before the account is opened; at each periodic review; on any change to a scored data field (for example residence, ownership, industry, PEP status or products held); after an investigation closes with a finding of unusual activity; and when a new external list (high-risk third countries, sanctions, PEP data) changes a geography or screening outcome. The scoring engine records every rating with a timestamp, the input values and the methodology version, so any past rating can be reproduced.

3. Risk factors and weights

The model has four factor groups. Group weights reflect the business-wide risk assessment, where customer characteristics and product exposure drove most of the inherent risk, and the validation results described in section 11.

Each factor value scores from 1 (lower risk) to 4 (higher risk). Within a group, sub-factors carry sub-weights that sum to 100% of the group.

3.1 Customer factor group

3.2 Geography factor group

Country scores come from the country risk table maintained by the MLRO and refreshed after each list change and at least quarterly. The table records the source of each score.

3.3 Product and service factor group

The product score equals the highest score among the products and services the customer holds or applies for.

3.4 Delivery channel factor group

4. Scoring model

The group score $G_g$ is the sub-weighted average of the sub-factor scores $s_{g,k}$ (or, for products and channels, the single score). The composite score $S$ is the weighted sum of the group scores.

Because every score lies between 1 and 4 and the weights sum to 1, the composite $S$ also lies between 1.00 and 4.00. Scores are computed and stored to two decimals; no rounding is applied before banding. A missing mandatory input does not default to a low score: the engine assigns the highest score for that sub-factor and raises a data quality task (section 10).

5. Automatic triggers and prohibited relationships

Automatic triggers apply before the composite score. A customer that meets any High trigger is rated High even if its composite score is lower; the score is still computed and stored for analysis. A customer that meets any prohibition is not onboarded, or is exited, in line with section 2 of the AML/CFT Programme Policy (compliance/aml-cft-programme-policy).

TRG-01 makes no distinction between domestic and foreign PEPs, because EU law (national law transposing AMLD4 now, the AMLR from 2027-07-10) and UK law require enhanced measures for every PEP, family member and known close associate. What differs is the extent of EDD, not whether it applies: national law and the AMLR define which domestic functions are prominent public functions (the national list under AMLR Art. 43), and for UK business MLR 2017 reg. 35(3A), inserted by SI 2023/1371 from 2024-01-10, sets a lower level of risk as the starting point for domestic PEPs and their family members and close associates, so their EDD is normally lighter than for a non-domestic PEP unless other enhanced risk factors are present. The PEP sub-factor scores in section 3.1 (3 for domestic, 4 for foreign) still feed the stored composite score, which the EDD analyst uses to size the measures. A former PEP stays under TRG-01 for at least 12 months after leaving office (AMLR Art. 45) and for as long afterwards as the risk persists.

6. Rating bands and due diligence levels

The 5-year and 1-year intervals are the AMLR ceilings that apply from 2027-07-10 for customers not subject to EDD and for EDD customers respectively; the 3-year interval for Medium is the institution's own choice. Shorter intervals required by national law prevail.

Portfolio distribution at 2026-09-30 (Example):

Of the 10,000 High customers, 3,600 are High through an automatic trigger and 6,400 through the composite score (3,600 + 6,400 = 10,000).

7. Worked examples

All examples are fictional and use the weights in section 3.

CUS-EX-01 (Example): SME importer of industrial parts, three ownership layers including a family trust, suppliers in score-3 jurisdictions, uses trade finance, onboarded in branch.

Record the reasoning for each sub-factor score in the KYC profile (here: a trust sits in the ownership chain, so ownership scores 3), so that a reviewer can check the score without re-running the engine.

CUS-EX-02 (Example): non-resident individual, foreign PEP, complex source of wealth, investment account, onboarded remotely with electronic identification.

CUS-EX-03 (Example): domestic salaried individual, salary account and card, onboarded through the app.

CUS-EX-04 (Example): small domestic retailer, simple ownership, standard sector, current account, onboarded in branch; later upgraded by override (section 8).

8. Overrides

An analyst may propose an override when facts known to the institution are not captured by the scorecard, for example unexplained cash deposits, an internal investigation outcome, or information from a law-enforcement request. Every override records the reason, the evidence, the proposer, the approver and an expiry date, after which the computed rating applies again unless the override is renewed.

The MLRO monitors the override rate monthly. In the 12 months to 2026-09-30, 1,240 overrides were recorded (0.30% of 412,000 customers), of which 85 were downgrades (Example). A downgrade share above [10%] of overrides, or any concentration of downgrades in one business line, triggers a review by the second line.

9. Review frequency and re-rating

Each periodic review refreshes the customer information, re-runs screening and recomputes the rating with the current methodology version. The review date is set from the band in section 6 and counts from the completion of the previous review, never from the original onboarding date. When the methodology changes, customers whose rating moves up are reviewed within [90] days; customers whose rating moves down keep their current review date.

Event-driven reviews start within [10] business days when any of the following occurs: a change to a scored data field; a confirmed adverse media hit; an investigation closed with a finding; a law-enforcement request; a new designation affecting the customer or a related party; or a change in a country score that affects the customer. From 2027-07-10, the AMLR also expects updates when the institution has a legal obligation to contact the customer about beneficial ownership information or tax information exchange, and regular checks against targeted financial sanctions on each new designation for credit and financial institutions.

Overdue reviews of High customers are a board risk appetite metric (Risk Appetite Statement (finance/risk-appetite-statement), RAS-CMP-01: appetite 2.0%, tolerance 4.0%; actual 2.9% at 2026-09-30, amber (Example)). At 10,000 High customers, the 2.9% figure means 290 overdue reviews (10,000 x 0.029 = 290).

10. Data, lineage and quality

The rating can only be as good as its inputs. Each input field has a named data owner, an authoritative source and a quality rule. The scoring engine reconciles its customer population with the core banking and KYC systems monthly, and every unrated or partially rated customer is reported as an exception.

Check: 1,850 / 412,000 = 0.45%.

11. Governance, validation and performance monitoring

The methodology is owned by the MLRO. Where it is implemented in an automated engine, it is registered in the model inventory and managed under the Model Risk Management Policy (finance/model-risk-management-policy). Independent validation covers conceptual soundness (are the factors and weights justified by the risk assessment and the risk factor guidance?), implementation (does the engine compute what the document says?), data (are inputs complete and correct?) and outcomes (does the rating separate higher-risk from lower-risk customers?). Validation results are documented in the Model Validation Report (ai-data/model-validation-report).

Outcome analysis compares ratings with later evidence of risk, such as external SARs, exits for financial crime reasons and confirmed sanctions matches. A useful rating shows a steeply rising rate of such outcomes from Low to High.

Check: 110 + 226 + 274 = 610 SARs, matching the business-wide risk assessment. Rates: 110 / 338 = 0.33, 226 / 64 = 3.53, 274 / 10 = 27.40 and 610 / 412 = 1.48 per 1,000 customers. The rate rises roughly eight- to elevenfold from band to band (3.53 / 0.33 = 10.7; 27.40 / 3.53 = 7.8), which supports the band boundaries. A Low band that produced a growing share of SARs would show that a risk is not captured by the factors and would trigger a methodology review.

Methodology changes follow change control: the MLRO proposes, model risk management reviews, the engine change is tested on a full-portfolio parallel run, and the change is approved before deployment. The parallel run reports how many customers move between bands and why. Version 2.0 (Example) moved 2,300 customers from Medium to High and 900 from High to Medium; the High-to-Medium moves were reviewed by the MLRO before the change took effect.

12. Glossary and references

References (obtain the current official versions):

• FATF Recommendations, R.1 Assessing risks and applying a risk-based approach; R.10 Customer due diligence; R.12, R.13, R.19 (number and title only).
• Directive (EU) 2015/849, Art. 13, Arts 20 to 23 (PEPs) and Annexes I to III, as amended and transposed; EUR-Lex.
• Regulation (EU) 2024/1624 (AMLR), Art. 20(2), Art. 26, Arts 42 to 46 (PEPs), Annexes I to III; applies from 2027-07-10; EUR-Lex.
• EBA Guidelines on ML/TF risk factors, EBA/GL/2021/02, as amended.
• 31 CFR 1020.210(a)(2)(v), 1010.610, 1010.620; FFIEC BSA/AML Examination Manual.
• UK MLR 2017 (SI 2017/692), regs 28, 33 and 35, as amended by SI 2023/1371 (domestic PEPs, in force 2024-01-10).
• Related templates: KYC/CDD Customer Profile (compliance/kyc-cdd-profile), Transaction Monitoring Scenario Specification (compliance/transaction-monitoring-scenario-spec), Risk Methodology (compliance/risk-methodology).

Standard and licence note

Based on public law: EU legislation from EUR-Lex (Directive (EU) 2015/849 and Regulation (EU) 2024/1624), reused with acknowledgement and summarised in original wording; US federal regulations in 31 CFR Chapter X and FFIEC publications (US government works, public domain); and the UK Money Laundering Regulations 2017 (Crown copyright, Open Government Licence v3.0 where stated). The EBA risk factor guidelines are cited by number with acknowledgement and no text is reproduced. FATF Recommendations are cited by number and title only. The factors, weights, bands and scores are original and illustrative; they are not regulatory requirements. Fernhollow Bank and all figures are fictional. This template is original text written for this collection. Check the current official version of each law and guideline before use. Template licence: MIT.