9.2 Customer Risk Ratings: Factors, Data Sources, and How Scoring Models Work
Key Takeaways
Customer risk ratings typically combine customer, geography, product, channel and expected-activity factors into a weighted score with defined thresholds.
Override rules ensure that some facts, such as PEP status or a confirmed sanctions nexus, set a minimum rating or a prohibition regardless of the score.
Dynamic models re-score customers when their behaviour or data changes, such as new alerts, SAR filings or a change of country.
Risk scoring tools should be documented, tested and validated, and each rating must be explainable to examiners and partner banks.
CAFCA sub-topic 2.6 covers risk ratings: the types of risk factors, what information to include, how to access it from internal and external sources, and how risk algorithms work. The rating is where CDD turns into action. It decides who gets EDD, how closely monitoring watches each customer, how often KYC is refreshed, and who must approve the relationship.
Risk factors
| Factor group | Examples of inputs | Higher-risk signals |
|---|---|---|
| Customer | Individual or entity type, occupation or industry, ownership complexity, PEP status, adverse media, age of relationship | Cash-intensive or high-risk industries; nominee structures; PEPs; negative news |
| Geography | Residence, nationality, place of incorporation, countries of counterparties | FATF-listed countries, sanctions-adjacent regions, high-risk corridors |
| Products and services | Products used: P2P, cross-border, cash load, crypto, virtual cards, credit | Anonymity, speed, cross-border reach, cash |
| Delivery channel | Remote, via an embedded partner, via an agent or intermediary | Non-face-to-face without strong eKYC; third-party introducers |
| Expected and actual activity | Declared volumes and values, actual behaviour, alert and SAR history | Activity far above the baseline; repeated alerts; SAR filed |
Where the information comes from
- Internal: application data, KYC documents, beneficial ownership certifications, transaction history, device and IP data, alert and case outcomes, SAR records, fraud claims, complaints.
- External: screening results (sanctions, PEP, adverse media), registries, bureau data, country risk sources such as FATF lists and national risk assessments, consortium fraud data.
Keep a data dictionary that names each input, its source, how often it refreshes, and who owns its quality. Poor data quality is the most common reason ratings fail.
How rating algorithms work
1. Weighted scorecards (most common)
Each factor gets a score, for example from 1 (low) to 3 (high), and a weight. The total maps to bands.
Worked example. Weights: customer 20%, geography 30%, product 25%, channel 15%, activity 10%. A sole trader (customer score 2) in a medium-risk country (geography 2) using cross-border payouts (product 3), onboarded fully remotely with strong eKYC (channel 2), with expected activity in line with the trade (activity 1):
| Factor | Score | Weight | Weighted |
|---|---|---|---|
| Customer | 2 | 0.20 | 0.40 |
| Geography | 2 | 0.30 | 0.60 |
| Product | 3 | 0.25 | 0.75 |
| Channel | 2 | 0.15 | 0.30 |
| Activity | 1 | 0.10 | 0.10 |
| Total | 2.15 |
If the policy bands are low below 1.8, medium from 1.8 to 2.4, and high above 2.4, this customer is medium risk.
2. Override and knock-out rules
Some facts must decide the outcome whatever the score. A foreign PEP sets the rating to at least high. A confirmed sanctions nexus means prohibit or exit. A SAR filed in the past year may set a minimum of high. Any manual override must be justified, approved and logged.
3. Dynamic re-scoring
Ratings should update when inputs change: new alerts, a SAR, an address change to a high-risk country, a new product, or activity well above the baseline. A rating fixed at onboarding goes stale fast in FinTech.
4. Statistical or machine learning models
Some firms predict the risk of SAR-worthy activity from historical outcomes. They need clear features, explainability (for example, showing the top contributing factors for each customer), bias testing and independent validation. Supervisors and partner banks will ask why a customer is rated low.
What the rating drives
A rating matters only if it changes treatment. A typical mapping looks like this:
| Rating | Due diligence | Monitoring | Review cycle | Approval |
|---|---|---|---|---|
| Low | Standard CDD | Standard scenarios | Event-driven, plus a periodic refresh | Automated within policy |
| Medium | Standard CDD plus extra purpose and activity questions | Some lower thresholds | Periodic, for example every two years | Analyst |
| High | EDD, including source of funds and wealth where relevant | Enhanced scenarios and tighter thresholds | At least annually | Senior compliance or management |
| Prohibited | Do not onboard; exit existing relationships | Not applicable | Not applicable | MLRO decision |
The review cycles shown are examples of common practice, not legal requirements. Firms set them in policy based on their own risk assessment.
Governance of the model
- Document the methodology, weights, thresholds and the rationale for each.
- Test before launch: does the distribution make sense, and do known high-risk customers land in the high band?
- Validate periodically and review the outcomes. Track whether SARs come mainly from "low-risk" customers, which would suggest miscalibration.
- Control changes to weights and thresholds with approval and an audit trail.
- Report the rating distribution and migrations in MI (Chapter 14).
Realistic exam scenario
After a scoring update, 97% of a neobank's customers are rated low. Yet 40% of last quarter's SARs involved customers who were rated low at the time. The pattern suggests the model under-weights behavioural signals or lacks dynamic re-scoring. Compliance should open a model review, test re-weighted options with below-the-line analysis, add behaviour-based triggers such as alerts and velocity, and record the change with validation evidence. Simply moving the band thresholds until the distribution "looks right" without analysis is not defensible.
Common exam traps
- Static ratings that never change after onboarding.
- Unexplained weights: "the vendor set them" is not a rationale.
- Manual downgrades without approval or evidence.
- Ignoring override rules, for example a foreign PEP rated low because the other factors scored low.
Using weights of customer 20%, geography 30%, product 25%, channel 15% and activity 10%, a customer scores 3, 2, 2, 1 and 1. What is the weighted score?
2.40
2.25
1.65
1.95
A customer's weighted score falls in the low band, but the customer is a foreign PEP. What should a well-designed model do?
Keep the low rating, because the weighted score is objective and auditable
Apply an override rule that sets at least a high rating for foreign PEPs
Delete the PEP flag to avoid confusion
Exit the customer automatically
Which observation most strongly suggests a customer risk rating model is miscalibrated?
Ratings change whenever customers move their residence to a new country
High-risk customers generate more alerts per account than low-risk customers do
Many recent SARs involve customers who were rated low at the time
The model combines internal and external data sources in the same score
Sections you finish are checked off in the contents.