Customer Risk Rating: How to Build an AML Risk Score

9/1/2026

Every bank has an institution-level BSA/AML risk assessment: the document that looks across products, services, customers and geographies and concludes where the bank's money laundering and terrorist financing exposure sits. That document gets a lot of attention. The customer-level risk rating gets less, even though it is the mechanism that actually decides how much diligence and monitoring each relationship receives.

This post is about the customer-level model: what goes into a customer risk score, how to weight it, how to handle overrides, and how to keep scores current. It is written for BSA officers and analysts building or rebuilding a model, and for operations staff who need to understand why the system rated a customer the way it did. For the institution-level exercise, see our separate guide to the BSA/AML risk assessment.

What the rules require, and what they do not

The legal hook is the CDD element of the bank AML program rule at 31 CFR 1020.210. Banks must have appropriate risk-based procedures for conducting ongoing customer due diligence, including "understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile," and conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

Notice what is required: a customer risk profile. Notice what is not: a numeric score, a specific number of tiers, or any particular methodology. FinCEN's CDD rule FAQs, consolidated and reissued in May 2026, are explicit that the rule does not require a specific method or categorization to establish customer risk profiles, and does not require institutions to automatically classify products or customer types identified in government publications as high risk. There are no prescribed risk categories, and the number and detail of categories can vary. What FinCEN does expect is that profiles be detailed enough to distinguish between significant variations in the risks of the bank's customers.

So a scored model is a choice, and a sensible one for most banks, because it makes ratings consistent across staff and branches, gives monitoring a field to key off, and produces an auditable trail. But the model has to serve the profile, not the other way round. A score with no narrative behind it is not a risk profile.

Step 1: Start from the institution-level risk assessment

The customer model should inherit its logic from the bank's risk assessment. If the risk assessment identifies cash-intensive businesses, international wires and remote deposit capture as the bank's main exposures, those should be heavily weighted factors in the customer model. If the model weights factors the risk assessment never mentions, or ignores ones it rates as high, an examiner will see the disconnect immediately.

A practical test: for each "high" or "elevated" conclusion in the risk assessment, point to the factor in the customer model that captures it. For each factor in the model, point to the risk assessment conclusion that justifies it. Gaps in either direction need fixing or explaining.

Step 2: Choose your risk factors

Most models score customers across four or five dimensions. The specific indicators depend on the bank, but the categories are fairly standard.

Customer type and characteristics

Individual versus legal entity, and entity type
Industry or occupation, mapped to risk tiers (for example, money services businesses, cash-intensive retail, professional service providers holding client funds, third-party payment processors, certain nonprofits)
Ownership complexity: layered structures, nominee arrangements, trusts, foreign parents
Politically exposed person status, assessed by role and country rather than as an automatic flag
Length of relationship and history with the bank
Prior SAR filings, law enforcement inquiries, or subpoenas
Adverse media

Products and services

Basic deposit and loan products at the low end
Wire transfers, especially international
Remote deposit capture
Cash management and sweep services
Foreign exchange, trade finance, correspondent services
Private banking or trust relationships with complex structures
Prepaid access, ATMs owned by the customer, and payment processing for third parties

Geography

Customer's location and principal places of business
Countries involved in expected wire and ACH activity
Jurisdictions subject to sanctions programs, special measures, or international non-cooperation designations
Domestic areas the bank's risk assessment flags, such as High Intensity Drug Trafficking Areas or High Intensity Financial Crime Areas, if relevant to the footprint

Delivery channel

In-person onboarding versus fully remote
Introduced through a third party, broker, or fintech partner
Use of nominees or agents to conduct transactions

Expected activity

Expected volume and value of cash deposits and withdrawals
Expected wire and ACH volume and counterparties
Whether expected activity is plausible for the customer's stated business and size

The last dimension is often missing from scoring models even though it is central to the profile. A small landscaping company expecting modest monthly cash deposits is one risk; the same company expecting large weekly cash deposits and international wires is another.

Step 3: Weight the factors

There is no regulatory formula. The goal is a model that produces ratings an experienced analyst would agree with most of the time, and that can explain itself when they disagree.

Three common approaches:

Additive point models. Each factor is scored, scores are summed, and the total maps to a tier. Simple to explain and audit. The weakness is that several moderate factors can add up to a rating that overstates risk, while one severe factor can be diluted.

Weighted models. Each dimension carries a weight that reflects the bank's risk assessment, for example weighting customer type and geography more heavily than delivery channel. More accurate, but the weights need documented rationale and periodic validation.

Hybrid models with override factors. A weighted score plus "hard" factors that set a minimum rating regardless of the score. For example, any customer in a section 312 enhanced due diligence category, any customer with a recent SAR, or any customer with an OFAC-related concern is rated high whatever else the score says. Most mature programs end up here.

Here is a simplified illustration of a hybrid model. The factors and weights are an example only, not a recommendation; a bank's own model must come from its own risk assessment.

Dimension	Illustrative weight	Example low-risk indicator	Example high-risk indicator
Customer type	30%	Salaried individual, payroll deposits	MSB, cash-intensive business, complex ownership
Products and services	25%	Checking and savings only	International wires, remote deposit capture, third-party payments
Geography	20%	Local customer, domestic activity only	Activity with higher-risk or sanctioned jurisdictions
Expected activity	15%	Activity consistent with stated occupation or business	Volume or patterns implausible for the stated business
Delivery channel	10%	In-person, established relationship	Remote onboarding via a third party
Override factors	Sets minimum tier	None	Recent SAR, section 312 category, credible adverse media

How many tiers

Three tiers (low, moderate, high) are the most common and the easiest to operate. Some banks add a fourth "prohibited" or "unacceptable" tier for customers they will not serve, and some split high into two levels to direct the most intensive EDD to the top slice. More tiers only help if each one carries a different treatment. If moderate and elevated get identical monitoring and review, they are one tier with two names.

Calibrate before you launch

Run the model against the existing customer base before it goes live. Look at the distribution: if 40 percent of the portfolio lands in high risk, either the bank is unusually exposed or the model is miscalibrated, and the EDD workload will be unmanageable either way. Sample customers from each tier and have experienced analysts rate them blind. Where analyst and model disagree, find out why and adjust. Keep the calibration work; it is your evidence that the weights are not arbitrary.

Step 4: Decide what each rating drives

A rating that does not change anything is decoration. The policy should state, for each tier:

Onboarding requirements, including approvals and EDD collection
Monitoring treatment, such as scenario thresholds, additional rules, or manual review
Periodic review interval, if the bank uses one
Event triggers that force an immediate review
Who can approve opening, continuing, or exiting the relationship

FinCEN's FAQs say there is no categorical requirement to update customer information on a continuous or periodic schedule; updating is risk-based and follows from monitoring. Many banks still set review intervals by tier because it is a straightforward way to show higher-risk customers are being revisited. If you set intervals, set ones you can meet, and track the backlog.

Step 5: Handle overrides

Analysts will sometimes know things the model does not. A long-standing customer may have a well-documented explanation for activity that looks unusual; a newly onboarded business may raise concerns the model cannot see. Overrides should be allowed, and they should be controlled:

Document the reason in plain language
Require approval above the analyst, at least for downgrades
Report overrides as a set to the BSA officer periodically
Watch the override rate. If a large share of ratings are overridden, or overrides run mostly in one direction, the model needs recalibrating

Downgrades deserve particular scrutiny. An override that moves an MSB from high to moderate because "relationship manager knows the owner" is the kind of decision examiners will ask about.

Step 6: Keep scores current

Risk ratings decay. A customer rated at onboarding five years ago may have changed products, owners, and activity entirely. Ratings should be refreshed:

On events: ownership or signer changes, new products such as international wires, significant changes in activity, adverse media, SAR filings, law enforcement inquiries, returned mail or failed address verification
On review: at each periodic review where the bank uses intervals
Systemically: when the model itself changes, rescore the whole portfolio and review movements between tiers

Monitoring and rating should feed each other. Alerts that are closed as "consistent with customer profile" are only valid if the profile is current. Alerts that reveal a change in the customer's business should update the profile and, where warranted, the rating. The bank's 2026 options under FinCEN's beneficial ownership relief order, which lets banks stop re-collecting ownership at every new account for an existing legal entity customer, make these triggers more important, not less.

Step 7: Govern and validate the model

Treat the risk-rating model like any other model the bank relies on:

Document the factors, weights, tier cut-offs, override rules, and the rationale for each, tied back to the risk assessment
Assign ownership: who can change the model and who approves changes
Validate periodically, including back-testing against SAR filings (are customers you filed on concentrated in higher tiers?) and against analyst judgment samples
Include it in independent testing. The FFIEC BSA/AML Examination Manual's independent testing section covers whether the bank's BSA/AML risk assessment aligns with its risk profile and whether policies and procedures align with that profile; the customer rating model is one of the main places that alignment is tested in practice
Record changes with dates so a reviewer can tell which version produced a given rating

For more on governance of models generally, see model risk management.

What examiners look for

When examiners review customer risk ratings, the questions are usually:

Does the methodology reflect the bank's own risk assessment?
Are similar customers rated similarly, and where they are not, is there a documented reason?
Do higher ratings actually lead to more diligence and monitoring?
Are high-risk reviews performed when the policy says they will be?
Are overrides documented, approved, and reviewed?
Can someone at the bank explain how the score is calculated without calling the vendor?

That last question comes up more than it used to. If the rating sits inside a vendor platform, the BSA function still owns it. Someone should be able to walk an examiner through a sample customer's score factor by factor.

Training the people who use the score

The model is only as good as the data entered at onboarding. If account-opening staff record "retail" as the business type and leave expected activity blank, no weighting scheme will rescue the rating. Front-line staff need to understand which fields drive the score and why specificity matters. Analysts need to understand the model well enough to recognize when it is wrong.

Our BSA/Anti-Money Laundering course is built for staff who need a working grasp of BSA/AML requirements, including the customer due diligence obligations that risk rating supports. For broader program context, see AML compliance program pillars and our KYC and customer due diligence guide, or browse all Bank Secrecy Act training.

Summary

A good customer risk rating model is built from the bank's risk assessment, uses factors that capture how the bank is actually exposed, drives real differences in diligence and monitoring, allows controlled overrides, and stays current through events and reviews. None of that is prescribed by regulation, which is exactly why the documentation behind it matters. To get operations and compliance staff on the same page about the requirements behind the score, start with BSA/Anti-Money Laundering.

Frequently Asked Questions

What is an AML customer risk assessment?

It is the process of evaluating the money laundering and terrorist financing risk an individual customer presents, producing a customer risk profile and, in most banks, a risk rating. It is distinct from the institution-level BSA/AML risk assessment, which evaluates the bank's overall exposure across products, customers, and geographies. The customer-level assessment draws on that institution-level work to decide which factors matter and how much.

Is a customer risk rating legally required?

The bank AML program rule requires risk-based procedures for understanding the nature and purpose of customer relationships to develop a customer risk profile. FinCEN's CDD FAQs say the rule does not require a specific method or categorization, and there are no prescribed risk categories. A numeric risk score is therefore a common way of meeting the requirement rather than a mandated one. Profiles must still be detailed enough to distinguish significant differences in customer risk.

What factors go into an AML risk score?

Most models assess customer type and characteristics, products and services used, geography, delivery channel, and expected activity. Typical high-risk indicators include money services or cash-intensive businesses, complex ownership, international wires, remote deposit capture, activity with higher-risk jurisdictions, remote onboarding through third parties, adverse media, and prior SAR filings. The weighting should reflect the bank's own risk assessment, and some factors may set a minimum rating regardless of score.

How many risk tiers should a bank use?

There is no required number. Three tiers (low, moderate, high) is most common and easiest to operate. Some banks add a prohibited tier or split high risk in two. The test is whether each tier carries a different treatment in onboarding, monitoring, and review. If two tiers are handled identically, they do not need to be separate.

How often should customer risk ratings be updated?

FinCEN's FAQs say there is no categorical requirement to update customer information on a periodic schedule; updates are risk-based and arise from monitoring. In practice, ratings should be refreshed on events such as ownership changes, new products, significant activity changes, adverse media, or SAR filings, and at any periodic review the bank's policy sets. When the model itself changes, rescore the whole portfolio.

Can analysts override the model's risk rating?

Yes, and good programs allow it. Overrides should carry a written reason, require approval above the analyst at least for downgrades, and be reported to the BSA officer as a set. A high or one-directional override rate is a signal that the model needs recalibrating. Examiners pay particular attention to downgrades of customers in inherently higher-risk categories.