Three dates set the duty:
- February 2012. The revised FATF Recommendations say firms should be required to assess and document their risks (now INR 1 para 12).
- 26 June 2017. The UK's Money Laundering Regulations 2017 come into force, and regulation 28 ties each customer's checks to the risk of the case.
- 10 July 2027. The EU's AMLR applies, and each customer's analysis must take the firm's business wide assessment into account.
The assessment does not have to end in one answer for the whole file. FATF's own example allows "normal CDD for customer acceptance measures, but simplified or enhanced CDD for ongoing monitoring, or vice versa" (INR 1 para 16), and a customer who is lower risk for identification is not automatically lower risk for monitoring (INR 10 para 18). If your file records one level for every measure, it has thrown away part of what the assessment found.
What is a customer risk assessment?
A customer risk assessment is the step in an AML and CFT program that turns one customer's know your customer (KYC) and customer due diligence (CDD) facts into a judgment of customer risk: the chance that this customer uses the firm to launder money or finance terrorism.
What the step is called is one of the ways KYC requirements differ by country:
- EU: "an individual analysis of the risks" (AMLR Article 20(2)).
- UK: due diligence must reflect "the level of risk arising in any particular case" (MLR 2017 reg 28(12)(a)(ii)).
- US: customer risk profiling under 31 CFR 1020.210(a)(2)(v): facts gathered at account opening, such as the type of customer, account or product, as a baseline for later activity, with risk ratings optional (81 FR 29398).
- India, commercial banks: risk categories set "based on its assessment and risk perception" (RBI Know Your Customer Directions, 2025, para 20(1)).
The tier the assessment ends in is the customer's KYC risk rating.
Who should assess the customer risk, and who decides?
- The obliged firm. Banks (FATF Recommendation 10), crypto firms as virtual asset service providers (Recommendation 15), and casinos, lawyers and other designated non-financial businesses and professions (Recommendation 22).
- The method owner. Usually the AML compliance officer or MLRO, who writes the factors, weights and thresholds. Under the AMLR the compliance officer draws up the business wide assessment and the management body approves it (Article 10(2)).
- Senior management. Approves the policies (MLR 2017 reg 19(2)(b); INR 1 para 13) and foreign PEP relationships (Recommendation 12). For other higher risk files, FATF lists that approval as one enhanced measure (INR 10 para 20).
- The analyst. Applies the method to one customer and records any override with the reason.
What are the core elements of a customer risk assessment?
Risk factors come first. They are set at business level, and UK firms must take into account factors relating to their customers, countries, products or services, transactions and delivery channels (MLR 2017 reg 18(2)). The AMLR adds "information on the customer base" (Article 10(1)). The high risk countries on FATF and EU lists feed the geography factor.
Then come the customer's own facts: purpose, the size of assets and transactions, and how regular and long the relationship is (INR 10 para 19; reg 28(13)). Weights and thresholds turn the total into a tier. None of the rules cited here sets those numbers, so the method document has to.
Both rulebooks tie the two assessments: UK due diligence reflects the reg 18(1) assessment and the risk of the case (reg 28(12)(a)), and the AMLR's individual analysis takes the business wide one into account (Article 20(2)).
How do you conduct a customer risk assessment effectively?
Table 1. The six stages of a customer risk assessment, with who decides and the rule (as of October 2026).
| Stage | Input | Output | Who decides | Rule |
|---|---|---|---|---|
| 1. Set the method | Business wide assessment, national and EU assessments, customer base data | Factors, weights, thresholds, method document | Compliance officer or MLRO; senior management approves | MLR 18(1), (2), (4), 19(2)(b); Directive (EU) 2015/849 Art 8 (AMLR Art 10 from 10 July 2027); INR 1 paras 12, 13 |
| 2. Collect | Identity, beneficial owner, purpose, nature of business, expected activity | The customer file | Onboarding analyst | R10; MLR 28(2), (13); 31 CFR 1020.210(a)(2)(v)(A); AMLR Art 20(1)(a) to (c), (e) |
| 3. Screen | Sanctions, PEP and adverse media checks | Matches resolved | Screening analyst | AMLR Art 20(1)(d), (g); R12 |
| 4. Weigh and score | Stage 1 factors applied to this customer | Profile, score, tier | The model; the analyst records any override and why | MLR 28(12)(a)(ii); AMLR Art 20(2); 2015/849 Art 13(3), Annex I |
| 5. Decide and record | Profile, tier, override reasons | A level per measure; accept, conditions or decline; the record | Analyst; senior management for foreign PEPs, and for other higher risk files where the method asks for it | INR 1 para 16; INR 10 para 20; R10, R12; AMLR Art 21; MLR 28(16), reg 40 |
| 6. Review | Triggers, review date, alerts | Updated profile and tier; method changes go back to stage 1 | Analyst | MLR 27(8); 2015/849 Art 14(5); 31 CFR 1020.210(a)(2)(v)(B) |
Stage 2 is customer due diligence. Stage 3, customer risk screening, includes PEP screening, because a confirmed PEP changes the result. Stage 4 is customer risk scoring.
At stage 5 the file sets a level for each measure, from simplified to enhanced due diligence, and whether to accept, accept with conditions or decline. When due diligence cannot be completed, FATF Recommendation 10 says not to open the account or start the relationship, or to end it, and to consider a suspicious transaction report.
What changes when the customer is a company?
For a corporate customer, part of the risk sits in who owns and controls it. UK firms must take reasonable measures to understand the ownership and control structure (reg 28(3A)), and the AMLR asks for the beneficial owners and the nature of the business (Article 20(1)(b) and (e)). Picture a merchant owned through two holding companies in two countries. Once KYB and UBO verification has traced that chain, the geography factor takes each owner's country as well as the merchant's.
When is a customer risk assessment redone, and how is the method checked?
Run the assessment again when something changes, whatever the review date says:
- Changed circumstances. Facts relevant to the customer's assessment change (MLR 2017 reg 27(8)(b)).
- Doubt. Earlier identity data looks unreliable (reg 27(1)(d)).
- An alert. Activity stops matching the profile.
- New owners. A new beneficial owner or a harder to read structure.
- A new product or country. Something the first assessment never weighed.
Between events, ongoing monitoring keeps the profile current. The method is checked too: firms must be able to show the supervisor that their measures fit the risks (reg 28(16); AMLR Article 20(4)).
In a US bank, whether a scored assessment counts as a model is the bank's own call. The 2021 interagency statement on model risk management says the definition also covers qualitative or expert judgment inputs where the output is quantitative (footnote 6).
What should a customer risk assessment tool do?
A client risk assessment tool should keep the method with the result: the factors, the weights, the version behind each rating and the source of each input.
In complead, customer risk assessment and KYC runs on the firm's own factors and weights, simulates a change on the live portfolio before publishing it, and stamps each rating with its model version, factors, weights and sources. When a factor stops separating risk, the product proposes a change with the evidence, for the team to simulate and approve.
What changed in 2026?
- 10 April. FinCEN's AML and CFT program proposal (91 FR 18704) would require documented risk assessment processes and keeps the customer risk profile duty; no final rule as of 28 October.
- 30 June. MLR reg 33(1)(b), as amended by S.I. 2026/621, ties mandatory enhanced due diligence to a "FATF call for action country".
- 10 July. AMLR Article 20(3)'s date for AMLA's guidelines on customer risk factors. AMLA's overview of 7 October lists none, and the EBA's guidelines still apply.
The three dates at the top mark where the duty sits: FATF asks countries to require the assessment, the UK wrote it into reg 28(12), and from 10 July 2027 the AMLR applies it directly in every member state.
Related terms
- KYC risk rating. The low, medium or high tier a customer risk assessment ends in.
- AML risk assessment. The firm wide, or business wide, assessment that sets the risk factors.
- Customer due diligence. The checks that collect the facts the assessment weighs.
- Enhanced due diligence. The extra measures a higher risk result calls for.
- Ongoing monitoring. The watch on activity and data that can set off a new assessment.
- Perpetual KYC. Reviews started by events, with a fixed date kept as the backstop.
How this entry was checked. Ufuk Gürdaş, Compliance Specialist, reads each rule cited here against its source before publication; the stage table and the text are by Onur Taner, Customer Success Manager at complead. Last reviewed: 28 October 2026. The rules were reopened on 28 October 2026: the FATF Recommendations (June 2026 text, Recommendations 10, 12, 15 and 22, INR 1 and INR 10), the UK Money Laundering Regulations 2017 (regulations 1, 18, 19, 27, 28, 33 and 40, with S.I. 2026/621), Regulation (EU) 2024/1624 (Articles 10, 20 and 21), Directive (EU) 2015/849 (Articles 8, 13 and 14), 31 CFR 1020.210, 81 FR 29398, FinCEN's proposal of 10 April 2026, the RBI's Know Your Customer Directions, 2025 for commercial banks, the 2021 interagency statement on model risk management and AMLA's overview of 7 October 2026. Table 1 condenses those rules into stages and is not a template.
