Customer risk profile: its primary purpose in a bank's CDD program

The primary purpose of a customer risk profile in a bank's CDD program is to set the baseline against which the customer's activity is monitored, so the bank can identify and report suspicious transactions and decide how much due diligence the relationship needs. FinCEN's CDD rule requires every bank to understand the nature and purpose of each customer relationship in order to develop that profile, and to monitor on an ongoing basis against it. The profile is the expected picture; monitoring is the comparison; the risk rating most banks derive from it sets how sharp the comparison is. Keeping all three current across a large book is hard because the facts live in different systems and change without notice. Botminds' Customer Risk Rating reads those systems each night, re-scores a customer when a fact moves away from the profile, and puts each change in a sentence a BSA analyst and a second signer approve.

Examples come from a fictional sample institution, Norrell Federal Credit Union, and one of its business members. The rule texts are quoted from eCFR and FinCEN, linked where they appear.

What is the primary purpose of a customer risk profile in a bank's CDD program?

To make suspicious activity recognizable. The rule couples the profile and the monitoring in a single requirement: a bank's AML program must include risk-based procedures for "(A) Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and (B) Conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information" (31 CFR 1020.210(a)(2)(v)). Part A builds the expectation; part B tests reality against it.

Without the profile, monitoring has nothing to compare against except generic thresholds that treat a wholesale distributor and a retiree alike. With it, the same $70,000 month in cash is unremarkable for one customer and a reason to ask questions about another. The profile also sets the level of due diligence: the FFIEC manual expects the bank's CDD procedures to be "commensurate with the bank's BSA/AML risk profile, with increased focus on higher risk customers" (FFIEC, CDD overview).

What is a customer risk profile?

A customer risk profile is the bank's understanding of a customer's money laundering and terrorist financing risk, built from what it learned about the relationship. FinCEN's 2018 FAQs, quoting the rule's preamble, describe customer risk profiles as "the information gathered about a customer at account opening used to develop a baseline against which customer activity can be assessed for suspicious activity reporting. This may include self-evident information such as the type of customer, or type of account, service or product" (FinCEN CDD FAQs, Question 37).

The FFIEC manual adds the vocabulary banks use: the profile "is also commonly referred to as the customer risk rating," and "a spectrum of risks may be identifiable even within the same category of customers" (FFIEC, CDD overview). The second phrase is the important one. A profile that stops at the category, a restaurant, a money services business, a non-resident alien, has not yet done its job.

Is a customer risk profile the same as a risk rating?

No: the profile is the understanding, and the rating is one way to express it. FinCEN said so directly: "The profile may, but need not, include a system of risk ratings or categories of customers. Accordingly, the documentation that is required to demonstrate an understanding of the nature and purpose of a customer relationship would vary with the type of customer, account, service, or product" (FinCEN CDD FAQs, Question 35).

In practice nearly every bank uses a rating, because tens of thousands of narrative profiles cannot drive monitoring settings. The distinction still matters: a rating that has drifted from the facts it summarizes satisfies the form and fails the purpose. A customer risk rating methodology is the bridge between the two, and the place where the profile's facts become points.

Does the CDD rule require a risk score?

No. The rule requires a customer risk profile and ongoing monitoring; FinCEN's FAQ 35 says the profile need not include ratings or categories, and the FFIEC manual leaves the number and kind of categories to each bank. What the rule does require is that the bank can show it understands each relationship well enough to tell when activity departs from it.

For some customers that understanding is almost free. FinCEN accepts that "for certain lower-risk customers, a financial institution's understanding of the nature and purpose of a customer relationship can be developed by inherent or self-evident information, such as the type of customer or type of account, service, or product," and that for a product such as a safe deposit box the nature and purpose are self-evident (FinCEN CDD FAQs, Questions 35 and 37). For a business with cash and international wires, it is not.

What goes into a customer risk profile?

Enough to predict the customer's normal activity, scaled to its risk. For higher-risk customers the FFIEC manual lists the information a bank may obtain at account opening and through the relationship; for lower-risk customers, self-evident information may be enough. Beneficial ownership is collected for legal entity customers at the 25 percent threshold regardless of risk, under a separate rule (31 CFR 1010.230).

How is a customer risk profile used in monitoring?

As the baseline. FinCEN's FAQ 36 says it in one sentence, and the FFIEC manual repeats the idea: the bank "is expected to use the customer information and customer risk profile in its suspicious activity monitoring process to understand the types of transactions a particular customer would normally be expected to engage in as a baseline against which suspicious transactions are identified" (FFIEC, CDD overview).

"This information should be used to develop a baseline against which customer activity, such as the customer's expected use of wires or typical number of deposits in a month, can be assessed for possible suspicious activity reporting."

FinCEN, CDD FAQs, Question 36 (April 3, 2018)

The sample shows the mechanism. A building supply wholesaler's profile, last updated in March 2025, expected about $25,000 a month in cash. From July to September 2026 its cash deposits ran at $64,800, $71,300 and $76,900, and wires began to two counterparties in jurisdictions on the credit union's high-risk list. Measured against the generic book, the business looked ordinary; measured against its own profile, it had nearly tripled its cash.

When must the profile change?

When the bank learns something material that bears on the customer's risk. The FFIEC manual: if updated customer information "is material and relevant to assessing the risk of a customer relationship, then the bank should reassess the customer risk profile/rating and follow established bank policies, procedures, and processes for maintaining or changing the customer risk profile/rating." It names the most common signal: "transactions or other activity that are inconsistent with the bank's understanding of the nature and purpose of the customer relationship or with the customer risk profile" (FFIEC, CDD overview).

FinCEN's FAQ 36 makes the link from monitoring back to the profile: "If account activity changes, particularly with regard to what should be anticipated based on the original nature and purpose of the account, risk-based monitoring may identify a need to update customer information." Who may then change the rating, and with whose second signature, is a separate control, covered in who may change a customer's AML rating.

A changed profile should change what follows from it. In Customer Risk Rating, a move into High drafts an enhanced due diligence case whose questions are tied to the facts that moved: where the cash comes from, what the wires are for, the relationship to the counterparties, and what activity to expect from now on. The last question rebuilds the baseline.

A move into High drafts enhanced due diligence that rebuilds the profile

The April 2026 proposal moves CDD, not the duty

FinCEN's April 2026 proposal to rewrite AML/CFT program rules would fold ongoing customer due diligence into the internal-controls requirement rather than keep it as a separate fifth pillar. The proposed text keeps the same words: covered institutions would "conduct ongoing customer due diligence, including to: (A) Understand the nature and purpose of customer relationships for the purpose of developing a customer risk profile" (91 FR 18704, proposed 31 CFR 1020.210).

FinCEN describes the move as housekeeping: the activities of the CDD pillar "are, in practice, subsumed by the obligation for a covered financial institution to have a risk-based set of internal policies, procedures, and controls that is reasonably designed," and the change "is not intended to have any substantive effect on existing obligations." Comments closed on June 9, 2026, and as of late October 2026 the rule was still a proposal. A profile program built for today's rule will fit tomorrow's.

The customer risk profile as a readable history, every change with its reason

The profile and the rating are only useful together if each reflects the other, which is the practical case for re-scoring when a fact changes rather than on a calendar. A customer risk rating system that reads the data you already hold shows how; to see it on your own members, start from Customer Risk Rating.

Questions people ask

What is the customer due diligence rule?

FinCEN's 2016 rule, with compliance from May 11, 2018, that set four core elements of CDD: identifying and verifying customers, identifying and verifying beneficial owners of legal entity customers, understanding the nature and purpose of customer relationships to develop a customer risk profile, and ongoing monitoring. The last two sit in the bank AML program rule at 31 CFR 1020.210; beneficial ownership is at 31 CFR 1010.230.

Do lower-risk customers need a documented risk profile?

They need one, but it can be thin. FinCEN accepts that for lower-risk customers the profile can rest on self-evident information such as customer type and account type, and that for products like a safe deposit box no documentation is needed beyond what establishes the account.

Can a customer risk profile be shared with the customer?

The information collected can be discussed, and asking a customer to update its expected activity is routine. The rating, alerts and any SAR are another matter: SAR confidentiality bars disclosing a SAR or information that would reveal one, so most banks keep risk ratings inside the BSA unit and phrase requests to customers as ordinary account reviews.

How often should a customer risk profile be updated?

When the bank learns of a material change; the FFIEC manual says ongoing monitoring imposes no categorical continuous or periodic update requirement, though a bank may set periodic reviews on the basis of risk. Higher-risk customers' information should be reviewed more frequently throughout the relationship.

Is the customer risk profile the same as the BSA/AML risk assessment?

No. The risk assessment covers the whole institution's products, customers and geographies; the profile covers one customer. The FFIEC manual says the factors for a customer profile are much the same as the risk categories in the bank's overall risk profile, which is why the two should use consistent definitions.