A customer risk rating methodology is the written method a bank uses to turn what it knows about a customer into a risk tier: which factors it considers, how much each weighs, where the tier boundaries sit, and why. The FFIEC manual sets no required format. It asks the bank to consider products and services, customers and entities, and geographic locations, says some factors may be weighted more heavily than others, and treats actual or anticipated account activity as a key factor. The hard part is not choosing factors; it is weighting them so that the tiers separate customers who really differ, and writing a reason anyone can check. Botminds' Customer Risk Rating applies a bank's own methodology, keeps every version back-tested and approved, and explains each change as a sentence in which every clause shows its rule and its points.
The worked scores come from a fictional sample institution, Norrell Federal Credit Union, and its method version 4.2. The rules are linked where they appear.
How one cash rule turns 'how far from expected' into points
What is a customer risk rating methodology?
It is the bank's documented answer to three questions: which facts about a customer indicate money laundering or terrorist financing risk, how much each should count, and where the lines between tiers fall. The FFIEC manual does not prescribe the answer. "There are no required risk profile categories and the number and detail of these categorizations will vary based on the bank's size and complexity," it says, and "any one single indicator is not necessarily determinative of the existence of a lower or higher customer risk" (FFIEC, CDD overview).
That freedom is also the obligation. A bank that can choose its factors must be able to say why it chose them, and the FFIEC's risk assessment section states the sound practice plainly: "Regardless of the bank's approach, sound practice would be to document the factors considered, including any weighting" (FFIEC, BSA/AML Risk Assessment). A methodology without that documentation is a scorecard with an author nobody can ask.
The statute sets the direction. The AML Act of 2020 wrote into law that programs be "risk-based, including ensuring that more attention and resources of financial institutions should be directed toward higher-risk customers and activities, consistent with the risk profile of a financial institution, rather than toward lower-risk customers and activities" (AML Act of 2020, §6101). A methodology is how that sentence is applied to each customer.
What factors go into a customer risk rating?
The FFIEC manual names three categories, "Products and Services," "Customers and Entities" and "Geographic Locations," and adds that "actual or anticipated activity in a customer's account can be a key factor in determining the customer risk profile." Most methods turn those into four to six families. The sample method uses five families of facts: customer profile, products and services, geography, channel and activity.
A customer risk score is a sum of five families, with caps
Customer profile
at most 15 points
Type, ownership and line of business. Type alone may carry at most 10 points (rule G-1).
Account opening and ownership file
Products and services
at most 15 points
International wires, cash management, remote deposit capture, ACH origination for others.
Core banking
Geography
points per rule
Where the customer is, and where its money goes, against a versioned high-risk list.
Core banking and wire logs
Channel
points per rule
How the relationship is conducted, for example remote opening or third-party conductors.
Account opening and core banking
Activity
at most 40 points
Actual activity against expected: cash intensity, P2P velocity, wires, dormancy.
Core banking and monitoring
The heaviest family is activity, and that is deliberate. A customer's type and products describe what it could do; its activity measured against what it said it would do describes what it is doing. FinCEN's CDD guidance frames the profile as a baseline for exactly that comparison, which is why every activity rule in the sample method compares actual with expected rather than with a fixed number.
How do you weight risk factors? Points, caps and a ceiling on type
Weight factors by how well each separates customers who later turn out to differ, cap each family so no single attribute can carry a customer into High on its own, and put a hard ceiling on customer type. The FFIEC risk assessment section allows that "the bank may determine that some factors should be weighted more heavily than others" and warns against treating "any single indicator as determinative" (FFIEC, BSA/AML Risk Assessment).
Caps matter more than the weights inside them. Without a cap, a customer type the bank considers risky can be weighted so heavily that every customer of that type lands in High whatever it does, which is the outcome the 2022 interagency joint statement warns against when it says no customer type presents a single level of uniform risk. The sample method caps type at 10 of 100 points and adds rule G-2: a move into High needs facts from at least one family other than the customer profile. Whether a cash-intensive business is high risk works through the consequences for one type.
Tier cut-offs need the same care. A boundary at 60 means a customer at 59 and one at 60 get different monitoring, so the method should say why the line sits there and how many customers sit within a few points of it. That population is where small weight changes move the most people, and where a batch sample should look first.
How are customer risk scores calculated?
Each rule that applies adds or subtracts its points, the families are summed within their caps, and the total is compared with the tier cut-offs. The arithmetic is simple; what makes a score defensible is that every rule that fired is named with its points and evidence. Take a downgrade from the sample credit union, scored overnight on October 22, 2026.
A worked score down: from 64 (High) to 22 (Low), and why it was still held
| Step | Rule | Points | Evidence |
|---|---|---|---|
| Score before | Method version 4.1, signed | 64 · High | High since February 11, 2025 |
| Account dormant | A-9 · activity | −30 | The core marked the account dormant after 14 months with no activity |
| Wire service closed | P-2 · products and services | −12 | International wire service closed on August 4, 2025 |
| Score after | Method version 4.2 | 22 · Low | Low is under 35 |
| Type check | G-1, G-2 | passed | Consumer customers get 0 points for type; the downgrade does not depend on it |
| Hold check | H-1 · open activity | held | A joint account the customer shares has an open monitoring alert, opened October 9 |
The upward case runs the same way. A business customer moved from 38 to 67 when rule A-3 added 14 points for cash at more than two and a half times expected and the geography rules added 15 for wires to two listed jurisdictions; an AML risk rating tool that explains each score opens that one clause by clause. In both directions, the score is only as good as the rules that can be named behind it.
Each clause of a rating change opens its rule, its family and its points
What is a customer risk rating matrix?
A customer risk rating matrix is a table that lists the risk factors down one side and describes what low, moderate and high look like for each, so that analysts rate consistently and examiners can see the logic. It is the human-readable form of a scorecard. The FFIEC's own quantity-of-risk matrix in Appendix J does the same job at the level of the whole bank; a customer matrix borrows its structure.
A customer risk rating matrix, factor by factor
| Factor | Lower risk | Moderate risk | Higher risk |
|---|---|---|---|
| Activity against expected | Within the expected profile | Sustained at 1.5 to 2 times expected | Sustained at 2.5 times expected or more, or unexplained new activity types |
| Cash intensity | Little cash, or cash in line with the stated business | Cash rising without a stated reason | Large cash well above peers or the stated business, or deposits away from the customer's area |
| Products and services | Deposit and payment basics | Cash management, remote deposit capture | International wires, ACH origination for third parties, correspondent-like services |
| Geography | Domestic, local, no listed counterparties | Some transfers involving higher-risk areas | Regular transfers to listed high-risk jurisdictions |
| Ownership and control | Simple, verified, screened | Layered but explained | Unexplained layers, politically exposed owners, adverse media |
| Customer type | Contributes little on its own | Contributes little on its own | Contributes little on its own: never enough for High by itself |
What do high, medium and low risk customers get?
A tier is only meaningful through what it changes: how much information the bank collects, how often it reviews, and how tightly monitoring is tuned. The FFIEC manual says "information provided by higher risk profile customers and their transactions should be reviewed more closely at account opening and more frequently throughout the term of their relationship with the bank."
What each tier changes: the FFIEC illustration, and one institution's settings
FFIEC Appendix K illustration: The lowest steps of the chart: a basic profile, a profile specific to the products used, and generic threshold monitoring.
The sample credit union: Standard monitoring; re-scored on change and in the quarterly whole-book re-score.
FFIEC Appendix K illustration: More information, such as a source of wealth statement and financial statements, as risk rises.
The sample credit union: Tighter monitoring thresholds; any move into High proposed by the agents goes to a person, never to a batch.
FFIEC Appendix K illustration: A "customized transaction profile with tailored monitoring against transaction profile."
The sample credit union: High-tier monitoring thresholds from the day the change is signed; an enhanced due diligence case opened, due within 30 days.
The cost of getting a tier wrong runs in both directions. Too low, and monitoring misses activity the bank should have seen. Too high, and investigators spend enhanced due diligence on customers who do not need it while the queue for those who do grows. In October 2026 the OCC fined American Express National Bank $350 million in part because the bank's BSA/AML risk assessment did not fit its business, concentrating on deposit products rather than its dominant card business (OCC News Release 2026-87). A methodology has the same duty at customer level: weight what the customers actually do.
The written reason: a sentence per factor
A methodology should require that every rating change be explained in words a second reader can test, not just a total. The reason is what lets a checker agree or disagree, an examiner follow the decision, and the next analyst know what would reverse it. In Customer Risk Rating the Rating agent writes each change as one sentence whose clauses each cite a source and the points their rule awarded, plus a reverse sentence stating what would move the rating back.
What a written reason for a rating change should contain
- The change: from which tier to which
And the score before and after, under which method version.
- Each factor that moved, with its points
Named by rule, so a reader can open the rule and check the weight.
- The evidence for each factor, with where it came from
The monthly cash figures, the wire log entries, the date a service was added.
- What the customer was expected to do
A rise is only a risk against a baseline; name the baseline and when it was last updated.
- What would move it back
Conditions, not hopes: cash under a level for a period, no listed wires for 90 days.
- The checks: type alone, open activity, stale data
Whether a move into High rests only on type, and whether anything open should stop a downgrade.
A customer's rating history, every entry a sentence with its method version
The national priorities as rating factors
FinCEN's national AML/CFT priorities are a useful test of whether a methodology weights the right things. The June 30, 2021 list, still the current one, names eight: corruption; cybercrime, including cybersecurity and virtual currency; foreign and domestic terrorist financing; fraud; transnational criminal organizations; drug trafficking organizations; human trafficking and smuggling; and proliferation financing (FinCEN, AML/CFT National Priorities).
Each maps to factors a rating can read. Fraud shows up in P2P velocity and new-payee bursts; drug trafficking in cash intensity and in HIDTA and HIFCA geography; corruption in politically exposed owners; cybercrime in virtual currency exposure. A method with no factor that would move for any of the eight has a gap worth writing down.
Timing matters here. FinCEN's April 2026 proposal would require institutions to review the priorities and build them into their risk assessments where they apply, but not until a final rule takes effect (FinCEN fact sheet, April 2026). Mapping factors to the priorities now is good practice, not yet a legal duty.
Questions people ask
What is customer risk rating in banking?
The tier, usually low, moderate or high, a bank assigns each customer for money laundering and terrorist financing risk, used to set monitoring and decide when enhanced due diligence starts. It is how most banks express the customer risk profile the CDD rule requires, though FinCEN's guidance says the profile need not be a rating at all.
What are high, medium and low risk customers?
Tiers produced by the bank's methodology, not categories set by regulation; the FFIEC manual says there are no required risk profile categories. What separates them is the treatment each receives: more information, more frequent review and tighter monitoring as the tier rises.
How many risk tiers should a customer risk rating have?
As many as the bank can treat differently; the manual leaves the number to the bank's size and complexity. Three tiers is common because most banks have three meaningfully different treatments; a fourth tier that triggers nothing different only adds a boundary to argue about.
How often should a customer risk rating methodology be reviewed?
Whenever the book, the products or the threats change materially, and on a cycle the bank sets. The sample credit union back-tests every new version on the whole book before use and routes overrides coded as disagreement with a factor weight to the method's owner, so recurring disagreement becomes a proposed revision.
Should customer type carry points in a risk rating?
It can, but it should never decide a high rating on its own. The 2022 interagency joint statement says no customer type presents a single level of uniform risk; capping type points and requiring another family of facts for any move into High is one way to make that true in the arithmetic.