Risk rating override: who may change a customer's AML rating

A risk rating override is a decision by a person to set a customer's AML risk rating to something other than what the bank's rating method produced: an upgrade the score did not reach, a downgrade it did not allow, or a rating held in place when the score moved. Overrides are legitimate and necessary, because no scorecard sees everything an analyst sees. They are also where a rating program is weakest, because an override replaces arithmetic with judgment, and judgment needs a name, a reason and a second person. The FFIEC BSA/AML Examination Manual expects every bank's procedures to say who in the organization may change a customer's risk profile. Botminds' Customer Risk Rating is built around that expectation: agents propose and explain each rating change, and a named analyst, a different checker and, for overrides, the BSA Officer sign it.

The examples come from a fictional sample institution as it runs through the solution: Norrell Federal Credit Union, with 520,000 members and a BSA unit of analysts, a senior analyst, a BSA Officer and a model risk manager. The rules come from the FFIEC manual, FinCEN and the OCC, linked where they appear.

What is a risk rating override?

A risk rating override is any change to a customer's AML risk rating that departs from the output of the bank's approved rating method. It covers three moves: raising a rating above the score (an analyst knows of adverse media the score does not read), lowering it below the score (the customer has documented why its cash rose), and refusing a change the score proposes (a downgrade while an alert is open). All three change how closely the customer is watched, so all three need the same discipline.

The rating itself rests on the customer due diligence rule. A bank's AML program must include risk-based procedures for understanding the nature and purpose of each customer relationship so as to develop a customer risk profile (31 CFR 1020.210(a)(2)(v)), and the FFIEC manual treats that profile and the customer risk rating as the same thing. An override therefore changes the document the bank uses to meet a regulation, which is why examiners care who made it.

Overrides are not a sign of a broken method. A method that is never overridden is either perfect or not being read. The useful questions are who may override, on what grounds, with whose second signature, and whether the overrides cluster around a factor the method gets wrong. The last question is how overrides improve the customer risk rating methodology rather than quietly replace it.

Who can change a customer risk rating? The FFIEC answer

The FFIEC manual does not name a role; it requires the bank to name one. "The procedures should indicate who in the organization is authorized to change a customer's risk profile," the Customer Due Diligence overview says, and the bank's CDD procedures should contain "a clear statement of management's and staff's responsibilities, including procedures, authority, and responsibility for reviewing and approving changes to a customer's risk profile, as applicable."

Two words in that sentence do the work. "Authority" means a list of roles, not a shared spreadsheet anyone can edit. "Approving" means a change is not finished when one person makes it. Most programs answer with a ladder: an analyst may propose and make routine changes, a senior analyst or manager must approve moves into the highest tier and any override, and the BSA Officer decides the exceptions, such as overriding a hold or a policy rule. The ladder is a choice; having one is not.

The override chain: proposal, review, approval, trail

An override holds up when four things can be shown for it: what the method proposed, who departed from it and why, who approved the departure, and what evidence both people saw. Each link answers a different examiner question, and a missing link turns a judgment into an unexplained change.

The proposal matters because an override is measured against it. If the method's output is not kept, nobody can tell an override from an ordinary change, and the override rate cannot be counted. In Customer Risk Rating the Rating agent writes each proposed change as one sentence, with every clause cited to its source and its points, and the reverse sentence that says what would move the rating back. An analyst who overrides is disagreeing with something specific.

The review is where the reason is written. The approval is a second person reading the same evidence, not a summary: in the solution the checker sees the sentence, the sources and both checks the maker saw, and the Sign button is locked on any change or batch the checker prepared. The trail keeps who did what, when, under which method version and on which evidence, for five years from each decision.

Can a relationship manager lower a risk rating?

Only if the bank's procedures name the relationship manager as authorized, and few BSA programs should. The FFIEC manual leaves the list to the bank, but the conflict is plain: the person paid on a relationship is the person most likely to see its activity as normal. A relationship manager's proper role is to bring facts, such as the contracts behind a rise in cash, to the BSA unit, which decides what they mean for the rating.

FinCEN's consent order against TD Bank shows the pressure in writing. When the bank onboarded a group of companies whose cash deposits soon worried branch staff, the sales team acknowledged that "the cash is what is making this [relationship] so lucrative," and the bank focused "primarily on its operational (but not AML-related) risks" by enrolling the customers in armored car services (FinCEN Consent Order 2024-02). What the TD Bank case says about unrated customers follows the rest of that failure.

The sample credit union goes one step further: member risk is visible to the BSA unit only, and the BSA Officer can preview what a member-facing employee sees. A relationship manager who never sees the rating cannot lean on it, and cannot let slip to a customer that one exists.

How should risk rating overrides be documented? Reason codes that carry weight

Document an override with a code that can be counted and a note that can be checked. The code lets the BSA Officer and model risk see patterns across hundreds of overrides; the note lets an examiner test one. A note that says "relationship reviewed, no concerns" can be neither counted nor checked.

A good note names the evidence: which document explained the activity, which alert is still open, which fact in the score is wrong. The FFIEC manual asks for "standards for conducting and documenting analysis associated with the due diligence process, including guidance for resolving issues when insufficient or inaccurate information is obtained" (CDD overview). A code list is the simplest standard.

Rejecting a downgrade with a reason code, kept with the decision

One code deserves attention: disagreement with a factor weight. An analyst who overrides because the method weights something wrongly is not making a customer decision; she is making a method decision one customer at a time. Routing that code to the method's owner turns a stream of individual overrides into one proposed revision, back-tested before it scores anyone.

What triggers a risk rating change, and what does not

A rating should change when something material about the customer changes, not when the calendar turns. The FFIEC manual says the requirement to update customer information "is event-driven and occurs as a result of normal monitoring," and that the ongoing monitoring element "does not impose a categorical requirement that the bank must update customer information on a continuous or periodic basis" (CDD overview). A bank may still schedule periodic reviews on the basis of risk.

What should not trigger a change is a customer's type alone, or an analyst's comfort with a long relationship. Re-reviews driven by events, and how they sit alongside a periodic schedule, belong to the know-your-customer program; the rating's job is to move when the evidence moves. How a rating system re-scores on change shows the mechanics.

A downgrade during open activity is the override to stop

The riskiest override is a downgrade signed while the customer has an open alert, case or law enforcement request. It lowers monitoring at the moment the bank has the most reason to watch, and it reads badly in any later lookback. The sample credit union writes the rule into its method: rule H-1 holds any downgrade during open activity, and only the BSA Officer can override that hold.

A High to Low downgrade, held because a shared account has an open alert

The member's own account was dormant for 14 months; the joint account she shares moved $48,000 in by ACH and $46,500 out by P2P to nine recipients within 36 hours. The score is right about her account and wrong about her. That gap, between what a method reads and what a person knows, is the honest case for overrides, and also the case for making them visible.

The reverse failure exists too. FinCEN found that TD Bank in 2018 "reduced the ACH product risk rating to 'medium,' without any documentation or rationale to support this downgrade" (FinCEN Consent Order 2024-02). That was a product rating, not a customer's, but the lesson carries: a downgrade with no written reason is the change examiners find first.

Do examiners look at risk rating overrides?

Yes, as a test of the process rather than a second-guessing of each decision. "Examiners may review individual customer risk decisions as a means to test the effectiveness of the process and CDD program," the FFIEC manual says, and where the bank has an effective process and followed it, "the bank should not be criticized for individual customer risk decisions unless it impacts the effectiveness of the overall CDD program, or is accompanied by evidence of bad faith or other aggravating factors" (CDD overview).

That sentence is the strongest argument for documenting overrides well. The protection it offers depends on two conditions: an established process, and evidence that it was followed. An override with a named approver, a code and a note satisfies both. An override that exists only as a changed value in the core banking system satisfies neither.

How much an examiner samples depends on the bank's risk. The OCC's community bank procedures, effective for exams beginning February 1, 2026, say "the size and composition of a sample selected for testing, as well as the type of testing, should be commensurate with the bank's risk profile and the examination scope" (OCC Bulletin 2025-37). A short list of overrides with reasons is easy to sample; a long list without them invites a larger one.

Override rates as an early signal

Review the override rate monthly by reason and by factor, and the method at least when the rate moves. There is no regulatory figure for a normal rate; what matters is the trend and the pattern. A rate that climbs means the method has drifted from the book; overrides clustered on one factor mean that factor's weight is wrong; overrides clustered on one analyst mean training or a conflict.

Overrides of the highest tier deserve their own line. A bank that overrides moves into High more often than moves out of it has a method that over-rates; the opposite pattern deserves a harder look, because it lowers monitoring. Customer Risk Rating keeps 30-day override rates with the method and agent versions, so model risk can see a change in behavior after a new version goes live.

The checker's desk: same sentence, same evidence, a different person

One more control is worth copying whatever system a bank uses: a closed account or an exited relationship is not an override of the rating. The FFIEC manual is explicit that whether to keep or close an account is the bank's own decision, made under its own standards (FFIEC, SAR filing on continuing activity). Keeping exit decisions apart from rating decisions stops one from being used to avoid the other. To see the whole chain on your own customers, start from Customer Risk Rating, or read what good customer risk assessment software shows you.

Questions people ask

Who can change a customer risk rating?

Whoever the bank's procedures authorize. The FFIEC manual says the procedures "should indicate who in the organization is authorized to change a customer's risk profile," and should set responsibility for reviewing and approving changes. Most programs let analysts propose, require a second, more senior signature for moves into the highest tier and for overrides, and reserve exceptions to the BSA Officer.

Can a risk rating be lowered while an alert is open?

No rule forbids it outright, but it is the override most likely to be questioned, because it lowers monitoring while the bank is investigating. Many programs hold such downgrades until the alert or case closes. In the sample credit union's method, rule H-1 holds them automatically and only the BSA Officer can override the hold.

What reason codes should a risk rating override use?

A short list that separates the reasons a bank needs to count: open activity, a rating resting on customer type alone, stale or wrong data, activity the customer has documented, disagreement with a factor weight, a duplicate or linked customer, and other with a mandatory note. The weight-disagreement code is the one to route to the method's owner, because it signals a method problem rather than a customer one.

How often should risk rating overrides be reviewed?

There is no regulatory frequency. A monthly look at override rates by reason, factor and analyst catches drift early, and the method should be revisited whenever one factor attracts a cluster of overrides. Model risk should see overrides of any policy hold individually.

Does an override need a second signature?

The FFIEC manual speaks of "reviewing and approving changes to a customer's risk profile," which implies a reviewer distinct from the person proposing. A second signature from someone senior who did not prepare the change is the plainest way to show that, and it is what protects individual decisions from criticism when the process is followed.

Is closing an account a risk rating override?

No. Exiting a relationship is a separate decision that the FFIEC manual leaves to the bank's own standards. Keeping it apart from the rating stops a bank from closing accounts instead of rating them, or lowering a rating to keep a profitable account.