A customer sends their documents, answers your questions, and wants to get started. Everything looks complete. But does the information explain who they are and how they plan to use your service?
That is where a customer risk assessment helps.
You look at the relationship as a whole: the customer, their business, ownership, payments, and any details that need explaining. Having a full document folder is useful. Understanding what those documents tell you matters more.
Below are three fictional examples. Before reading each explanation, choose what you would check next.
What Is a Customer Risk Assessment?
A customer risk assessment examines the money laundering and terrorist financing risks associated with a particular customer relationship.
It helps you decide how much checking and monitoring the relationship needs. The FATF’s risk-based approach supports directing attention and resources towards higher-risk areas. fatf-gafi.org
The examples here illustrate that approach. Actual decisions depend on your sector, applicable rules, and approved assessment method.
Start with these questions:
| Question | What you want to understand |
| Who is the customer? | Their identity and business activity |
| Who owns or controls the business? | The people behind the company |
| Why do they need your service? | The purpose of the relationship |
| What activity do they expect? | Payment amounts, frequency, and methods |
| Which countries are involved? | Relevant business and payment connections |
| What needs explaining? | Missing, inconsistent, or unusual details |
Example 1: A Local Business with Clear Information
A small office-supply company approaches your firm for accounting services. It has traded for several years and serves local businesses.
The owner provides identification, registration documents, and information about the company’s activities. Available records support the explanation. Payments will come from an account in the company’s name.
Nothing presented so far contradicts the stated purpose of the relationship.
Your Turn: What Would You Do?
A. Give it a low-risk rating because it is local.
B. Complete the relevant checks and assess the information together.
C. Request every document you can think of.
The best starting point is B.
A local address does not settle the assessment. You still need to understand the customer and complete the checks relevant to your business.
Here, the clear ownership, understandable activity, and consistent information may support a lower-risk conclusion under your assessment method. That conclusion should follow the evidence.
Asking for unrelated paperwork can create delays without answering a useful question.
What would you record?
Explain why the business activity makes sense, how ownership was checked, and what activity you expect. A bare “low risk” label leaves the next reviewer guessing.
What could change your view?
The company later starts receiving frequent payments from unrelated overseas businesses. That new activity deserves a closer look, even if the original assessment was reasonable.
Example 2: A Property Buyer with Unclear Ownership
A company wants to buy a commercial property. Its representative supplies registration documents and says the purchase is an investment.
The company is owned by another company, which is owned by a third. The representative cannot clearly identify the people who ultimately own or control the buyer.
They also ask to pay part of the purchase price through an unrelated business.
Your Turn: What Needs Attention First?
A. The value of the property alone.
B. The ownership chain and the proposed payer.
C. How quickly the customer wants to complete.
B gives you the most useful starting point.
The ownership chain and payment arrangement raise questions that the documents have not answered.
Several ownership layers do not prove wrongdoing. Neither does a proposed third-party payment. But you need to understand why those arrangements exist and whether the explanation is supported.
Beneficial ownership means identifying the individuals who ultimately own or control the customer, rather than stopping at another company’s name. fatf-gafi.org
Useful follow-up questions include:
- Who ultimately owns or controls the purchasing company?
- What is the relationship between the buyer and the proposed payer?
- Why is that business making the payment?
- What evidence supports the explanation of the purchase funds?
If the customer gives conflicting answers or cannot provide necessary information, follow your escalation process. Do not treat an unresolved ownership gap as a completed check.
What would you record?
Keep the ownership information, payment explanation, supporting evidence, and unresolved questions together. Explain how they affect the assessment and the next decision.
Example 3: A Familiar Customer Changes Their Payment Pattern
You have worked with a trading company for two years. Its usual activity involves moderate payments connected with domestic suppliers.
Recently, larger payments have started arriving from several overseas companies. Some money moves out shortly afterwards.
The customer says the business has expanded, but the information on file still describes its earlier operations.
Your Turn: What Would You Do Next?
A. Keep the original rating because the customer is familiar.
B. Treat the change as proof of money laundering.
C. Compare the activity with the explanation and request supporting information.
C is the sensible next step.
Business expansion may explain the change. You need enough information to judge whether it does.
Ask about the new trading relationships, payment routes, and expected volumes. Where relevant, examine contracts, invoices, or other records supporting the activity.
Then compare that evidence with what you can observe.
Does the explanation account for the payment amounts? Do the counterparties fit the stated business? Are there contradictions that remain unresolved?
A customer relationship can change after onboarding. Your assessment needs to reflect relevant new information.
What would you record?
Describe the changed activity, what you checked, and whether the findings support revising the rating or monitoring. Escalate unresolved concerns through the appropriate process.
Compare the Three Examples
| Example | Main question | Practical next step |
| Office-supply company | Does the information support the stated activity? | Complete relevant checks and document the assessment |
| Property buyer | Who controls the company, and why is another business paying? | Clarify ownership and payment arrangements |
| Existing trading customer | Does the new activity fit the business explanation? | Review supporting evidence and update the customer information |
The outcome is not always “raise the rating.” Sometimes the evidence supports the current rating. Sometimes more checking is needed before you can reach a conclusion.
Before You Finalise the Assessment
Read your notes as though someone else wrote them. Can you understand the decision without asking the reviewer what they meant?
Check that the record explains:
- What you know about the customer.
- Which information supports that understanding.
- What remains unanswered.
- Why the chosen rating makes sense.
- What checking or monitoring follows.
A score can help organise the assessment. It cannot explain a missing fact or resolve a contradiction.
Make Your Next Customer Review Easier
Choose one recent customer file and compare it with these examples. Is the relationship clear? Does expected activity match what is happening? Could another reviewer follow your reasoning?
If the answer is no, start with the missing explanation.
Discuss your customer risk assessment process with us to know more about where your team needs support.
Frequently Asked Questions
1. Can a small business be high risk?
Yes. Size tells you little about who controls a business or how its payments work. Look at the relationship and evidence before deciding.
2. Does a high-risk rating mean the customer is breaking the law?
No. A rating indicates the level of risk and checking needed. It is not a finding that a crime has occurred.
3. What if the customer will not explain a payment?
Record the unanswered question and escalate it through your process. Do not invent a reason or mark the issue resolved.
4. Should we reassess an existing customer?
Review relevant changes and follow your required schedule. Familiarity does not explain new activity.
5. Can we use the same questionnaire for everyone?
A shared starting form can help. Follow-up questions should reflect the customer’s circumstances and the information you still need.
