How are ML/TF risks rated and weighted?

Risk factors are not scored one by one and then forgotten. The firm looks at all the factors it has identified for a business relationship or occasional transaction and decides, taken together, what level of risk they add up to. A wealthy customer from a low-risk country buying a simple product through a regulated bank presents a different picture from the same customer using nominee companies and asking for secrecy.

As part of that judgement a firm may give some factors more weight than others, depending on the product, the customer and the relationship. The weighting is a matter of informed judgement, not a fixed formula.

Firms choose how to categorise risk according to the nature and size of their business, but the usual scheme has three levels: high, medium (or normal) and low. CySEC-supervised firms must set criteria for putting customers into low, normal and high-risk categories in their customer acceptance policy, and keep lists of customers in each category up to date.

Low risk reflects situations with potentially lower risk related to the customer, geography, product, service, transaction or delivery channel. Where the law allows, and only once the lower risk has been established and there is no suspicion of money laundering or terrorist financing, the firm may apply simplified due diligence, adjusting the amount, timing or type of CDD measures to the low risk. It is never an exemption from CDD, and ongoing monitoring continues.

Medium or normal risk is the expected level, where the standard rules apply. The firm applies all the CDD measures in the law but may set their extent on a risk-sensitive basis, and it must be able to show its supervisor that what it did was proportionate to the risk.

High risk requires more stringent controls to bring the risk down to an acceptable level: enhanced due diligence and more rigorous transaction monitoring. Enhanced measures are added to standard CDD; they never replace it. A high rating does not mean automatic rejection or an automatic report to MOKAS.

Whatever a firm's own model says, the law requires enhanced due diligence in certain situations. Two appear most often: a customer or beneficial owner who is a politically exposed person, or a family member or known close associate of one, and business relationships or transactions involving a high-risk third country. Cross-border correspondent relationships involving payments are another. Firms may also classify any other customer as high risk on the basis of their own assessment.

A high-risk third country is one on the European Commission's list or one the firm itself rates as high risk in its own assessment. A link to any other non-EU country does not on its own make a customer high risk. The enhanced measures for these countries include more information on the customer, the beneficial owner, the intended relationship and the purpose of transactions, the source of funds and wealth, senior management approval and closer monitoring. There is one narrow exception: a branch or majority-owned subsidiary of an EU firm located in such a country, which fully applies the group's policies, is assessed on a risk-sensitive basis rather than automatically.

Weighting must be an informed judgement about how relevant each factor is to the relationship. The EBA guidelines add safeguards: the rating must not be unduly driven by a single factor, revenue or profit must play no part in it, and the method must always leave room for a relationship to be rated high risk. A model that can only ever produce low and medium scores is defective, and cases the law treats as always high risk cannot be weighted down.