Introduction
The customer risk rating is one of the quieter controls in an Anti-Money Laundering (AML) framework, yet a great deal depends on it. The rating decides how much due diligence a customer receives, whether enhanced measures apply, which monitoring thresholds are used and how often the relationship will be reviewed. When the rating is accurate, the rest of the framework can be proportionate. When it is wrong, every control that relies on it is applied at the wrong level.
Most institutions put considerable effort into rating customers correctly at onboarding, but far less attention is given to whether that rating remains correct several years later. Customers change their business, their ownership and the way they use their accounts, and the institution’s own view of risk changes as country lists and methodologies are updated. If the rating does not move with these changes, it gradually stops describing the customer it is attached to. I refer to this as drift.
In an earlier article on the execution gap in AML, I described a periodic review in which the KYC records held by the compliance function did not match those held in the core banking system, and several customer risk ratings had not been updated despite clear changes in transaction behaviour. As a result, the monitoring system continued to apply outdated thresholds. This article looks more closely at why risk ratings drift, why the drift so rarely shows up in management information, and what institutions can do about it.
Regulatory context
In the UK, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) make clear that customer risk assessment is a continuing obligation. Regulation 28(11) requires ongoing monitoring of a business relationship, including scrutiny of transactions to ensure they are consistent with the firm’s knowledge of the customer, the customer’s business and risk profile, and reviews of existing records to keep due diligence information up to date. Regulation 27(8) requires due diligence to be applied to existing customers at other appropriate times on a risk-based approach and when the firm becomes aware that the circumstances of a customer relevant to its risk assessment have changed. Regulation 27(9) lists matters the firm must take into account, including transactions that are not reasonably consistent with its knowledge of the customer and any change in the purpose or intended nature of the relationship.
The Financial Action Task Force (FATF) takes the same position in Recommendation 10, which requires ongoing due diligence on the business relationship (FATF, 2012–2025), and the Joint Money Laundering Steering Group (JMLSG) guidance sets out how UK firms should apply these due diligence and monitoring requirements in practice (JMLSG, 2023).
The FCA has also found weaknesses in practice. Its 2022 review of financial crime controls at six challenger banks reported that in some banks the customer risk assessment framework was not well developed and lacked sufficient detail, that some banks did not have a customer risk assessment in place at all, and that some relied on transaction monitoring to identify higher-risk customers rather than carrying out adequate due diligence at onboarding (FCA, 2022). In its July 2025 enforcement action against Barclays Bank PLC in relation to Stunt & Co, the FCA found that Barclays had not carried out proper ongoing monitoring and failed to properly consider the money laundering risks associated with the customer, even after receiving information from law enforcement about suspected money laundering through Fowler Oldfield, a business that was paying funds to Stunt & Co (FCA, 2025). The fine of approximately £39.3 million, which formed most of a combined £42 million penalty imposed on two Barclays entities, shows that a failure to revisit a customer’s risk in light of new information is treated as a serious failing in its own right.
How risk ratings drift
The rating is set once and rarely recalculated
In many institutions, the risk rating is calculated by a scoring model at onboarding and then stored as a field on the customer record. Unless something actively triggers a recalculation, the stored rating does not change, even if the information it was based on has become outdated. A company onboarded as a domestic wholesaler may later trade internationally, change its directors and multiply its volumes, while its record continues to show the rating it received on its first day.
The rating decides when it will next be checked
The most significant cause of drift, in my view, is a circularity built into many review frameworks. Periodic review frequency is set by the risk rating, so a high-risk customer may be reviewed annually while a low-risk customer may not be reviewed for three or five years. Any customer whose rating is understated will therefore be reviewed less often than its true risk warrants, so the framework itself postpones the opportunity to correct the error.
Periodic reviews that carry forward rather than reassess
When a review does take place, it is often treated as a refresh of documents. From what I have observed, the risk assessment section of a review is frequently completed by carrying forward the previous answers, particularly where reviews are managed against volume targets. The review is then recorded as complete, and the rating is confirmed without having been genuinely reassessed.
Trigger events that do not reach the rating
Information about changes in a customer’s circumstances is usually spread across the institution. A relationship manager may record a new business activity in a relationship management system, and a monitoring analyst may close an alert noting that the customer appears to have entered a new market, while a change of ownership may be visible on a public register that nobody is prompted to check. Each of these is a trigger event, yet in many institutions none of them automatically prompts a reassessment of the rating. An analyst who concludes that unusual activity has a legitimate explanation has often learned something new about the customer, but closing the alert does not update the customer’s profile.
Methodology changes that are not applied to existing customers
Drift also comes from the institution’s side. Risk methodologies are updated when countries are added to or removed from the FATF’s published lists of high-risk jurisdictions and jurisdictions under increased monitoring, or when product risk weightings change. New customers are scored under the revised methodology immediately, while existing customers often keep their old rating until their next scheduled review. The customer book can therefore contain customers with identical risk profiles holding different ratings, depending only on when they joined.
Overrides that outlive their reasons
Most scoring models allow the calculated rating to be overridden, which is necessary because no model captures every relevant factor. However, overrides tend to remain in place long after the reason for them has passed and the staff member who approved them has moved on. Where they are not recorded with a review date, they become a permanent and largely invisible adjustment to the risk profile.
Data that changes as it moves between systems
The risk rating frequently sits in more than one system, such as the onboarding platform, the core banking system and the transaction monitoring system. Each time data passes from one system to another, it depends on how the fields are mapped. When a rating, or a risk factor behind it, is mapped incorrectly, defaulted during migration or updated in one system but not the others, the monitoring system may apply thresholds that no longer match the customer file. Such differences are rarely visible to the users of any one system, because each system appears internally consistent. The mismatch I described in my earlier article, between compliance records and the core banking system, was an example of this problem.
An illustrative case
Consider a hypothetical UK company onboarded as a domestic wholesaler of household goods, with two directors, a modest expected turnover and UK-based suppliers and buyers. The scoring model rated it low risk, and it was scheduled for review every five years.
Over the following three years, the company began importing goods from suppliers in higher-risk jurisdictions and selling to buyers overseas, and payments for those sales started to arrive from third parties rather than from the buyers themselves. One of the original directors resigned, and a new controlling shareholder with interests in several other trading companies was registered. Annual turnover through the account also increased more than threefold.
Each of these changes was visible to someone. The relationship manager recorded the new import and export business. The monitoring system generated alerts on the third-party receipts, and the analyst closed them as consistent with the company’s expansion into international trade. Third-party payments of this kind are a recognised trade-based money laundering red flag, but against a low-risk profile they were treated as routine. The change of shareholder was also publicly recorded. However, none of these events was connected to the risk rating, so the customer continued to be monitored against low-risk thresholds. When the five-year review took place, the reviewer refreshed the company’s verification documents and recorded the new shareholder, but the risk assessment questions were completed using the previous answers and the rating was confirmed as low risk. The relationship was only reassessed when the institution received a request from law enforcement concerning one of the company’s overseas counterparties.
Taken on its own, each control appeared to work. The weaknesses lay in a review that confirmed the rating without reassessing it, and in the fact that none of the other controls fed back into the rating.
Why drift is so rarely noticed
From what I have observed, the main reason drift goes unnoticed is that the management information used to oversee customer risk assessment measures activity rather than accuracy. Dashboards typically report the number of customers in each risk category and the proportion of reviews completed on time. Both can look like evidence of good control, yet neither reveals whether the ratings themselves are correct. A distribution of ratings that has barely changed over several years, in a customer book that has clearly changed, may itself be a sign of drift. I made a related argument in an earlier article on measuring compliance effectiveness, and customer risk rating is one of the clearest examples of activity being mistaken for performance.
The ownership of the rating is also often unclear. The first line usually owns the customer relationship and the review process, the second line owns the methodology, and technology teams own the systems in which the rating is stored. Each team can reasonably say that its own part of the process is working, while no single team is responsible for confirming that each rating still reflects the customer’s risk.
Finally, understated risk tends to be quiet. An overstated rating produces visible costs, such as unnecessary enhanced due diligence and customer complaints, and is usually corrected quickly. An understated rating produces no complaints and no additional work, and it is rarely discovered until an external event, such as a law enforcement request or a media report, brings the customer to attention.
Practical measures
Addressing drift does not necessarily require a new risk rating model. It requires institutions to treat the rating as a live assessment rather than a historical record. In practical terms, institutions should consider the following measures:
- Recalculate ratings regularly, not only at review. Where the model allows it, ratings should be recalculated across the whole customer book using current data, with material changes routed for review. This also means that methodology changes reach existing customers as well as new ones.
- Connect trigger events to the rating. A change of ownership or business activity, a significant departure from the activity expected at onboarding, or a closed alert that records new information about the customer should prompt a reassessment.
- Make periodic reviews genuine reassessments. Review templates should require each risk factor to be confirmed against current information, and quality assurance should test whether the confirmed rating was correct, not only whether the review was completed.
- Place a time limit on overrides. Every override should record its rationale, its approver and a date by which it must be revisited, with expired overrides reported to the second line.
- Reconcile the rating across systems. The ratings held in different systems should be reconciled periodically, and data migration plans should include specific checks on risk rating fields.
- Report on accuracy as well as activity. Management information should include indicators of drift, such as the number of ratings changed at review, the number of overrides past their review date and the proportion of customers whose activity departs materially from their profile.
Conclusion
The customer risk rating is set at a single point in time but used every day for the rest of the relationship. Over the years, the customer changes and the institution’s understanding of risk changes, while the rating often stays where it was. Because the rating also decides how often it will be revisited, an understated rating can remain unchallenged for a long time, while the dashboards that oversee the process continue to show a framework working as expected.
The regulatory expectation is clear that customer risk assessment is a continuing obligation. Institutions that recalculate ratings regularly, link trigger events back to the customer’s profile, limit the life of overrides and measure the accuracy of ratings, rather than only the completion of reviews, will be in a much better position to know whether their ratings still describe the customers they hold.
Having seen how a rating that had not moved could quietly weaken the monitoring built on top of it, I have come to regard the customer risk rating as one of the controls that most deserves to be tested over time, not only at the point it is first assigned.
References
Financial Action Task Force (FATF) (2012–2025) International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation: The FATF Recommendations. Paris: FATF.
Financial Conduct Authority (FCA) (2022) Financial Crime Controls at Challenger Banks. London: FCA.
Financial Conduct Authority (FCA) (2025) FCA Fines Barclays £42 Million for Poor Handling of Financial Crime Risks. Press release, 16 July. London: FCA.
Joint Money Laundering Steering Group (JMLSG) (2023) Prevention of Money Laundering/Combating Terrorist Financing: Guidance for the UK Financial Sector, Part I. London: JMLSG.
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692). London: The Stationery Office.
Leave a Reply