Building a Risk Based Approach to CDD

The risk based approach is the organising principle of the AML/CTF regime: focus your effort where the money laundering and terrorism financing risk is highest, and be able to explain why.

Start with two assessments

There are two layers of risk assessment. The firm wide (enterprise) risk assessment evaluates the ML/TF risk across your whole business, the services you offer, the customers you serve, your delivery channels and your geographic footprint. The customer risk assessment then rates each client against the same lens. The firm wide assessment sets your risk appetite and controls; the customer assessment applies them case by case.

The core risk factors

AUSTRAC guidance points to a consistent set of risk factors. A defensible model considers:

• Customer type, individuals, companies, trusts, partnerships; PEP status; complex or opaque ownership structures;
• Designated service / product, which services you provide to the customer and their inherent risk;
• Delivery channel, face to face versus non face to face or intermediated onboarding;
• Geography, countries of residence, citizenship and operation, with weighting for FATF listed and other higher risk jurisdictions; and
• Behaviour, transaction patterns that are unusual or inconsistent with the customer profile.

Turn factors into a rating

Score each factor, apply a weighting that reflects your firm wide assessment, and resolve to a clear outcome, typically Low, Medium or High. The rating is only useful if it is consistent (the same inputs produce the same result) and documented (you can show how you reached it).

Allow overrides, but govern them

Sometimes the model and professional judgement differ. A robust framework allows a rating to be overridden, but requires the reason to be recorded and, for material changes, approved. Undocumented overrides are an audit risk; documented ones demonstrate active risk management.

Re rate over time

Risk is not static. Ratings should be refreshed at a frequency driven by the rating itself (higher risk customers more often) and whenever a trigger event occurs, a change in ownership, a new sanctions or PEP match, adverse media, or a shift in transaction behaviour.