Customer Risk

Overview

Customer risk evaluates how a particular customer relationship may expose an organization to fraud, money laundering, sanctions, credit loss, disputes, security abuse, regulatory breach, or reputational harm. Relevant factors depend on the service and legal framework.

Indicators may include business type, ownership, geography, delivery channel, source of funds, expected activity, transaction patterns, adverse information, and use of intermediaries. A single characteristic should not automatically determine risk without context and reliable evidence.

Organizations should assess risk at onboarding and update it when behavior, ownership, products, or external information changes. Decisions need documented methodology, quality data, review, and proportional controls so risk management does not become arbitrary or discriminatory.

The financial-crime compliance workflow for Customer Risk should locate where evidence enters, where a rule or judgment is applied, what state changes, and which downstream service relies on the result.

Customer risk is the potential exposure arising from a customer’s identity, activities, behavior, jurisdiction, products, transactions, and relationships. Customer risk is contextual and dynamic, requiring evidence-based assessment, periodic refresh, and controls proportionate to actual exposure.

For Customer Risk, the assessment should evaluate the potential exposure arising from a customer’s identity, activities, behavior, jurisdiction, products, transactions, and relationships. The assessment record should separate observed evidence supporting the potential exposure arising from a customer’s identity, activities, behavior, jurisdiction, products, transactions, and relationships from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in the potential exposure arising from a customer’s identity, activities, behavior, jurisdiction, products, transactions, and relationships have changed enough to require a new rating, treatment, or approval.