Asset managers and investment firms
The investor’s structure
“Chains of vehicles and beneficial owners in several jurisdictions: the customer factor weighs more than any other.”
Customer Risk Profile and AML Risk Scoring
Risk scoring is what decides which due diligence applies to each customer. If it is not built properly, everything that follows—measures, monitoring, alerts—is miscalibrated from day one.
Does your risk scoring hold up? Free assessment
Tell us how you classify your customers today and we will tell you whether your approach is defensible.
- 50+ entities advised
- Reply within 24 h
- No commitment
- Minimum fine, very serious infringement
- €150,000
- Key legislation
- Law 10/2010
- Implementing regulation
- Royal Decree 304/2014
Services
What we do for you in risk classification
Scoring is where your risk assessment turns into specific decisions about specific customers.
Model
Scoring model design
We build the classification model from your risk assessment: factors, weightings, cut-off thresholds and override rules, with documentation that lets you explain why a given customer ended up where they did.
Learn more →
FactorsWeightingThresholds
Procedure
Reclassification rules
When a customer moves up a level, when they move down, who authorizes it and what evidence is required. Downgrades are what is most often done badly and most often reviewed in inspections.
Learn more →
ReclassificationAuthorization
EDD
Measures by risk level
Which specific measures are triggered at each level, with no ambiguity.
Learn more →
EDDEscalation
PEP
PEPs and close associates
How politically exposed person status feeds into the model.
Learn more →
PEPClose associates
Countries
Geographic factor and lists
How to build in the FATF and EU lists without the model going out of date.
Learn more →
FATFThird countries
Validation
Model validation
Review of how your customer base is distributed and of consistency between the level assigned and the measures applied.
Learn more →
DistributionBacktesting
Concept
What a customer risk profile is
The classification on which every later measure depends.
The customer risk profile is the classification that assigns each business relationship a level—usually low, medium or high—which determines the applicable due diligence measures, the intensity of monitoring and the alert thresholds. It is the practical expression of the risk-based approach that underpins the whole of Law 10/2010 and Royal Decree 304/2014.
Put another way: scoring is the switch. It determines whether you apply simplified due diligence, standard due diligence or enhanced measures; how often you review the file; and which transaction patterns should stand out as unusual. A miscalibrated model does not produce a one-off error. It produces a systematic error, repeated across your entire customer base.
It is also the part that is hardest to improvise during an inspection. When a supervisor asks why a specific customer is rated low risk, the acceptable answer is not a professional judgment given verbally. It is a documented model, with factors, weights and thresholds, that produces that result when applied to that customer.
Factors
The factors to weigh
Six blocks. The quality of the model depends on none of them being left out and on the weights being justified.
| Block | Typical factors | High-risk signals | Common trap |
|---|---|---|---|
| Customer | Type of person, business activity, track record, corporate structure, beneficial owner | Layered structures, shell companies, beneficial owner hard to identify | Scoring the legal form and overlooking the real complexity of the chain of control. |
| Person | Politically exposed person status, close associates, screening results | PEP, close associate or family member, match on sanctions lists or adverse media | Treating a PEP’s close associate as an ordinary customer because the name does not appear on the list. |
| Geography | Country of residence, nationality, incorporation, transactions and funds | High-risk jurisdictions, listed third countries, territories lacking tax transparency | Looking only at the country of domicile, not at the real country of origin or destination of the funds. |
| Product and service | Nature of the product, complexity, ability to transfer value, anonymity | Products that allow funds to be moved quickly or with limited traceability | Not reviewing the model when a new product is launched. |
| Channel | Face-to-face, non-face-to-face, through an agent, intermediated by a third party | Non-face-to-face onboarding without enhanced verification, opaque intermediation | Scoring onboarding with video identification the same as onboarding with documents sent by email. |
| Transactions | Expected volume, type of counterparty, use of cash, declared pattern | Mismatch between declared and actual activity, heavy use of cash | Setting the transaction profile at onboarding and never comparing it with reality again. |
No factor decides on its own, except override factors (sanctions, confirmed suspicion). These place the customer in high risk regardless of the rest of the score.
Consequences
From risk level to measures
Classifying is pointless if the classification does not change what you do next.
| Item | Low risk | Medium risk | High risk |
|---|---|---|---|
| Due diligence regime | Simplified, if the case qualifies | Standard | Enhanced (EDD) |
| Beneficial owner verification | General procedure | Reasonable and documented | Full documentary verification of the chain |
| Source of funds | Not generally required | Depending on red flags | Required and documented |
| Review frequency | Less frequent, defined in writing | Periodic | Frequent, with review by a designated officer |
| Alert thresholds | Standard | Adjusted to the profile | Sensitive, with lower tolerance |
| Onboarding approval | Business as usual | Business as usual | Designated officer or senior management |
| Termination on risk grounds | Exceptional | To be assessed | Documented decision required |
Consistency between the level assigned and the measures actually applied is the first thing checked in a file review. A customer rated high risk with a low-risk file is an immediate deficiency.
Sectors
Which factor weighs most in each sector
The model cannot be the same for everyone: the relevant factors change with the business activity.
Payment institutions
Channel and speed
“Non-face-to-face onboarding and the ability to move funds in seconds: channel and product dominate the model.”
Real estate
Source of funds
“Large amounts, payment in installments and non-resident buyers: the geographic and transaction factors prevail.”
Crypto
Traceability
“On-chain provenance and exposure to anonymization services require factors that do not exist in other sectors.”
Consequences
What happens if scoring is badly built
It is the control whose failure spreads to all the others.
A miscalibrated scoring model is a systematic error. It does not affect one file: it affects your whole customer base, for as long as the model has been running.
The distribution gives it away. If 95% of your customer base is rated low risk, the supervisor does not need to review files: they already know the model does not discriminate.
And without a documented model, there is no defense. Explaining a classification with professional judgment but no written support is, in practice, the same as having no criteria.
| Severity | Amount | Basis or alternative |
|---|---|---|
| Minor infringements | up to €60,000 | Less significant breaches, or breaches with no appreciable impact on the AML/CFT system. |
| Serious infringements | €60,000 – €5,000,000 | Or 10% of the company’s total resources. |
| Very serious infringements | €150,000 – €10,000,000 | Or 10% of the entity’s own funds. |
How is your customer base distributed across risk levels?
It is the question that opens almost every inspection. We review your model, the actual distribution of your customers and the consistency between the level assigned and the measures applied.
Frequently asked questions
Customer risk profile: common questions
What is a customer risk profile?
It is the classification—usually low, medium or high—that results from applying the entity’s scoring model to the data on that business relationship. The applicable due diligence measures, review frequency and alert thresholds all depend on it.
Is a scoring model mandatory?
The law does not require a specific tool, but it does require a risk-based approach, which means measures must be proportionate to each customer’s risk. In practice, the only way to show that proportionality consistently across a customer base of any size is with a documented model.
How many levels should it have?
Three is standard and usually enough. More levels only add value if each one has genuinely different measures attached. A five-level model in which the three middle levels get the same treatment is a three-level model with longer names.
Can a customer be moved down a risk level?
Yes, but it is the decision that gets the most scrutiny. It must be provided for in your procedure, be based on an objective change in circumstances, be authorized by the right person and be documented with its reason. A downgrade with no audit trail reads as a commercial decision disguised as a risk decision.
What about PEPs?
Politically exposed person status, and that of their family members and close associates, is a high-risk factor that triggers enhanced measures. The most common mistake is not forgetting the PEP but forgetting the close associate, who does not appear on any list and can only be identified by asking. We cover this on our PEP page.
How often should the profile be reviewed?
As often as your procedure sets for each level, and whenever a relevant event occurs: a change of beneficial owner, business activity or jurisdiction, a monitoring alert or the customer appearing on a list. Event-driven review matters more than periodic review, because risk does not change on the anniversary of onboarding.
What customer base distribution is reasonable?
There is no right figure: it depends on your business. What is a warning sign is extreme concentration in the low level. If virtually your entire customer base scores the same, the model is not discriminating, and that can be spotted in a minute without reviewing a single file.
How is the model validated?
By checking three things: that the resulting distribution makes sense for your business; that the level assigned is consistent with the measures actually applied in the file; and that the customers who ended up generating suspicious transaction reports were reasonably classified. That last exercise is the most useful one, and almost nobody does it.
Where does the entity-wide risk assessment fit in?
The entity-wide risk assessment is the level above: it analyzes the risk of your business as a whole—products, channels, countries, customers. Scoring applies it to the individual customer. Scoring that is not derived from the risk assessment is a model without foundation; a risk assessment without scoring is a document without consequences.
Does anything change with the AMLR in 2027?
Regulation (EU) 2024/1624 keeps and strengthens the risk-based approach, with technical rules from the new EU authority on risk factors and how to weigh them. Greater standardization of the minimum required factors is to be expected, so it is advisable for the model to be configurable rather than hard-coded. More on our AMLR page.
Practical guide
Practical guide to risk scoring
A defensible scoring model does not need to be sophisticated. It needs to be written down, derived from the risk assessment and produce different consequences at each level. Ten steps.
Derived from the self-assessment
Factors and their weights must be traceable to the entity-wide risk assessment. Without that thread, the model is just an opinion.
Each level changes something
If a high-risk customer’s file is identical to a low-risk customer’s file, the classification is serving no purpose.
Validate against reality
Cross-check the customers who ended up in a suspicious transaction report against the level they had been assigned. It is the best test of whether the model discriminates.
10-step risk scoring checklist
- Start from the entity-wide risk assessment and identify the factors relevant to your business.
- Define the six factor blocks—customer, person, geography, product, channel and transactions—and their variables.
- Assign weightings and document why each factor carries the weight it does.
- Set the cut-off thresholds between levels and the override rules that place a customer directly in high risk.
- Link each level to a specific, distinct set of due diligence measures and a review frequency.
- Define the reclassification procedure: triggering events, who authorizes and what evidence is required.
- Configure the model in your system so that the classification is calculated and recorded, not decided by hand.
- Document the classification in the file with the factors that determined it, not just the result.
- Analyze the distribution of your customer base by level and justify the breakdown.
- Validate the model every year against real experience: alerts, reports and terminations on risk grounds.
If you want to review your model and its distribution, start with the risk assessment or an AML/CFT audit.
Scoring in operation
From a factor table to a consistent customer file
Risk models fail in four places, and none of them is the mathematical formula.
1) DataThe data must exist and be reliable
A factor without data does not score. If the business activity field is empty for 40% of your customer base, that factor is not working for 40% of your customer base.
- Field coverage
- Data quality
- Updates
2) CalculationThe classification must be calculated
Automatic and recorded. A classification entered by hand by the relationship manager is not a model: it is an opinion dressed up as a field.
- Automatic calculation
- Result recorded
- Factors stored
3) ConsequenceThe level must change the file
The level must trigger different measures automatically, rather than depend on the analyst remembering what applies to each category.
- Measures by level
- Tasks generated
- Adjusted thresholds
4) ReviewIt must be recalculated when something changes
New beneficial owner, change of business activity, monitoring alert, appearing on a list. Risk does not wait for the onboarding anniversary to change.
Tip: define the events that trigger recalculation and automate them. Periodic review has its place; event-driven review is what actually picks up changes.
Quick decisionPractical map: which level applies?
Three common profiles and a reasonable classification for each.
Supervised EU entity
Low risk, unless there are specific red flags. Simplified due diligence if the case qualifies.
Layered, non-resident company
High risk due to structure and geography. EDD and source of funds.
Local individual, simple product
Low or medium risk, depending on declared activity and onboarding channel.
Scoring playbook
The risk profile in practice
Documented model
Factors, weightings, thresholds and override rules in writing.
Model document approved by the internal control body (OCI), with version control.
Traceability to the self-assessment
The factors derive from the entity-wide risk assessment.
Cross-reference between the self-assessment and the model.
Calculation and recording
The classification is calculated automatically and stored with its factors.
Level field and score breakdown in the file.
Consistency of measures
The measures applied match the level assigned.
Sampling of files by level.
Reclassification
Defined events trigger recalculation; downgrades are authorized and documented.
History of level changes, with reason and approver.
Signs that your risk model does not discriminate
Any one of these justifies a full review of your scoring.
- More than 90% of the customer base is at the same risk level.
- The level is entered manually, not calculated.
- There is no history of level changes or of the reasons for them.
- High-risk and low-risk files contain the same documentation.
- The model has not been reviewed since before the last product launch.
Working glossary
Key risk profile concepts
Terms that come up in scoring models, manuals and customer base reviews.
RBABasis
Risk-based approach
Principle that requires measures to be proportionate to the risk identified.
It underpins Law 10/2010 and the AMLR.
IARSource
Entity-wide risk self-assessment
Analysis of the risk of the business as a whole. It is where the scoring factors come from.
See: risk map.
ScoringModel
Risk score
Applying weighted factors to a specific customer to obtain their level.
It must be calculated, not decided.
OverrideRule
Automatic high-risk factor
A circumstance that places the customer in high risk regardless of the rest of the score.
E.g. a match on sanctions lists.
PEPFactor
Politically exposed person
High-risk factor that also extends to family members and close associates.
See: PEP.
Transaction profileActivity
Expected activity
Volume and type of transactions expected at onboarding. A mismatch with reality is an alert.
It must be compared, not just collected.
ReclassificationDynamic
Change of level
Recalculation of the profile, triggered by an event or a periodic review. Downgrades require authorization.
Always document the reason.
DistributionValidation
Breakdown of the customer base
Proportion of customers at each level. Extreme concentration indicates that the model does not discriminate.
The first indicator examined.
AMLR2027
Regulation (EU) 2024/1624
Strengthens the risk-based approach and provides for technical rules on risk factors.
See: AMLR.
COMPLIANCE CONTROL CENTER · SCORING
Risk matrix: customer by geography
Two of the six factors, crossed, to show how the model behaves. In a real implementation, the calculation weighs all six blocks and applies the override rules.
Resulting level matrix
Green: low risk. Amber: medium. Red: high, with enhanced measures.
Customer \ Geography
Spain / EU
Standard third country
High risk
Local individual
LowStandard CDD
Medium+ source of funds
HighEDD
Simple company
LowStandard CDD
Medium+ beneficial owner
HighEDD
Layered structure
Medium+ chain of control
HighEDD
HighEDD + senior management
Obliged entities
Who has to classify customers by risk?
All obliged entities. What changes are the relevant factors and their weight.
General
Obliged entities under Law 10/2010
We design the scoring model based on your specific business and your risk assessment, not on a generic template.
See obliged entities →
Law 10/2010RBA
Fintech
Payment institutions and fintechs
The onboarding channel and the ability to move funds dominate the model. Non-face-to-face onboarding needs its own factor.
See our fintech approach →
ChannelSpeed
Real estate
Real estate agents
Amount, payment method and the buyer’s residence account for almost all the risk in the sector.
See AML for real estate →
AmountSource of funds
Crypto
Crypto-asset service providers
On-chain exposure and anonymization services require factors that do not exist in other sectors.
See crypto AML →
On-chainTraceability
Common mistakes
The six risk scoring failures we see most often
None of them is a calculation error: they are all design or usage errors.
Entire customer base in low risk
It is the quickest finding in any inspection. If the model does not spread customers across levels, it is not doing its job, and you do not need to open a single file to see it.
Classifying by hand
The relationship manager picks the level from a drop-down menu. That is not a model; it is an opinion recorded in a field, and it cannot be reproduced or audited.
Factors without data
The model weighs business activity, but that field is empty for half the customer base. The factor exists on paper but does not work in reality.
The level changes nothing
A high-risk customer with the same file as a low-risk one. The classification is decorative.
Downgrades with no audit trail
A customer moves from high to medium, and there is no record of the reason or of who authorized it. It is the record most often requested and most often missing.
Not validating against experience
Nobody has ever checked which level was assigned to the customers who ended up generating a suspicious transaction report. It is the best test available, and it costs nothing.
Official sources
Where all of the above comes from
Direct links to the consolidated texts and the relevant bodies.
BOE
Law 10/2010 of April 28
Consolidated text. Risk-based approach and due diligence measures.
BOERoyal Decree 304/2014 of May 5
Implementing regulation: risk analysis and proportionate measures.
EUR-LexRegulation (EU) 2024/1624 (AMLR)
Strengthens the risk-based approach and the factors to be considered from July 2027.
SEPBLACExecutive Service of the Commission for the Prevention of Money Laundering
Guidance and communications on risk analysis by sector.
FATFFATF Recommendations
International standard for the risk-based approach, plus sector guidance.
European CommissionList of high-risk third countries
Jurisdictions with strategic deficiencies, for the geographic factor.
Initial publication, with the six factor blocks and validation against real experience.
Planned review: application of the AMLR and EU technical rules on risk factors.
Contact
Book a call
Tell us how you classify your customers today and how your customer base is distributed by level.
Regulatory framework for the customer risk profile in AML/CFT
The customer risk profile is the application, customer by customer, of the risk-based approach that underpins Law 10/2010 of April 28 and Royal Decree 304/2014. The law does not impose a specific tool or scale. It does require due diligence measures to be proportionate to the risk identified, and in practice that means having a documented classification approach that can be applied consistently across your entire customer base.
The six factor blocks
A complete model weighs factors relating to the customer (type, business activity, corporate structure and beneficial owner), the person (politically exposed person status, close associates, screening results), geography (residence, incorporation, origin and destination of funds), the product, the onboarding channel and the expected transactions. Leaving out any of these blocks creates a blind spot that eventually shows up in file reviews.
Distribution as the first indicator
Before reviewing a single file, inspectors usually ask for the distribution of the customer base by risk level. Extreme concentration in the low level indicates that the model does not discriminate, however sophisticated its design. There is no correct breakdown in the abstract—it depends on the business—but there is an obligation to be able to explain why your customer base is distributed the way it is.
Consistency between level and measures
Classifying only makes sense if the classification has consequences. The level assigned must determine the applicable due diligence regime (simplified, standard or enhanced), how thoroughly the beneficial owner is verified, whether proof of the source of funds is required, the review frequency and the sensitivity of monitoring thresholds. A high-risk file that cannot be told apart from a low-risk one shows that the model is not working.
The validation almost nobody does
The most useful way to check whether a model works is to cross-check the customers who ended up generating a suspicious transaction report against the risk level they had been assigned before the report. If most of them were rated low risk, the model does not anticipate. It is a simple validation, needs no additional tools and is first-rate evidence for the supervisor. It is worth building it into the annual internal audit plan.
Due diligence
AML/CFT system
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Royal Decree 304/2014 of May 5 approving the Regulations implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Regulation (EU) 2024/1624 of May 31, 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financingEUR-Lex · Official Journal of the EU
Legislation and links reviewed in .