A customer risk scoring model is transparent when each score can be broken down to determine which factors were considered, with what weighting, based on which data, and on what date. It is auditable if this breakdown, successive versions of the model, and analysts’ decisions are retained and available for review. In AML-CFT, this score is used to classify customers and adjust the level of vigilance.
A risk score serves two purposes: to classify a customer and to justify that classification. The first is based on the calculation. The second is established right from the design phase: if no one can explain why a customer is classified as high risk, the score is worthless to an auditor.
What is the purpose of customer risk scoring in e- AML-CFT ?
The scoring system assigns each customer a institution’s risk classification and determines the level of vigilance required. It translates the identified risk factors—including the customer’s profile, products purchased, transaction terms, channels used, and geographic areas involved—into a numerical score.
Article L. 561-4-1 of the Monetary and Financial Coderequires regulated professionals to classify their business relationships according to the level of risk they pose. The law does not mandate the use of an automated system: for a small portfolio, an individual review may suffice. For a large portfolio, an automated calculation ensures uniform application of the rules and maintains a record of each decision.
The score determines the level of vigilance: simplified, standard, or enhanced. This level determines the frequency of inspections, the documents to be collected, and the checks to be performed.
Which risk factors should be included in the score?
The five categories of factors correspond to those in the ACPR guidelines regarding customer identification and due diligence.
| Family of factors | Examples of criteria | Data source | What You Need to Be Able to Prove |
| Client Characteristics | Status as a politically exposed person, ownership structure, business activity | Customer Information File, Screening Results | The date and source of each piece of information used |
| Products and Services | Nature of the product purchased, option for anonymity or payment by a third party | Institution Product Catalog | The risk level assigned to each product in the classification |
| Terms and Conditions | Amounts, frequency, use of cash, complexity of arrangements | Transaction History | The relationship between the observed operation and the grade |
| Distribution Channels | Establishing a relationship remotely, using an intermediary | Path to Building Relationships | Measures to Mitigate the Risk Associated with the Canal |
| Country or territory of origin or destination of the funds | Countries included on the authorities’ lists; geographic distribution of the activity | Official lists kept up to date | The version of the list used at the time of the calculation |
The geographic factor is based on the lists of high-risk countries published by the Financial Action Task Force (FATF) and the European Commission. Nationality alone is never sufficient: it must be cross-referenced with the origin of the funds and the location of the business.
Customer characteristics include politically exposed person (PEP) status (PEP), the ownership structure of a legal entity, the identification of the beneficial owner, and the nature of the reported business activity. Products and services, on the other hand, have an intrinsic level of risk, as defined in your classification. A product that allows payments by a third party poses a higher risk than a checking account with a monthly statement.
How should the factors be weighted and the thresholds set?
Weighting, priority rules, and threshold calibration determine how well the score reflects the institution’s actual exposure.
Weights: A decision made by the school, supported by documentation
The regulations do not specify any weightings. Your institution determines the weight of each factor based on its risk classification. If your business exposes you to a greater degree of geographic risk than product risk, the geographic factor will carry greater weight.
A hypothetical example of weighting includes:
- customer profile: 30%;
- product: 20%;
- operations: 25%;
- channel: 10%;
- Geography: 15%.
These proportions are relevant only if they reflect your actual exposure. Any weighting that is copied without regard to your risk mapping will be called into question during an audit.
Priority Rules
Certain cases involve a high level of risk, regardless of the calculated score. The Monetary and Financial Code requires heightened vigilance in several situations, particularly in dealings with politically exposed persons and in transactions involving high-risk third countries.
These priority rules are set before the calculation is performed. If they are triggered, they override the score obtained and enforce the higher level.
Test the thresholds on the existing portfolio
Once the weights have been set, test the thresholds on a representative sample by following these steps:
- Apply the template to a few hundred existing files;
- Examine the resulting distribution;
- Check to see if it matches your understanding of the portfolio.
If 90% of customers are classified as high risk, even though you believe the majority fall into the standard-risk category, the thresholds are miscalibrated.
What is an explainable score?
A score is understandable when three parties receive an appropriate explanation: the analyst, who needs to understand why a client received that score; the internal auditor, who verifies the consistency of the system; and the external auditor, who verifies the compliance of your procedures.
The analyst must be able to review the breakdown of the rating to identify the factors that contributed to the result, their weightings, and the data used. The auditor expects a description of the model, the tests conducted prior to its implementation, and the results obtained. The controller verifies that the model correctly applies your risk classification.
The ACPR discussion paper (2020) on the governance of artificial intelligence algorithms in the financial sector emphasizesexplainability. An automated rating system must allow users to trace the path from the input data to the resulting rating.
TheAuditability of AI systems in compliance is the subject of a dedicated guide.
How can we make the score auditable?
| Preserved element | Contents | A question to which he answers |
| Input Data | The information used, along with its date and source | What is the basis for the rating? |
| Template Version | The factors, weights, and thresholds in effect on the date of the calculation | What criteria were used to calculate the score? |
| Breakdown of the Grade | Each factor's contribution to the score | Why does this customer have this rating? |
| Priority rules triggered | Cases that involve a certain level of risk, regardless of the calculation | Is the ranking based on the score or on a rule? |
| Statement by an analyst | Any note that has been handwritten, along with its author and the reason for the change | Who decided that, and why? |
| History | The client's successive notes and the event that prompted each change | How has the risk changed? |
AP Scoringsaves each version of the model, tracks successive scores over time, and provides a factor-by-factor breakdown. The solution applies more than 90 configuration criteria and allows you to reconstruct, at any time, a customer’s score as it was calculated on a given date.
Two points deserve special attention: version control for the model and the traceability of manual changes. If you revise your classification and modify the weights, the new version must not overwrite the old one. When an analyst manually modifies a score that was calculated automatically, this change must be logged along with the analyst’s name, the date, and the reason for the change.
When should you recalculate the score and revise the model?
It is important to distinguish between recalculating a client’s rating and revising the model itself. A client’s score must be recalculated whenever their situation changes: a change in shareholders, a new reported business activity, a transaction inconsistent with their profile, or an update to a sanctions list. A score that is fixed as of the date the client relationship begins no longer reflects the actual risk once the account activity contradicts the client’s statements.
The model must be revised whenever your risk classification changes—such as when a new product is launched, when the threats identified by the authorities evolve, or when new typologies are published by the FATF or Tracfin. This revision triggers a recalculation of the entire portfolio. There is no mandated frequency for these revisions; it must be established in your internal procedures.
What should you show your supervisory authority regarding your scoring?
During an audit AML-CFT, your auditor expects to see the following documents:
- an up-to-date risk classification that explains the factors selected and their weightings;
- a description of the scoring model, including its successive versions;
- the tests conducted prior to going live;
- examples of itemized scores, showing how each factor contributed to the total score;
- the log of manual changes, including the reasons;
- the results of the internal audit on the implementation of the model.
To prepare for an audit, learn how the audits AML-CFT.
The most effective approach is to select a few files at random and verify that, for each one, you can explain the score by tracing it back to the input data and the rules that were applied. If you are unable to do this for even one file, your audit trail is incomplete.
FAQ
What is the difference between customer risk scoring and risk classification?
Risk classification is the framework established by the institution. It assesses the risk associated with its activities, products, distribution channels, customer segments, and the countries involved. The scoring process applies this framework to each customer and generates a score. The former is reviewed when the business changes, while the latter is recalculated when the customer’s situation changes.
Is automated customer risk scoring required under the " AML-CFT "?
No. The regulations require risk classification and due diligence tailored to the profile of each business relationship; they do not mandate the use of an automated tool. However, for a large portfolio, an automated calculation remains the most reliable way to apply the same rules to all customers and maintain a record of them, provided that each rating remains justifiable.
Can an analyst modify a score that was calculated automatically?
Yes, and such intervention is advisable when the user has information that the model lacks. The modification must include a record specifying the author, the date, the reason, and the score before and after the correction. A large number of modifications involving the same factor indicates that the weighting needs to be reviewed.
Does the EU AI Regulation apply to “ AML-CFT ” scoring?
The answer depends on the technique used and the purpose of the score; it should be determined in consultation with your legal department. In any case, the expectations are the same: document the model, be able to explain each score, and maintain human control over the decision.
Should a customer's score take their transactions into account?
Yes, whenever the observed transactions differ from what the customer reported. The rating assigned at the start of the relationship is based on self-reported information, while the account’s activity either confirms or contradicts that information. A rating that never changes no longer reflects the actual risk.
