Risk Rating

The foundational layer that aggregates static and semi-static attributes to establish a baseline risk profile before transactional behavior is considered.

• Geographic Risk: Incorporates FATF high-risk jurisdictions, tax haven classifications, and conflict zone proximity.
• Entity Type Risk: Assigns weight based on legal structure complexity—shell corporations, trusts, and bearer share companies receive elevated scores.
• Product/Service Risk: Scores the inherent anonymity or value-transfer speed of products like private banking, cross-border wires, and virtual asset services.
• PEP & Sanctions Status: Automatically elevates risk for politically exposed persons, their close associates, and sanctioned entities.

Example: A newly onboarded offshore holding company domiciled in a jurisdiction with weak beneficial ownership transparency receives a high inherent risk score before a single transaction occurs.

A real-time computation layer that continuously adjusts the risk score based on observed transactional activity and deviations from expected behavior.

• Velocity Checks: Monitors the frequency and volume of transactions within sliding time windows to detect sudden spikes indicative of structuring or layering.
• Peer Group Deviation: Compares an entity's activity against a statistically similar cohort; a small import/export business transacting millions triggers an anomaly flag.
• Pattern-of-Life Analysis: Establishes a temporal baseline—transactions occurring at unusual hours or on atypical days receive higher anomaly scores.
• Counterparty Risk Propagation: If a customer transacts with a high-risk entity, a portion of that risk propagates to the customer's own score.

Example: A retail customer with a stable 2-year history of domestic payroll deposits suddenly receives five international wire transfers totaling $200,000 over three days, causing their behavioral score to spike.

The mathematical framework that combines disparate risk signals into a single, interpretable composite score, typically ranging from 1 (low) to 100 (critical).

• Additive vs. Multiplicative Logic: Simple models sum weighted factors; sophisticated models use multiplicative logic where two moderate risks combine to create a severe risk.
• Decay Functions: Applies time-based decay to older adverse events so that stale negative news does not permanently penalize a customer.
• Override Flags: Allows human analysts to apply manual overrides that supersede the calculated score, with full audit trail capture.
• Confidence Scoring: Attaches a confidence metric to the composite score, reflecting the completeness and recency of the underlying data.

Example: A customer with medium geographic risk (weight 0.3) and high product risk (weight 0.4) receives a composite score of 78/100 under a multiplicative model, triggering Enhanced Due Diligence.

The business rules engine that maps composite risk scores to discrete risk tiers, each with a prescribed set of due diligence requirements and monitoring cadences.

• Tier Thresholds: Defines score boundaries—e.g., Low (1-30), Medium (31-60), High (61-85), Prohibited (86-100).
• Due Diligence Mapping: Low tier triggers Simplified Due Diligence (SDD); Medium triggers Standard CDD; High triggers Enhanced Due Diligence (EDD) with source of wealth verification.
• Review Cadence Assignment: Low-risk customers reviewed every 3 years; medium-risk annually; high-risk every 6 months or upon trigger events.
• Dynamic Re-tiering: Automatically promotes or demotes customers between tiers as their composite score crosses thresholds.

Example: A corporate client's score drops from 72 (High) to 58 (Medium) after a 12-month period of clean transactional behavior, automatically reducing their review frequency from semi-annual to annual.

The continuous intelligence feed that scans unstructured external data sources and correlates findings to internal customer profiles, feeding directly into the risk score.

• Natural Language Processing (NLP): Parses global news, sanctions lists, and law enforcement bulletins in multiple languages to extract entities and risk-relevant events.
• Fuzzy Name Matching: Employs phonetic algorithms (Soundex, Double Metaphone) and edit-distance calculations to match adverse media entries to customer records despite transliteration differences.
• Sentiment & Severity Classification: Classifies matched articles by severity—negative news about regulatory fines carries more weight than general reputational criticism.
• Network Expansion: If adverse media identifies a beneficial owner or close associate, the risk propagates to all linked accounts within the entity's network.

Example: A fuzzy match links a newly published corruption indictment against a foreign official to a private investment account held under a slightly different transliteration, instantly elevating the account's risk tier to High.

The compliance wrapper that ensures every risk score decision is explainable, reproducible, and defensible to regulators during examinations.

• Factor-Level Explainability: For any composite score, the system must decompose and display the contribution of each individual risk factor (e.g., 'Geographic Risk contributed 22 points').
• Immutable Audit Log: Records every score change, the triggering event, the timestamp, and the responsible system or analyst, creating a complete lineage for regulatory review.
• Threshold Justification: Documents the statistical rationale and business logic behind tier boundary definitions, linking them to the institution's stated risk appetite.
• Backtesting & Validation: Periodically re-runs historical data through the model to ensure tier distributions remain stable and that the model continues to discriminate effectively between low and high-risk entities.

Example: During a regulatory exam, the compliance team produces an audit report showing that Customer X was escalated from Medium to High risk on March 15th due to a 42-point contribution from a newly detected PEP association.