Ref CP-024 · Joshua M. · Reading time 9 minutes

Customer risk rating methodology: what to do when too many customers land in the middle

When a customer risk model puts most of the book in one band, the label may be hiding more than it explains. I would first check whether the inputs distinguish the firm’s actual exposures, whether missing information quietly becomes a neutral score, and whether the result changes a decision. The useful question is not whether the spreadsheet produces a number. It is whether the method helps the firm understand and manage customer risk.

Start with the decision the rating supports

Before reviewing a formula, write down what the rating is meant to do. Does it set the depth of due diligence, determine review frequency, route a relationship for approval, or help allocate investigation capacity? A score that has no defined decision attached to it can look precise while changing nothing.

Then define the unit being rated. A customer-level assessment is not the same as a business-wide assessment, a product-risk review or an individual transaction decision. Those views may inform one another, but putting them into a single field makes it hard to see what the rating actually represents. I want an analyst to be able to explain the customer’s relevant exposure in plain language before relying on a band.

There is no single factor list or scoring formula that fits every institution. The FFIEC BSA/AML examination manual describes a risk profile shaped by a bank’s customers, products and services, and geographic locations. It also recognises that banks may weight factors differently and that no single indicator determines a customer’s risk. That is U.S. bank examination guidance; firms elsewhere should use the requirements and supervisory guidance that apply to their own jurisdiction and business.

Choose factors that describe your exposure

A factor belongs in the model because it helps explain exposure in your business, not because it appears in a vendor template. Depending on the firm, relevant dimensions may include customer type and ownership, products used, delivery channel, geographic connections, expected activity and the nature or scale of actual activity. The important step is to connect each factor to a documented risk rationale and to data the firm can collect with reasonable quality.

I review each input with a few questions: What exposure does it represent? Where does the value come from? How often is it refreshed? What does an unknown value mean? Could two customers with different risk profiles receive the same value for reasons unrelated to risk? If the team cannot answer those questions, adding more fields will not make the output more informative.

Missing data deserves its own treatment. A blank field mapped to zero, or silently treated as the lowest category, can make an incomplete record look safer than a complete one. But automatically assigning every unknown the highest score can create noise and unfair outcomes too. State what the system does, identify which data gaps matter, and give staff a route to resolve or explain them.

Do not blur inherent exposure and controls

Inherent risk describes exposure before the effect of controls is considered. Residual risk describes what remains after relevant controls are taken into account. Customer ratings do not always use these labels in the same way, so explain the method the firm has chosen rather than borrowing terminology without defining it.

One common design problem is to combine exposure factors and control claims into one total. A customer’s cross-border activity might add points while a screening control subtracts them. The final number then hides two separate questions: what risk is present, and how well does the institution manage it? If controls affect the customer’s rating, identify the evidence used to give them credit and show how failed or overdue testing changes that treatment.

In its UK supervisory review, the FCA describes stronger risk-assessment approaches as considering inherent risk, control effectiveness and residual risk, with governance and testing around the process. That is UK supervisory material and should be read in its context. The UK handbook’s financial-crime guidance also expects systems and controls to be proportionate to a firm’s nature, scale and complexity; it does not prescribe one universal customer scorecard. See the FCA review of firms’ risk-assessment processes and FCG 3.

Investigate a crowded middle band

A large middle category does not prove the model is broken. It is a signal to examine the distribution and the decisions made from it. Start by looking at the full population and then segment it by dimensions that matter to the firm: product, channel, customer type, geography or onboarding route. A single aggregate chart can conceal a high-risk cluster inside a much larger group.

• Check the band definitions. Are cut-offs documented and tied to decisions, or were they chosen simply to produce a convenient distribution?
• Inspect the inputs. Look for missing values, default scores, stale records, duplicated fields and factors that nearly every customer shares.
• Understand each factor’s contribution. If the model is weighted, confirm that the weights produce the differences the method says they represent. Do not treat a mathematically neat total as evidence that the weighting is sound.
• Compare with internal evidence. Review where investigations, due-diligence escalations, control findings and confirmed outcomes arise. These are imperfect signals, not ground truth: monitoring coverage and analyst decisions shape what gets recorded.
• Test the practical consequence. Do customers in different bands receive meaningfully different review, due diligence or approval steps? If not, the model may be adding administration without helping staff act.

Do not tune the model only to make the chart look more varied. A more even spread is not automatically a more accurate spread. The purpose of testing is to find out whether the method separates exposures that matter, where it does not, and what the institution should change or investigate further.

Make overrides visible and reviewable

Staff sometimes need to change a system rating because they know something the model does not. That can be sound judgement. An override without a reason, supporting evidence and accountable approval is much harder to defend.

Record the original output, the final rating, the direction of the change, the reason, the evidence considered, the decision-maker and any required approval. Then review override patterns. Are changes concentrated in one team, product or customer segment? Do analysts repeatedly correct the same input? Is a particular override direction becoming routine? A repeated manual correction may point to a data or design problem that belongs in the model’s backlog.

Set a review process that fits the firm. It should specify who may override, which changes need escalation, how exceptions are recorded, and how the model owner checks trends. The exact governance depends on the institution, its risk appetite and applicable rules. Avoid inventing a universal approval threshold where none has been established.

Write down what the model cannot tell you

A customer risk rating is a decision aid, not a verdict. It cannot establish that a person or company has committed wrongdoing. It cannot replace a reasoned review of the information available, and a low band does not make contradictory evidence disappear.

Keep a short model record that a new analyst or reviewer can follow: purpose and scope; factor definitions and data sources; treatment of missing or stale information; scoring and band logic; how controls are considered; override rules; testing performed; limitations found; owner and review triggers. If the model changes, record what changed and why. The written explanation is part of the control.

I would rather see a modest method that staff understand and test than a complex score nobody can explain. If the middle band contains very different customers, find out what separates them and whether the difference matters to a decision. If it does, the method should make that visible. If it does not, simplify the model and say what it is for.

Frequently asked questions

What is a customer risk rating methodology?

It is the documented way an institution uses relevant customer and relationship information to assess exposure and support defined decisions. A useful method explains its scope, factors, data, scoring, limitations and governance.

Which factors should a customer risk model include?

There is no universal list. Consider the customer, products and services, delivery channels, geographic connections and expected or actual activity where those dimensions are relevant to your business and supported by reliable data.

Should a customer rating include controls?

Explain whether controls affect the rating and how. Keep the underlying exposure visible, describe what control evidence earns credit, and show how the method handles weak, overdue or failed testing.

Is a medium customer rating proof that the relationship is safe?

No. A band is a decision aid within a defined process. It does not establish that wrongdoing has or has not occurred, and it does not replace review of material evidence or contradictory information.

Sources and jurisdiction notes

• FFIEC BSA/AML Examination Manual, Customer Due Diligence — U.S. bank examination guidance on customer risk profiles and institution-specific factors.
• AUSTRAC: Assigning customer risk ratings — Australian guidance on a method appropriate to the nature, size and complexity of a reporting entity.
• FCA: Risk assessment processes and controls — firms' findings — UK supervisory review of risk assessments, governance and testing.
• FCA Handbook FCG 3 — UK financial-crime systems and controls guidance.

These sources inform the method discussion; they do not establish one scoring formula for every jurisdiction or institution. Firms should check current requirements applicable to their own business.

Bottom line: A useful customer risk rating shows its reasoning, its limits and the decision it supports. A number on its own shows none of those things.