It can calculate one, but it should not decide one. An AI agent can gather the inputs, apply the firm's approved rating method and propose a rating with reasons. Where the result is high risk, where an override needs judgement, or where the rating drives enhanced checks or an exit, a compliance officer decides and records why.
What is a customer risk rating for?
A customer risk rating summarises how much money laundering or financial crime risk a customer presents, based on factors such as the customer's type, location, products, delivery channels and behaviour. It drives the level of due diligence the firm applies, how often the customer is reviewed, and how closely their activity is monitored. The concept is explained in what a customer risk rating is.
Because so much follows from it, the rating has to be consistent, explainable and defensible. Those needs shape what an agent may do.
What may the agent do, and what stays with a person?
| Task | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Gathering inputs | Pulls KYC data, products, geography, transaction patterns, screening results | 1 | Nothing |
| Applying the method | Calculates the rating using the approved factors and weights | 3 for low and medium | Ratings that come out high |
| Spotting triggers | Flags events that should prompt re-rating, such as new high-risk countries in payments | 2 | Deciding whether to re-rate early |
| Proposing overrides | Suggests where the method seems to under- or over-state risk, with reasons | 2 | Approving any override |
| High-risk rating | Proposes with evidence | 2 | Confirming and setting enhanced checks |
| Methodology | Reports where factors seem out of line with outcomes | 1 | Changing factors or weights |
| Record | Files the inputs, calculation and decision | 3 | Signing high-risk and overridden ratings |
The approved method usually takes the form of a matrix of factors and scores; see the customer risk rating matrix.
Why not let the agent use its own judgement?
Because a rating must be explainable to a supervisor and consistent between customers. An approved method gives both: the same inputs produce the same rating, and every factor can be traced. An agent applying open-ended judgement would produce ratings that differ in ways nobody can fully explain, which undermines the firm's whole risk-based approach.
The agent's judgement is useful in one place: noticing when the method seems to miss something, and saying so. That observation goes to a person.
Where are the difficult cases?
Overrides. A customer may score low on the matrix but carry risk the factors miss, such as a known association with a person under investigation. Overrides upwards and downwards need a named decision and a reason.
Behavioural change. A low-risk customer's activity may shift: new countries, new counterparties, larger cash amounts. The agent can flag it; a person decides whether the rating should move.
Fairness. Ratings that lean heavily on nationality or location can treat customers unfairly. The methodology owner should review outcomes for patterns the firm cannot justify.
An illustrative example
Take an electronic money firm that re-rates customers on each periodic review. The agent prepares each review.
For most customers, it gathers the inputs, applies the matrix and confirms the existing rating, which it records at depth 3. For one small business customer, the matrix produces "medium", but the agent notices that over the past quarter the customer began receiving payments from several countries the firm treats as higher risk, with no change in the stated business. It proposes an upward override to "high" with the transactions attached. The compliance officer reviews, asks the customer about the payments through the relationship team, and sets the rating to high with enhanced monitoring. Her reason is recorded alongside the agent's proposal. The workflow is described in how to run customer risk rating reviews with an AI agent.
How does this connect to wider risk work?
Customer risk ratings feed into the firm's overall view of its financial crime exposure. An agent can help assemble that wider picture too, covered in whether an AI agent can do a compliance risk assessment. Conduct risk is a separate dimension, about how customers are treated rather than the risk they pose; see whether an AI agent can review customer calls for conduct risk.
What controls keep this safe?
- Only the approved method is used for calculation, with its version recorded.
- High-risk outcomes always held for a person.
- Overrides require a named decision and reason, never the agent alone.
- Every rating filed with its inputs, so it can be recalculated.
- Outcomes reviewed periodically for drift and unfair patterns.
The principle for all compliance agents is in AI compliance agents: second line, never the last word.
Where Pryme fits
In Pryme, applying the approved matrix can be certified for depth 3, while overrides and high-risk ratings stay held for a named person. Each input carries its provenance class, so the officer can see whether a factor came from the firm's own records or from what the customer declared.
Questions people ask
Can the agent lower a customer's rating?
It can propose a lower rating where the method supports it. Downgrades from high risk should always be confirmed by a person, because errors there reduce scrutiny.
Is the rating method itself a model?
Often, yes, for model risk purposes, especially if it uses statistical scoring. Ask your model risk team.
Should customers be told their rating?
Generally not, and the reasons for enhanced checks may be sensitive. Any customer contact should follow approved wording.