A customer risk rating matrix scores a customer's financial crime risk across set factors, such as customer type, geography, products, channel, activity and screening results, then combines them into a rating of low, medium or high, with overrides for cases that are always high. An AI agent can calculate each factor and show its working. A person sets the rating.
What does the matrix do?
A customer risk rating decides how much due diligence a customer receives, how often their file is reviewed and how closely their activity is monitored. It is the practical form of the risk-based approach in the FATF Recommendations. The matrix makes the rating consistent: the same facts produce the same score, whoever looks.
It also makes the agent's role clear. Scoring factors from data is mechanical work an agent can do accurately. Deciding what a combination of facts means, and whether an override applies, is judgement. Whether an AI agent can decide a customer's risk rating answers the question directly: it can calculate, a person decides.
When should it be applied?
At onboarding, at each periodic review, and when a trigger event changes a factor: a new country in the customer's payments, a screening hit, a change of business. The review process itself is covered in how to run customer risk rating reviews with an AI agent.
How do you build and fill the matrix?
- Choose factors that reflect your business and your own risk assessment. Six to eight is usually enough.
- Define low, medium and high for each factor in words, with examples. Avoid vague terms like "unusual".
- Assign scores to each level, and decide how scores combine: a total, or the highest factor wins, or a mix.
- Set overrides: facts that make a customer high risk whatever the score, and facts that require a person to set the rating even if the score is low.
- Set outcomes: what each rating means for due diligence, review cycle and monitoring.
The agent fills in a factor sheet for each customer: level, score, and the evidence behind it with provenance. The analyst reviews the sheet, applies overrides and sets the rating.
The customer risk rating matrix
Part A: factors
| Factor | Low (score) | Medium (score) | High (score) |
|---|---|---|---|
| Customer type | |||
| Geography | |||
| Products and services | |||
| Delivery channel | |||
| Expected activity | |||
| Industry or occupation | |||
| Screening |
Part B: combination and overrides. How scores combine; automatic high-risk overrides; cases always referred to a person.
Part C: outcomes
| Rating | Due diligence | Review cycle | Monitoring |
|---|---|---|---|
| Low | |||
| Medium | |||
| High |
A filled example: business banking
Part A (extract)
| Factor | Low (1) | Medium (2) | High (3) |
|---|---|---|---|
| Customer type | Limited company, simple ownership | Partnership; sole trader | Trust; layered ownership |
| Geography | Domestic only | Trade with lower-risk foreign countries | Links to higher-risk countries on your list |
| Industry | Professional services | Retail; hospitality | Cash-intensive; money services; precious goods |
| Expected activity | Matches turnover | Seasonal swings | Turnover inconsistent with business |
| Screening | No hits | Adverse media, not financial crime | PEP link; financial crime media |
Part B. Total of seven factors: 7 to 10 low, 11 to 15 medium, 16 and above high. Any sanctions-related hit, or a direct PEP, is high regardless. Any PEP link or trust structure is referred to an analyst before rating.
Factor sheet for a hypothetical sole trader running a car wash:
| Factor | Level | Evidence |
|---|---|---|
| Customer type | Medium | Sole trader (registry, signed) |
| Geography | Low | Domestic only (transactions, signed) |
| Products | Low | Current account only |
| Channel | Low | Onboarded in branch |
| Expected activity | Medium | Weekly cash deposits, seasonal |
| Industry | High | Cash-intensive |
| Screening | Low | No hits |
Total 12: medium. No override. The analyst accepted medium, noting the cash pattern matched the business, and set monitoring rules for cash deposits above the expected weekly range.
How does this relate to other matrices?
Financial crime risk is not the same as conduct risk. A customer can be low risk for money laundering and still be vulnerable, which affects how they should be treated; whether an AI agent can review customer calls for conduct risk covers that side. Complaints are classified on their own matrix, the complaint classification matrix. The wider boundary is set out in AI compliance agents: second line, never the last word.
Questions people ask
Should the agent's score be the default rating?
It can be shown as the calculated score, but the analyst sets the rating. Record both, and record the reason whenever they differ.
How often should the matrix itself be reviewed?
At least once a year, after your business-wide risk assessment, and whenever you add products, channels or markets.
Can the agent lower a rating at review?
It can show that factors have improved. Lowering a rating reduces scrutiny, so that decision should always be a person's.