Customer Risk Reviews: Inputs, Changes and Human Decisions

Start from the relationship and relevant facts

Describe the customer or entity, intended services, expected activity, ownership and control where relevant, funding context and delivery channel. Identify which facts are verified, self-declared, inferred or missing. Keep those evidence states visible rather than treating every populated field as equally reliable.

FATF's customer-due-diligence framework uses a risk-based approach within applicable requirements. That does not mean inventing a universal score or permitting an average score to cancel a mandatory legal restriction. The operator's qualified policy owner must determine which factors and controls apply to its activities and jurisdictions.

Explain changes and conflicting evidence

Compare the current case with its previous assessment. A changed owner, new funding pattern or different intended activity may matter even if a vendor's overall label remains unchanged. Record the event, underlying evidence and reason for reviewing it. If a screening result conflicts with verified identity information, assign the specific discrepancy rather than merely increasing an opaque risk number.

Digital identity evidence also has scope. FATF's digital-ID guidance addresses the assurance and governance of identification systems. A successful digital verification can support an identity question without answering every question about ownership, intended activity or source of funds. Record what the check covers and what still needs assessment.

Document a decision that can be challenged

State the outcome, material reasons, required controls, approval authority and next review trigger. If an exception is permitted, identify the policy provision and its owner. A sales request to speed up onboarding is not evidence resolving an identity or ownership gap. Keep review responsibilities separate from commercial incentives where the process requires it.

Reviewers should be able to explain why a factor is relevant and whether less intrusive evidence could answer the question. Avoid unsupported assumptions about individuals or protected characteristics. Retain the decision history so a later reviewer can see what changed, without rewriting the earlier case as if today's information had always been known.

Example: a business change triggers a focused review

A fictional corporate customer originally described a single operating business. It later adds a holding company and proposes funding from a different related entity. The reviewer updates the ownership map, asks about the relationship and funding authority, and records the evidence needed. The outcome remains pending on those questions; the system does not automatically reject the customer or approve it because a previous review passed.