Connect the rating to a decision
A customer risk rating is a summary of an assessment. It is not the assessment itself. The useful result is an explanation of the risks presented by this customer, in this service, and the checks needed to manage them. A number without its inputs cannot show that reasoning.
Under section 28, identify customer risk from know your customer (KYC) information reasonably available before the service begins. For an Australian permanent establishment, take account of the business risk assessment, customer type, services, delivery channels and countries. These are connected considerations. Do not select a rating from the customer's name or occupation alone.
Source: Federal Register of Legislation: Sections 28(3) to (5), 31, 32.
- Customer and service
Collect the relevant available KYC and service information.
- Risk assessment
Consider customer, service, channel and country factors.
- Specific triggers
Examine mandatory responses separately from an overall score.
- Recorded response
Describe the rating, evidence and controls selected.
Keep the reason behind the rating
A score cannot cancel a mandatory trigger. This is a suggested way to present the reasoning, not a scoring formula.
Follow the process from top to bottom.
Keep mandatory duties separate
A rating can help staff apply the business's policies consistently. The rating should remain connected to the evidence used to assess the customer. The law attaches consequences to risk: high risk requires enhanced customer due diligence (CDD), while simplified CDD has several conditions beyond a low rating.
Some enhanced CDD triggers apply independently of a general score. A model must not average those triggers away. Keep the finding that activates a mandatory rule visible beside the rating. The reviewer needs to know whether a response follows the assessed risk, a specific legal trigger, or both.
Source: Federal Register of Legislation: Sections 28(3) to (5), 31, 32.
Invented example: incomplete ownership information
A company gives a clear business purpose but an incomplete ownership chart. A staff member initially expects ordinary risk because the service is routine. The missing information means that expectation needs examination. It does not, by itself, prove the company is involved in crime.
The staff member identifies the missing link, requests suitable information and records the result. If the response explains the structure, the rating can reflect that evidence. If contradictions remain, the reviewer considers their significance and the appropriate controls. Changing the rating without recording what changed would hide the actual decision.
Source: Federal Register of Legislation: Sections 28(3) to (5), 31, 32.
Invented example: similar customers, different evidence
Two company customers request the same service. The first supplies an ownership explanation consistent with the available records. The second supplies conflicting explanations. The reviewer records the conflict and examines its effect on the second assessment.
The shared service and company form do not require identical ratings. The reviewer records the relevant evidence, unresolved questions and reasons for each response. Missing information is not proof of crime. A clear ownership explanation does not remove unrelated risks.
Now suppose a person acting for the first customer is a foreign politically exposed person. Section 32(c) requires enhanced CDD in that circumstance. An otherwise low score cannot cancel this requirement. The example distinguishes evidence-based ratings from a separate mandatory trigger.
Source: Federal Register of Legislation: Sections 28(3) to (5), 31, 32.
Read the evidence behind a screening label
A screening category is an input to examine. Record what the underlying information establishes and what remains uncertain. Keep the identity-match decision separate from the assessment of relevant conduct. Use the linked article to interpret special interest person labels.
Source: Federal Register of Legislation: Sections 28(3) to (5), 31, 32.