Use each type of information correctly
A risk factor is information that helps you assess the risks of a customer and service. A mandatory trigger is a condition in the law that requires a response when it applies. The same fact can contribute to an assessment and activate a legal duty, but those functions should remain visible.
Section 28 requires a customer risk assessment. Section 32 then specifies circumstances requiring enhanced CDD. A business should not treat the second step as optional simply because most answers in a questionnaire appear ordinary. The legal condition must be assessed on its own terms.
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006: Sections 28(3) to (5), 31 and 32
- AML/CTF Rules 2025: Section 6-20
- Risk factors
Information contributes to the customer risk assessment.
- Legal conditions
An applicable statutory or Rules trigger requires its specified response.
- Required measures
Select measures that address both the risk assessment and applicable duties.
A risk rating and a legal trigger do different jobs
A low rating does not override an enhanced CDD trigger. These are connected questions, not weights to average together.
Connected concepts. Lines do not show ownership or a reporting hierarchy.
Know what a low rating cannot do
Simplified CDD under section 31 requires low customer risk, no applicable section 32 trigger and compliance with the Rules. These conditions operate together. A low score alone is not permission to reduce checks.
Rules 6-20 also requires enhanced CDD for requests involving no apparent economic or legal purpose, unusually complex or large transactions, or an unusual transaction pattern. Assess the request in context. This is different from deciding that every large amount or every company structure meets the condition. The reason it is unusual matters, as does the exact service requested.
Worked example: a score and a rule
A fictional scoring tool gives points for several characteristics. Most are ordinary, so the total is low. The file also establishes a foreign PEP connection covered by section 32. If the tool simply averages all the answers, it can hide a mandatory enhanced CDD response.
A clearer design records the overall risk reasoning and the specific trigger separately. The reviewer sees both and selects the required measures. This example is about decision design. It does not prescribe numerical weights, establish that a particular person is a PEP or prove that the customer has committed an offence.
Ask what caused the response
A useful case note answers three questions: what fact was established, which duty or policy applied, and what action followed. If the answer says only high risk, the connection may be unclear. Add enough detail to distinguish a legal trigger from a judgement made under the business's policies.
Likewise, record why an apparent trigger did not apply after review. A name match may prove to concern a different person. That is a different result from ignoring a true match because other factors were low. Clear reasons support later review and make control failures easier to identify.