Customer Risk Scores:
What the Number Cannot Decide

The question, and what this guide will not decide

A scoring engine produces a number every time it is asked. Whether the number deserves the weight the firm puts on it is a separate question, and it is the one a supervisor, an auditor or the next MLRO will ask.

This guide answers one question. How can a firm design and govern a customer risk scoring method so that the number informs judgement without replacing it? It is written for the people who own, run or challenge a scoring method. It is a practitioner framework, not a scoring model and not legal advice.

It will not tell you what to weight, where to put the bands or how many bands to have. No source read for this guide does, and a guide that supplied those figures would be inventing a standard and presenting it as one. What it does give you is seven control points a reviewer can put to the model owner, and a way to tell a controlled departure from the number from a quiet manipulation of it.

Two terms, used precisely

A customer risk assessment is the exercise of assessing the risk a customer presents. A customer risk rating is its output: a band or label such as high, medium or low, usually produced from a score. The business-wide risk assessment under regulation 18 is a different exercise, about the firm itself. They connect, and a model that ignores the connection is a weaker model, but they are not the same document. [1]

The analytical spine

Question

How can a firm design and govern a customer risk scoring method so the number informs judgement without replacing it?

Evidence state

The Regulations require risk assessment and risk-sensitive due diligence and prescribe no model. The FCA material is guidance and examples. The seven control points, the override and change designs and the scenario grading are FinCrimeRadar assessment.

Decision object

One judgement about a scoring method: accept it, challenge it, or require a controlled change. It is not a decision about any one customer's rating.

Uncertainty

No source read sets a validation standard, a sensitivity test, an acceptable override rate or a number of bands. The FCA findings on customer scoring are thin, and several items speak only of "risk assessment" in general.

What would change this

A regulator or court stating a model standard. An FCA finding that deals directly with overrides or thresholds. A change to regulation 28 or 33. The firm's own testing contradicting a control point.

Practitioner outcome

After this guide you should be able to challenge a scoring methodology against seven control points, document an override so that it survives review, and recognise when a change to the model needs an impact assessment, testing and approval.

How evidence is labelled

• Established Statute or an in-force regulation, read from the text.
• Guidance FCA findings, case studies and Handbook guidance. Examples and observations, not rules.
• FinCrimeRadar assessment Our analysis. It rests on the sources but is not their wording.
• Unknown No source read settles it.

Out of scope: business-wide risk assessment design, screening and transaction monitoring thresholds, the exit decision itself (see The De-Risking Judgement Call), regulation 35 on politically exposed persons beyond naming it, and other jurisdictions. The word "threshold" in this guide means a customer risk band boundary and nothing else.

What the Regulations ask for, and what they leave to the firm

The legal text is shorter than most scoring methodologies and says nothing about their arithmetic.

What the FCA material adds, and what it does not

The FCA's findings of 11 November 2025 say their purpose is to help firms reflect on how they meet the existing risk assessment requirements, and note that good practice often goes beyond the minimum regulatory requirements. [4] The Financial Crime Guide is general guidance. It is not binding, and the FCA says firms can comply in ways other than following the good practice in it. [8] The January 2025 markets review applies the same register to a sample of wholesale brokers. [5]

Guidance So this guide treats an FCA example as an indication of what a supervisory conversation is likely to cover, and never as a standalone legal obligation. Where an example is applied to a customer scoring model and the source does not itself say so, the text says it is an application. That matters here more than usual, because the 2025 findings page covers customer risk assessment briefly, and most of its items use the general words "risk assessment" without distinguishing the firm from the customer. [4]

The score-to-decision chain

Every scoring method, however it is built, runs the same seven stages. Control points attach to stages, not to the number.

The seven control points

1. CP1Factor admissibility and evidence quality. Why is this input in the model, where does it come from and how reliable is it?
2. CP2Weighting rationale and double counting. Why this weight, and is the same underlying fact being counted twice?
3. CP3Threshold design and operational consequences. Where do the bands fall, and what does each band actually cause?
4. CP4Triggers outside the arithmetic. Which legal or policy triggers apply whatever the score says?
5. CP5Controlled overrides. What evidence, reason, approval and record does a departure from the output need?
6. CP6Model testing, change control and triggered reassessment. What tells the firm the model still works, and what happens when it changes?
7. CP7Management information and feedback. What comes back from the chain, to whom, and who can act on it?

Inside the number: nine decisions nobody sees on the dashboard

A customer risk score appears as one figure. It contains at least nine design decisions, and a reviewer who sees only the figure cannot challenge any of them.

Control point 1: factors the firm can defend

A factor earns its place when the firm can say what risk it stands for, where the value comes from, how far it has been verified and what the model does when it is missing. The Regulations name categories of risk factor, among them customers, geographies, products or services, transactions and delivery channels, and the case-level factors in regulation 28(13) are expressly not a closed list. [1] [2] Established The FCA's guidance lists the kind of relationship factors a firm might weigh, such as company structures, political connections, country risk, source of wealth and funds and expected account activity. [7] Guidance

The difficulty is the gap between the factor as named and the evidence behind it. A self-declared industry code and a verified registry entry are different inputs, and a model that cannot tell them apart will weigh them alike. The same goes for a blank. FinCrimeRadar assessment Decide in writing whether a missing input scores as unknown, as neutral or as low, and who approved that choice. A default that happens to be benign is a hidden decision. It can produce the effects the FCA lists as poor practice: a classification system that makes a high rating almost impossible, or higher risk countries given low scores to avoid enhanced due diligence. [7] The FCA describes those as design failures, not as consequences of missing data, so the link to defaults is our application.

The FCA also lists as poor practice customer scores that rest predominantly on one factor, such as jurisdiction, and records firms that based the assessment solely on customer jurisdiction. [5] Guidance A model that is easy to explain because it only has one moving part is not thereby defensible.

Control point 2: weights, and facts counted twice

The FCA's Case Study 17 is the example practitioners reach for, so it is worth reading for what it says. One wholesale broker used a spreadsheet that scored six categories (product and service, customer type, customer industry, geography, relationship structure, and adverse media and PEP status), weighted the category scores, and mapped the total to a high, medium or low rating that determined the level of due diligence. The same sheet alerted the user when escalation to the MLRO for approval was needed, had a section for manual overrides and their rationale, and prompted the user to consider other risk factors. The FCA introduced it as an illustration of a reasonable approach to calculating risk ratings. [5] Guidance

It did not say those weights are right for anyone else. The percentages belong to one firm's business and risk profile, and copying them copies the least transferable feature of the case. What transfers is the structure around the arithmetic: a score that sets the level of due diligence, a route to escalation, and a controlled place for overrides and their reasons. FinCrimeRadar assessment

The FCA's wider observation is that most firms it saw considered a variety of risk factors and several weighted their calculations. [5] Some tailored their customer assessment through sub-factors and weightings, and the FCA lists as good practice reflecting the risks found in the business-wide assessment in the customer assessment through weightings or sub-factors. [4] So the question for this control point is not whether to weight. It is whether the firm can write down why each weight is what it is and what evidence it was tested against. A weight with no recorded rationale is a guess that has been given authority by a spreadsheet.

Double counting is the quieter risk. No source read addresses it, so this is FinCrimeRadar assessment. Suppose a model scores a customer's sector, its country of registration and the channel through which it was onboarded, and in the firm's book the three move together: most customers in the sector are registered in that country and arrive through agents there. The model has counted one fact three times, and the customer looks three times as risky as the facts support. The control is to measure how factors move together across the book, then cap or net the overlap by rule, and record the decision.

Where the bands fall, and what each band does

Consequences attach to bands, not to scores. That makes each cut-off one of the most consequential numbers in the model, and one of the least often justified in writing.

Two customers a point apart on either side of a boundary receive different due diligence, different monitoring and perhaps a different approver. That is acceptable only if the firm chose the boundary deliberately and knows how many customers sit close to it. Three questions follow. Why is the boundary here? What does a small movement do to the population in each band? And can the teams who receive each band's customers actually do the work?

The last question is the one models skip. A high band that swallows a large share of the book gets worked through rather than investigated, and a high band that catches almost nobody is the failure the FCA describes as a classification system that makes a high rating almost impossible. [7] Guidance FinCrimeRadar assessment Set the boundaries by reference to risk appetite and operational capacity together, and record both. The Regulations do not fix a number of bands, and Case Study 17 happened to use three. [1] [2] [3] [5]

Control point 3: every band needs a stated consequence

The FCA lists as good practice customer risk assessments that directly affect due diligence, transaction monitoring and other controls, and in Case Study 17 the rating determined the level of due diligence. [4] [5] The FCA also saw the reverse: a customer's rating set on completion of due diligence instead of the assessment deciding how much due diligence to do, and some client types assigned low risk automatically regardless of other factors. [5] Guidance The mapping from band to consequence is where a scoring method either does something or does nothing, so for each band the firm should be able to answer:

• What depth of due diligence applies, and who decides it?
• What level of ongoing monitoring applies?
• When is the next review, and which events bring it forward?
• Who may approve onboarding or continuation?
• Which of these consequences is required by law (see the next section), and which is firm policy?

Rules that sit outside the arithmetic

Some obligations do not ask what the score is. A model that can lower them has no business being in the chain.

Control point 4: statutory and policy triggers

Established Regulation 33(1) requires enhanced due diligence and enhanced ongoing monitoring in listed cases. Two of them depend on the firm's own assessment: a case identified as high risk by the firm under regulation 18(1) or in supervisory information, and any other case that by its nature can present a higher risk. The rest turn on facts. They are a business relationship or relevant transaction involving a person established in a "FATF call for action country", subject to the narrow exception in regulation 33(2); correspondent relationships caught by regulation 33(1)(c), in accordance with regulation 34; a customer the firm has determined to be a politically exposed person or a family member or known close associate of one; a customer who has provided false or stolen identification where the firm proposes to continue dealing; and the unusual transaction cases. [3] Separately, regulation 33(7) tells the firm, when it assesses whether a situation is high risk, to bear in mind that the presence of one or more risk factors may not always indicate a high risk. [3]

FinCrimeRadar assessment The fact-based cases are not conditioned on a rating. A model that returns low for a customer established in a Call for Action country has not changed what regulation 33(1)(b) requires, unless the regulation 33(2) exception applies. That exception turns on its own conditions and not on the score. Where it does not apply, the model has produced a wrong treatment. Build these cases as rules that act beside or before the score, either as a floor under which the applied treatment cannot fall or as a flag that attaches the legally required measures whatever the band. For every customer record two things: the model output, and the treatment applied with the rule that set it. When the two differ, the difference is then a record and not a mystery.

The wording of regulation 33(1)(b) changed with effect from 30 June 2026. [3] A rules engine built before that date may carry the older trigger, so check it against the current text. [3] The De-Risking Judgement Call sets out what changed and what it left in place.

Policy triggers are the firm's own: sectors it will not serve, jurisdictions it will not touch, activities that need senior approval. They sit outside the arithmetic for a different reason. They are risk appetite decisions, and a model should not be able to dilute them. Label each trigger as law or policy, so that nobody mistakes one for the other.

What a high score does not do

FinCrimeRadar assessment A high rating raises the level of due diligence and attention. By itself it does not establish suspicion, require the firm to exit the customer, or show that the customer is outside the firm's appetite. None of the sources read ties a rating band to a suspicion judgement or to an exit decision, and nothing in the regulations read converts a score into either. Regulation 33(7) is a narrower point: it says that one or more risk factors may not always indicate a high risk, and it does not address suspicion or exit. [3] Whether a suspicion exists, and whether to end a relationship, are separate judgements made on facts. For the second, see The De-Risking Judgement Call.

Overrides: a controlled departure or a quiet manipulation

An override is a person disagreeing with the model. Whether that is good governance depends entirely on what gets written down.

Control point 5: evidence, reason, approval and record

Guidance The FCA lists a clear audit trail of customer risk rating overrides and their rationale as good practice, and the Case Study 17 sheet had a section for manual overrides and rationale. [5] On the other side, FCG 3.2.3 lists relationship managers being able to override customer risk scores without sufficient evidence as poor practice, together with risk assessments unduly influenced by the potential profitability of relationships and the risk that a relationship manager becomes too close to customers to take an objective view. [7] The markets review found that few firms adequately documented the rationale for a rating, particularly where management overrides had taken place, and that evidence of escalation, decisions and quality assurance was often not evident. [5]

FinCrimeRadar assessment The sources treat evidence and record as the dividing line. They do not say overrides are acceptable only below some frequency, and they do not say who must approve one. Those are design choices, and the loop below is ours.

A simple test separates the two. Could an independent reviewer reconstruct the original output, the change, the reason, the evidence and the approver from the record alone? Downward overrides deserve the sharper control, because they reduce due diligence, while an upward override adds it. The sources do not draw that distinction, so it is FinCrimeRadar assessment.

Testing, change and reassessment

A model that was sound when it was approved is only sound today if something has checked.

Control point 6: test, approve, release, watch

Guidance The FCA lists as good practice documenting risk assessment methodologies in detail and formally logging, discussing and approving changes, and reviewing risk assessment models and processes with quarterly or triggered updates. It lists as poor practice limited or no testing and review of risk assessment processes when firms make enhancements, upgrades or automation, customer assessments not developed in line with business growth, assessments that are not sufficiently dynamic, and rapid expansion of products, services and customer types without first ensuring controls remain appropriate. [4] FCG 3.2.3 says firms must regularly review their risk assessment to ensure it remains current, and FCG 2.2.4 says firms should regularly review both their business-wide and their individual risk assessments. [7] [6]

Established The statutory text names no frequency. Regulation 28(11)(b) requires reviews of existing records and keeping due diligence information up to date, and regulation 18(4) requires an up-to-date record of the steps taken. [1] [2] Quarterly updating is therefore an FCA example of good practice, not a legal minimum, and the FCA presents triggered updates alongside it. What matters is that the firm can name its triggers and show that they work.

FinCrimeRadar assessment Firms blur two kinds of reassessment. Customer reassessment re-scores a customer when something about them changes. It is operational, and the FCA says firms should consider the events that would trigger a review or update, noting that some firms looked at changes in geographical risk only at the periodic review. [5] Model reassessment re-tests the method when something about the book, the data, the law or the product changes. It is change control, and the cycle below is how it should run. Nothing in the findings addresses validation of a scoring model by name, so the testing ideas that follow are ours.

Useful tests, none of them prescribed by any source read: how many customers change band if each input moves by a small margin; how an independent reviewer would rate a sample of files, compared with the model, across all bands and not only the high one; how the model treats a customer whose key input is missing; and whether any segment is rated differently from the rest for reasons the firm cannot explain.

What should come back from the chain

A scoring method that reports nothing about itself cannot be governed.

Control point 7: management information and feedback

Guidance The FCA lists customer risk assessment management information provided to senior management committees for discussion as good practice. [4] The markets review found that evidence of escalations, decisions taken and quality assurance checks was often not evident. [5] No source sets a threshold for any measure below, and this guide gives none.

FinCrimeRadar assessment A useful pack reports:

• The distribution of customers across bands over time, and what moved when it moved.
• Movement between bands, and the inputs behind it.
• Overrides by reason code, team, approver and direction, with age.
• The time from a trigger event to a re-score.
• The result of sampled file reviews: how often an independent reviewer would have rated differently.
• Consequences actually applied against the consequences expected for the band.
• Model changes, test results and open remediation.

The test of the pack is who can act on it. Someone must be able to pause reliance on the model, someone must decide to change it, and the pack must reach them. Management information that nobody has the authority to act on is decoration.

The model that was approved for someone else

The engine will score anyone. That is not the same as being valid for them.

The same reason, again and again

Each file looks defensible. The pattern may not be.

Red Team Questions

1. If the number disappeared tomorrow, could we still explain why this customer received this level of due diligence?
2. Do we know what a blank input does to the score, and who approved that?
3. Which factors move together in our book, and have we counted any fact twice?
4. If one input moved slightly, how many customers would change band?
5. Does any band produce the same action as another, whatever caused the rating?
6. Is there a legal trigger the model can lower, and is every policy trigger labelled as policy?
7. Could someone who was not there reconstruct an override from the record alone?
8. What would we have to see to conclude the model no longer works, and who has the authority to stop relying on it?

Risk, Signal, Response

Related intelligence