High risk. Medium risk. Low risk.

For many financial institutions and accountable institutions, these three categories have become so familiar that they can feel like a regulatory requirement.

But are they?

The risk-based approach requires institutions to identify, assess, monitor, manage and mitigate financial crime and sanctions risk. In South Africa, Guidance Note 7B reinforces this obligation in relation to money laundering, terrorist financing, proliferation financing and related financial crime risks.

What it does not do is prescribe a universal three-tier customer-risk classification model.

That distinction matters.

As institutions reassess their financial crime frameworks, RMCPs and customer-risk methodologies, there is an opportunity to challenge a model that may have become deeply embedded through policy, systems, practice and organisational habit.

The central issue is whether the customer-risk model improves financial crime risk management, rather than whether it simply reflects accepted industry convention.

This question forms the basis of the latest FCRMC white paper examining customer-risk classification under the risk-based approach.

For organisations that would like to explore the regulatory context, analysis and practical recommendations in greater depth, contact FCRMC to request the full white paper.

Familiar does not necessarily mean required

The use of high, medium and low-risk classifications is widespread.

The model is intuitive, familiar to management and regulators, straightforward to configure in many systems and relatively easy to incorporate into reporting, policies, quality assurance and audit programmes.

Those are all legitimate advantages.

However, familiarity does not establish regulatory necessity.

The more important consideration is whether each category serves a clear risk-management purpose and produces a meaningful control outcome.

A three-tier model may be entirely appropriate where an institution can clearly demonstrate:

• what each category means;
• how customers are assigned to each category;
• which risk factors influence movement between categories;
• what controls apply to each category;
• how monitoring, review and escalation differ;
• how customer impact has been considered; and
• how the model is governed and tested.

Where those distinctions are clear, three categories may support an effective and proportionate risk-based approach.

Where they are not, the classification may have become more of a convention than a control.

A customer-risk category should change something

The most important test for any customer-risk category is whether it changes the control outcome.

A meaningful classification should influence areas such as:

• the level of customer due diligence;
• the need for enhanced due diligence;
• approval requirements;
• screening intensity or frequency;
• transaction or activity monitoring;
• review frequency;
• escalation requirements;
• quality assurance and oversight; and
• management information or Board reporting.

If a category does not produce a differentiated control response, it may be functioning primarily as a label.

This matters because customer-risk classification should not be treated merely as an administrative or system-generated outcome.

It is a risk-management decision.

The classification should influence how the institution understands and manages the financial crime and sanctions risks presented by the customer.

The problem with “medium risk”

The medium-risk category deserves particular attention.

In some organisations, medium risk is clearly defined and produces a distinct control response.

In others, it becomes the category used where customers are not clearly low risk but do not quite meet the threshold for high risk.

Where this happens, the category may create the appearance of risk differentiation without materially improving the underlying assessment or control response.

If a medium-risk customer is subject to essentially the same controls as a standard customer, there may be limited value in maintaining the additional classification.

Conversely, where medium risk results in additional documentation requirements, shorter review cycles or more intensive controls, the institution should be able to explain why those measures are proportionate to the underlying risk.

This is relevant not only from a compliance perspective, but also from a customer and operational perspective.

An unnecessarily complex risk methodology can create repeated information requests, onboarding delays, review friction and increased operational workload without necessarily improving financial crime risk management.

Two categories are not automatically better

Challenging the three-tier model does not mean that every institution should replace it with a two-tier approach.

There is no universally correct number of customer-risk categories.

A two-tier model, for example, might distinguish between standard-risk customers and high-risk customers.

That may be appropriate where the institution has a relatively homogeneous customer base, strong baseline controls and clearly defined escalation criteria.

But simplicity alone does not make the model defensible.

A two-tier approach only works where standard-risk customers remain subject to a robust baseline control environment and customers presenting higher risk are consistently identified and escalated for appropriate enhanced measures.

Importantly, “standard risk” should not automatically be confused with “low risk”, and it should not automatically result in simplified due diligence.

Simplified due diligence is a separate control treatment that must itself be justified.

Similarly, more granular models may be appropriate for complex institutions operating across multiple products, customer types, jurisdictions and delivery channels.

Greater granularity, however, brings greater governance demands.

More categories can require stronger data, better systems, greater staff capability, more sophisticated assurance and more complex management information.

Complexity should therefore have a clear purpose.

Customer-risk models should earn their complexity

The central proposition is not that fewer customer-risk categories are always better.

It is that a customer-risk model should earn its complexity.

Every additional category should materially improve one or more of the following:

• risk identification;
• control application;
• resource allocation;
• customer proportionality; or
• regulatory defensibility.

If it does not, the continued value of that category should be reconsidered.

This is particularly relevant where existing methodologies have been inherited.

Customer-risk models often become deeply embedded over time through legacy policy drafting, system defaults, audit methodologies, peer benchmarking and organisational habit.

A system may require three categories because it was configured that way years ago.

A policy may contain three categories because an earlier version did.

An audit programme may test high, medium and low-risk customers because that is how testing has always been structured.

Over time, an internal design choice can begin to resemble a regulatory requirement.

That is precisely why periodic reassessment matters.

GN7B creates an opportunity to reassess the model

Guidance Note 7B provides institutions with a useful opportunity to revisit their customer-risk methodologies.

The guidance reinforces the importance of an institution-specific, documented and risk-based approach and strengthens the focus on areas including money laundering, terrorist financing, proliferation financing, technology, systems and controls.

The implication is not that institutions should immediately change the number of customer-risk categories they use.

Rather, institutions should be able to explain why the model they have chosen remains appropriate.

A reassessment should consider whether:

• the model reflects current ML, TF, PF and sanctions risks;
• the model aligns with the institution’s RMCP;
• each category produces a meaningful control response;
• standard controls, simplified due diligence and enhanced due diligence are clearly distinguished;
• the methodology relies excessively on fixed periodic reviews;
• ongoing monitoring and trigger events identify changes in customer risk;
• customer impact has been considered;
• appropriate governance has approved the model; and
• the effectiveness of the model is periodically tested.

GN7B does not prescribe the number of customer-risk categories an institution should use.

It reinforces the need for the institution to be able to justify and evidence the model it has selected.

The debate should not be reduced to “two or three”

Customer-risk classification should not be reduced to a simple choice between two categories and three.

The more important consideration is whether the chosen structure produces meaningful, proportionate and defensible control outcomes.

For one institution, a two-tier model may be appropriate.

For another, three categories may remain entirely suitable.

For a complex financial institution with multiple jurisdictions, products and customer segments, considerably more granularity may be justified.

The quality of the model does not depend on the number of labels.

It depends on whether the methodology accurately identifies risk and translates that assessment into proportionate controls.

The role of Boards and executive management

Boards and executive management should be able to understand and challenge the rationale behind the institution’s customer-risk methodology.

This includes understanding why the current number of categories is used, whether the model was deliberately selected or inherited, and what changes when a customer moves from one category to another.

Particular attention should be given to whether intermediate categories have a clearly defined control purpose, whether additional requirements remain proportionate to the risk being managed, and whether changes in customer risk are identified through ongoing monitoring and trigger events rather than periodic reviews alone.

Management should also be able to demonstrate that the methodology is supported by appropriate governance, systems, data and assurance.

Ultimately, the institution should be able to explain and defend its model during regulatory scrutiny.

Control outcomes, not inherited labels

There is no universally correct number of customer-risk categories.

High, medium and low are widely used, but widespread industry practice should not automatically be treated as a regulatory requirement.

Equally, a two-tier model should not be adopted simply because it appears easier to operate.

The defensibility of any customer-risk methodology ultimately depends on its rationale, the strength of the underlying control environment, the proportionality of its outcomes and the institution’s ability to demonstrate that it works in practice.

A three-tier model may be entirely appropriate where every category produces a distinct, justified and measurable control response.

A two-tier model may be appropriate where robust baseline controls apply to standard customers and clearly defined risk indicators result in enhanced treatment.

More granular models may be necessary where institutional complexity justifies them.

The central test is not the number of categories.

It is whether the model improves financial crime risk management.

Customer-risk classification should be designed around control outcomes, not inherited labels.

Read the full FCRMC white paper

This article provides an overview of the issues explored in FCRMC’s latest white paper on customer-risk classification and the risk-based approach.

The full paper examines the regulatory and standards context in greater detail, considers how the three-tier model became embedded across the industry, compares two-tier, three-tier and more granular approaches, explores customer and operational impacts, and provides a diagnostic checklist and recommended actions for Boards and executive management.

To receive the full white paper, Contact FCRMC.

This paper forms part of a broader FCRMC thought-leadership series examining established financial crime practices through the lens of effectiveness, proportionality and regulatory defensibility.

Keep an eye out for the next paper in the series as we continue to examine whether established financial crime practices remain appropriate for today’s risk and regulatory environment.