Customer-risk classification affects far more than a label in a system.
It influences the level of customer due diligence applied, the intensity of monitoring, the frequency of review, escalation requirements, the customer experience, the allocation of compliance resources and the institution’s ability to defend its risk-based approach during regulatory scrutiny.
As institutions reconsider traditional high, medium and low-risk models, one distinction becomes particularly important:
Standard risk is not simplified due diligence.
A standard-risk customer remains subject to the institution’s full baseline financial crime control environment.
Simplified due diligence, by contrast, is a separate control treatment that should only be applied where lower money laundering, terrorist financing and proliferation financing risk has been assessed and documented, and where reduced treatment is permitted under applicable law, regulatory guidance and the institution’s RMCP.
That distinction forms the basis of the second white paper in FCRMC’s customer-risk classification series.
For organisations that would like to explore the regulatory analysis, control implications and practical recommendations in greater depth, contact FCRMC to request the full white paper.
Why the terminology matters
The language used in customer-risk frameworks is not merely semantic.
Terms such as low risk, standard risk and high risk can influence how staff interpret controls, how customers are treated, how procedures are designed and how regulators understand the institution’s methodology.
The phrase “low risk” can easily create the impression that fewer controls are required.
In some circumstances, that may be appropriate. Where an institution has properly assessed and documented lower ML, TF and PF risk, and where simplified treatment is permitted, reduced due diligence measures may be justified.
However, many customers are not genuinely low risk.
They are simply customers whose financial crime risks are sufficiently understood and manageable through the institution’s normal control environment.
In that context, “standard risk” can be a more accurate description.
It communicates that the customer:
- does not currently require enhanced due diligence;
- does not automatically qualify for simplified due diligence;
- remains subject to the institution’s baseline controls;
- remains subject to ongoing monitoring and trigger-event review; and
- can be escalated where risk indicators emerge.
The distinction is important because standard risk is not a reduced-control state.
It is the normal control state.
Standard risk, low risk and simplified due diligence are different concepts
These terms are often used interchangeably, but they should not be.
Standard risk
A standard-risk customer is managed through the institution’s full baseline financial crime control environment.
That should include appropriate:
- customer identification and verification;
- beneficial ownership identification and verification where applicable;
- understanding of the purpose and intended nature of the relationship;
- sanctions screening;
- PEP/PIP screening where applicable;
- customer risk assessment;
- ongoing monitoring;
- trigger-event review;
- record keeping;
- suspicious and unusual transaction reporting controls; and
- escalation where risk indicators arise.
Standard risk therefore means that the institution’s ordinary control framework is sufficient to manage the customer’s residual risk.
It does not mean the customer is free from risk.
Low risk
Low risk is an assessed risk state.
It means the institution has determined, using its methodology and supporting evidence, that the customer or transaction presents a lower level of ML, TF and PF risk.
Low risk should not be assumed merely because the customer is local, an individual, lower income, associated with a common product or historically treated as low risk.
It should be assessed, documented and capable of being explained.
Simplified due diligence
Simplified due diligence is a control treatment.
It involves applying reduced or less intensive due diligence measures where this is permitted and justified by the assessed level of risk.
A low-risk classification should therefore not automatically result in simplified due diligence.
The institution should still be able to demonstrate that reduced treatment is appropriate, permitted under its RMCP and applicable regulatory framework, and not contradicted by higher-risk indicators.
Standard risk requires full baseline control
The credibility of a standard-risk classification depends heavily on the quality of the institution’s baseline control environment.
A standard-risk category becomes difficult to defend where baseline controls are weak or inconsistently applied.
By contrast, where the ordinary control environment is robust, the model becomes more credible because the institution can demonstrate that the majority of customers remain subject to meaningful controls without being unnecessarily escalated into enhanced treatment.
A defensible baseline framework should incorporate several elements.
Customer due diligence
Customers should still be appropriately identified and verified in accordance with the institution’s RMCP.
For legal persons and arrangements, this should include sufficient understanding of ownership and control.
Beneficial ownership
Where applicable, beneficial owners should be identified and appropriately verified.
More complex, layered or opaque structures may require further scrutiny.
Screening
Standard-risk customers should remain subject to relevant sanctions, targeted financial sanctions and PEP/PIP screening in line with the institution’s methodology.
Customer risk assessment
Risk factors should still be assessed and documented.
These may include customer type, product, service, channel, geography, ownership structure, expected activity and screening outcomes.
Ongoing monitoring
Standard-risk customers remain subject to monitoring.
This includes identifying activity inconsistent with the expected customer profile, adverse information, sanctions developments and other changes in risk.
Trigger-event review
Institutions should not rely solely on fixed periodic review cycles.
Material changes in ownership, activity, geography, customer behaviour, sanctions exposure, PEP/PIP status, adverse media or other relevant factors should trigger reassessment where appropriate.
Escalation
The methodology should clearly identify when a customer can no longer be managed through baseline controls and requires enhanced review or high-risk classification.
A two-tier model is not a reduction in control
A standard-risk and high-risk model may be appropriate for some institutions.
The purpose of such a model is not to weaken controls.
It is to create a clearer link between the customer’s risk profile and the level of control applied.
Under this approach, customers whose risk can be managed through the full baseline control framework remain standard risk.
Customers presenting defined higher-risk indicators, unresolved uncertainty or residual risk beyond what the baseline environment can effectively manage move into enhanced treatment.
The distinction should therefore be operational, not merely linguistic.
Standard risk represents full baseline controls.
High risk represents a need for additional or enhanced measures.
Simplified due diligence should remain a separate decision
Simplified due diligence should not become the default treatment for standard-risk customers.
Reduced measures may only be appropriate where the institution has established a defensible basis for lower risk.
That basis should be supported by the institution’s methodology, RMCP and applicable regulatory guidance.
Importantly, simplified due diligence should not be used primarily to speed up onboarding or reduce operational cost.
Any operational benefit should be secondary to the underlying risk assessment.
The institution should also remain able to reverse simplified treatment when new information emerges.
A customer previously considered lower risk may need to move into standard or enhanced treatment as risk factors change.
Enhanced due diligence should be targeted to the risk
The other side of the framework is enhanced due diligence.
Where baseline controls are insufficient, additional measures should respond directly to the risk identified.
Higher-risk indicators may include:
- PEP/PIP exposure;
- sanctions proximity;
- links to higher-risk jurisdictions;
- complex or opaque ownership structures;
- nominee arrangements;
- unexplained third-party involvement;
- material adverse media;
- cash-intensive activity;
- trade-finance or dual-use goods exposure;
- proliferation financing indicators;
- unusual transaction behaviour;
- inconsistent source of funds or source of wealth information;
- cross-border complexity; and
- unresolved material uncertainty.
Enhanced due diligence should not simply mean asking every higher-risk customer for more information.
The measure applied should be connected to the underlying concern.
For example, complex ownership may justify additional beneficial ownership verification, while PEP/PIP exposure may require stronger source-of-wealth assessment and senior approval.
Enhanced controls should be more targeted, not merely more burdensome.
Customer impact should form part of control design
Customer-risk classification directly affects the customer experience.
Customers encounter financial crime controls through onboarding questions, document requests, beneficial ownership queries, source of funds and source of wealth requests, periodic reviews, transaction holds and other control interventions.
These measures may be entirely necessary.
However, they should remain proportionate to the risk being managed.
Where institutions apply additional measures without a clear risk basis, the customer bears the cost of weakness in the underlying methodology.
A well-designed standard-risk category can help avoid this.
It allows institutions to maintain full baseline controls without unnecessarily escalating customers into enhanced treatment.
The principle is straightforward:
Customer impact is not a reason to weaken controls.
It is a reason to ensure that controls are necessary, targeted and proportionate.
Governance and regulatory defensibility
Regulators are unlikely to focus solely on the terminology an institution has adopted.
The more important consideration is whether the institution can explain and evidence its methodology.
An institution using a standard-risk and high-risk model should be able to demonstrate:
- why the model was selected;
- how it aligns to Guidance Note 7B and the RMCP;
- how standard risk is defined;
- why standard risk is not treated as low risk;
- when simplified due diligence may be applied;
- how high-risk customers are identified;
- what enhanced measures apply to higher-risk relationships;
- how trigger events are monitored;
- how customer impact has been considered;
- how the model is governed and approved; and
- how its effectiveness is tested.
The regulatory defence is not that the institution uses fewer categories.
The defence is that the model is rational, proportionate, documented, embedded and tested.
The FCRMC view
FCRMC’s position is that the term standard risk should be used carefully and deliberately.
Standard risk is not a weaker form of compliance.
It represents a control state in which the customer remains subject to the institution’s full baseline financial crime control environment.
A standard-risk/high-risk model may be more appropriate than a traditional high/medium/low model where baseline controls are strong, escalation criteria are clearly defined, simplified due diligence is separately governed and the institution has effective monitoring, governance and assurance.
However, the model should not be adopted merely because it appears simpler.
It should be supported by clear rationale, RMCP alignment, governance approval, staff training, category-to-control mapping and ongoing assurance.
The principle is simple:
Use standard risk where full baseline controls are sufficient.
Use simplified due diligence only where lower risk has been assessed, documented and permitted.
Use high risk where enhanced measures are justified by defined risk indicators or unresolved material uncertainty.
Control clarity is the real objective
The distinction between standard risk and simplified due diligence is central to any institution considering changes to its customer-risk classification model.
A standard-risk category can be both proportionate and defensible, but only where customers remain subject to a robust baseline financial crime control environment.
Simplified due diligence remains a separate treatment that should be used carefully and only where the regulatory and risk conditions for reduced measures are met.
The value of a standard-risk model lies in the clarity it can create.
A well-designed framework should allow an institution to state confidently:
This customer does not currently require enhanced treatment, but remains subject to our full baseline control environment, ongoing monitoring and trigger-event review.
That is the appropriate role of standard risk.
Read the full FCRMC white paper
This article provides an overview of the second paper in FCRMC’s customer-risk classification series: Standard Risk Is Not Simplified Due Diligence.
The full white paper explores the distinction between standard risk, low risk, simplified due diligence and enhanced due diligence in greater detail. It also examines baseline control expectations, customer impact, governance and inspection defensibility, category-to-control mapping, common implementation weaknesses and recommended actions for Boards and executive management.
To receive the full white paper, contact FCRMC.
This publication forms part of FCRMC’s wider thought-leadership series examining customer-risk classification and the practical application of the risk-based approach.
Keep an eye out for the next paper in the series as we continue exploring how institutions can build financial crime control frameworks that are proportionate, operationally meaningful and capable of being defended in practice.