Medium risk can feel like the safest answer.
It avoids classifying a customer as standard risk where there is uncertainty, while also avoiding the operational consequences of treating the customer as high risk.
That apparent balance can be misleading.
Customer-risk classification should support disciplined, proportionate and defensible financial crime risk management. It should help institutions identify risk, apply appropriate controls, allocate resources effectively and avoid unnecessary burden on customers.
The problem arises when an intermediate category such as medium risk becomes a default response to uncertainty.
Where that happens, the classification may create the appearance of risk differentiation without necessarily improving the institution’s understanding of the underlying risk.
That is the focus of the third paper in FCRMC’s customer-risk classification series: A Safe Haven of Uncertainty – When Medium Risk Becomes a Default Category.
For organisations that would like to explore the full analysis, practical framework and recommended actions, contact FCRMC to request the full white paper.
Risk and uncertainty are not the same
One of the most important distinctions in customer-risk assessment is the difference between risk and uncertainty.
Risk refers to the institution’s exposure to money laundering, terrorist financing, proliferation financing, sanctions or related financial crime threats.
Uncertainty refers to a lack of clarity, completeness or confidence in the information being used to assess that risk.
The two can be related, but they are not interchangeable.
A customer may present clear higher-risk indicators because of complex ownership, exposure to a higher-risk jurisdiction, sanctions proximity, PEP/PIP status, adverse information or activity inconsistent with the expected profile.
That is a risk issue.
A different customer may present incomplete beneficial ownership information, unclear source of funds information or adverse media that has not yet been confirmed as relating to the correct person.
That is initially an uncertainty issue.
The appropriate response depends on whether the uncertainty is material to the financial crime risk assessment.
Treating every uncertainty as medium risk can obscure that distinction.
When medium risk becomes a decision-avoidance mechanism
A medium-risk category may be entirely appropriate where it is clearly defined and results in a distinct control response.
It becomes problematic where it is used because the institution has not reached a clear conclusion about the customer.
This can occur where:
- staff are uncomfortable assigning a standard-risk classification;
- high-risk escalation criteria are unclear;
- systems default customers to medium risk when information is incomplete;
- quality assurance challenges lower-risk classifications more aggressively than over-classification;
- medium risk is perceived as the safest outcome during regulatory scrutiny; or
- policies do not clearly explain how uncertainty should be resolved.
In these circumstances, the label can begin to replace the analysis.
The institution records the customer as medium risk without clearly identifying the underlying concern, whether that concern is material, or what control response is actually required.
That weakens the risk-based approach.
Materiality should drive the response
Not every uncertainty requires escalation.
The more important consideration is whether the uncertainty affects the institution’s ability to understand or manage ML, TF, PF or sanctions risk.
Material uncertainty may affect the institution’s ability to:
- identify or verify the customer;
- establish beneficial ownership or control;
- understand the purpose and intended nature of the relationship;
- understand expected customer activity;
- assess source of funds or source of wealth where relevant;
- assess sanctions or geographic exposure;
- identify PEP/PIP exposure;
- evaluate adverse information;
- identify proliferation financing indicators; or
- detect unusual or suspicious activity.
Where the uncertainty is material, the institution should act.
Where it is immaterial to the financial crime risk assessment, unnecessary escalation may add operational complexity and customer burden without improving the control outcome.
The risk-based approach is not a requirement to eliminate every inconsistency or information gap.
It requires institutions to understand and manage material risk.
Different uncertainty should produce different responses
A more disciplined approach is to distinguish between different types of uncertainty.
Administrative uncertainty may simply require information to be corrected or refreshed.
Immaterial uncertainty may be documented while the customer continues to be managed through standard controls.
Material but resolvable uncertainty may justify a targeted information request or clarification.
Material uncertainty that cannot be resolved may justify escalation, enhanced review, restriction or potentially a higher-risk classification.
Where the available facts begin to create suspicion of money laundering, terrorist financing, proliferation financing, sanctions breaches or other criminal activity, the matter moves beyond customer-risk classification and into investigation and reporting considerations.
This is more precise than simply assigning the customer to medium risk and leaving the underlying issue unresolved.
Do not transfer institutional uncertainty to the customer
Poorly designed customer-risk models can have direct consequences for customers.
An uncertainty-driven medium-risk classification may result in:
- additional information requests;
- repeated document submissions;
- longer onboarding periods;
- shorter review cycles;
- increased transaction scrutiny;
- source of funds or source of wealth requests;
- account restrictions; and
- repeated requests that the customer may struggle to understand.
These measures may be appropriate where the underlying risk justifies them.
They are much harder to defend where the real cause is incomplete data, weak methodology, unclear system logic or defensive decision-making.
In these circumstances, the customer effectively bears the cost of institutional uncertainty.
A more proportionate approach is to identify the specific information gap and request only what is necessary to resolve that risk-relevant issue.
Customer impact should not be a reason to weaken controls.
It should be a reason to make those controls more targeted and proportionate.
The medium-risk population can distort management information
The problem is not limited to individual customer outcomes.
A large medium-risk population can also distort management information.
On paper, an institution may appear to have a sophisticated risk distribution across low, medium and high-risk customers.
In reality, a large proportion of the medium-risk population may reflect unresolved uncertainty, inconsistent analyst decisions, system defaults or data-quality weaknesses.
This can prevent Boards and executive management from understanding the true risk profile of the customer base.
It can also consume significant compliance resources.
Teams may spend time managing a broad population of medium-risk customers while genuinely high-risk relationships receive insufficient focus.
Risk classification should support prioritisation.
If an intermediate category obscures where the material risk actually sits, it may be weakening rather than strengthening that prioritisation.
A GN7B-aligned approach to uncertainty
A more disciplined risk-based approach treats uncertainty as an issue to be assessed rather than an automatic category.
Institutions should:
- identify the specific uncertainty;
- establish whether it is relevant to ML, TF, PF or sanctions risk;
- assess its materiality;
- determine whether it can be resolved;
- obtain targeted clarification where appropriate;
- escalate where material uncertainty remains unresolved;
- avoid simplified treatment where higher-risk indicators or suspicion are present;
- document the rationale; and
- monitor the outcome.
The focus should remain on the specific risk created by the uncertainty and the control necessary to address it.
This creates a more direct relationship between the information gap and the response.
Risk flags may provide a more targeted alternative
In some environments, risk flags may be more useful than assigning a customer to a broad intermediate category.
A risk flag identifies a specific issue while allowing the institution to apply a targeted response.
Examples could include:
- adverse media;
- PEP/PIP exposure;
- sanctions proximity;
- complex ownership;
- higher-risk jurisdiction exposure;
- proliferation financing exposure;
- unusual activity;
- data-quality concerns; or
- unresolved material uncertainty.
A customer could remain within the standard-risk population while a specific issue is investigated or corrected.
For example, a data-quality flag may require information to be refreshed without changing the broader customer-risk classification.
An adverse media flag may trigger targeted review.
A sanctions proximity flag may require specialist escalation.
This can produce a clearer audit trail because the institution can show exactly what issue was identified and what control was applied.
Risk flags should not, however, be used to avoid high-risk classification where enhanced treatment is genuinely warranted.
Their purpose is to support precision, not under-classification.
Practical examples of a more targeted approach
Consider a customer whose contact information is outdated, but whose identity is verified, activity remains consistent and no other risk indicators are present.
That is primarily an administrative issue. Correcting the information may be sufficient.
Now consider adverse media that appears to relate to a customer, but where the identity match is uncertain.
That requires targeted review. If the concern is resolved, escalation may not be necessary. If the information remains unresolved and material, additional treatment may become appropriate.
A corporate customer with layered ownership across multiple jurisdictions and unclear beneficial ownership presents a different issue.
The uncertainty is material because the institution cannot adequately understand ownership and control. Additional verification and escalation may therefore be required.
The same principle applies to customers whose actual transaction activity materially differs from their stated expected activity, or businesses dealing in goods with potential dual-use applications where information about counterparties, end users or destination jurisdictions is incomplete.
The control response should follow the nature and materiality of the uncertainty.
Governance and inspection defensibility
An institution using a medium-risk category should be able to explain precisely why that category exists and what it achieves.
That includes being able to demonstrate:
- how medium risk is defined;
- how it differs from standard or high risk;
- which controls apply;
- how customers enter and leave the category;
- whether the category represents defined risk or unresolved uncertainty;
- how staff are trained to apply it;
- how customer impact is considered;
- how the medium-risk population is monitored; and
- what management information is provided to executive management and the Board.
The existence of an intermediate category does not automatically strengthen the regulatory position.
A poorly defined medium-risk category may itself become a vulnerability.
The institution should be able to demonstrate why a particular customer received a particular classification and how that classification changed the control response.
Where that connection cannot be evidenced, the methodology may require refinement.
The FCRMC view
FCRMC’s position is not that medium risk should be removed from every customer-risk methodology.
Medium risk can be entirely defensible where it is clearly defined, consistently applied and linked to a distinct, justified and measurable control response.
The concern arises when medium risk becomes a safe haven for uncertainty.
A customer should not be placed into an intermediate category simply because staff or systems cannot determine whether standard controls remain sufficient or enhanced treatment is required.
The more disciplined approach is to identify the uncertainty, assess its materiality, apply targeted clarification, escalate where necessary and document the rationale.
The principle is straightforward:
Do not classify uncertainty. Analyse it.
A mature customer-risk framework should distinguish between:
- defined risk indicators requiring enhanced treatment;
- uncertainty requiring targeted clarification;
- administrative gaps requiring correction;
- immaterial uncertainty manageable through standard controls; and
- suspicion requiring investigation and potential reporting.
This supports better risk outcomes, stronger governance, more proportionate customer treatment and greater regulatory defensibility.
Better classification requires better analysis
Medium risk is not inherently problematic.
The problem is what the category may conceal.
Where medium risk is used as a substitute for analysis, the institution may end up with a model that appears sophisticated but does not meaningfully improve risk understanding or control effectiveness.
A more mature approach focuses on the underlying issue.
Material uncertainty should be investigated and resolved where possible.
Immaterial uncertainty should not automatically result in additional customer burden.
Unresolved material uncertainty should be escalated.
Suspicion should be investigated and considered within the appropriate reporting framework.
The objective is not to force every customer neatly into a label.
It is to understand the risk well enough to apply the right control.
Read the full FCRMC white paper
This article provides an overview of White Paper 3 in FCRMC’s customer-risk classification series: A Safe Haven of Uncertainty – When Medium Risk Becomes a Default Category.
The full paper explores the distinction between risk and uncertainty in greater depth, examines the operational and customer consequences of uncertainty-driven classification, provides a practical uncertainty decision framework, considers the use of risk flags and sets out diagnostic questions and recommended actions for Boards and executive management.
To receive the full white paper, contact FCRMC.
This publication forms part of FCRMC’s wider thought-leadership series examining customer-risk classification and the practical application of the risk-based approach.
Keep an eye out for the next paper in the series as we continue exploring how institutions can build customer-risk methodologies that are proportionate, operationally meaningful and capable of being defended in practice.