Customer Risk Scoring Model
Customer risk rating is not a table of points. It is the rule by which a firm decides how deeply to check a person or a company and how closely to watch what they do.
- Duration
- Three to six weeks
- Format
- Remote
- Result
- Methodology, working model and a test on a sample
How this differs from the enterprise risk assessment
The enterprise assessment answers what the firm as a whole is exposed to. Customer risk rating answers what to do with a particular customer here and now.
The order between them is not a matter of taste. First the firm's risk profile is understood, and the customer factors, weights and thresholds follow from it. Scoring built without that foundation looks convincing right up to the first question about why the weights are what they are.
What the model is made of
A working model is several connected parts, and a missing one shows immediately.
- Risk factors for the customer, their activity, geography, product and acquisition channel.
- The scale and the weights, meaning the rule that turns factors into a final level.
- Risk levels and what follows from them, from due diligence depth at onboarding to how often the rating is reviewed.
- Rules for changing the level when customer behaviour or external circumstances change.
- The procedure for departing from the model, when a decision is taken manually, and the trail that decision leaves.
How the model scores one customer
| Factor | This customer | Points |
|---|---|---|
| Customer | Legal entity, non-resident | 15 |
| Activity | Digital asset exchange | 20 |
| Geography | Higher-risk jurisdiction | 20 |
| Product | Cross-border transfers | 8 |
| Channel | Remote identification | 5 |
| Total | 68 | |
High risk. Enhanced due diligence at onboarding and more frequent review of the rating.
The last item on the list is easy to skip, and inspectors ask about it readily. Lowering a rating by hand without an explanation devalues the whole model.
How the work runs
We start from your customer base and your products, not from a template.
- We study the business model, the mix of customers, the geography and the channels.
- We assemble the list of factors and agree the scale.
- We run the model against a sample of real customers and look at how the levels are distributed.
- We calibrate weights and thresholds so that high risk is neither diluted nor assigned to every second customer.
- We describe the model so that an analyst can apply it and an outside reader can check it.
- We help move the rules into your system or spreadsheet and verify that the move did not distort the logic.
Automation
Automation pays off where the rules have already settled. We prepare a description of the logic in a form that can be moved into a system, help brief your developers or your vendor, and check the result against control cases.
We do not sell software of our own, and that is deliberate. We describe the logic and verify how it behaves in the tool you already use.
What you get
Customer risk methodology
A document with factors, weights, levels and the review procedure, ready to be annexed to your internal control rules.
Working model
A working file or a description of the logic for moving into your system, with control cases.
Results of the sample test
How risk levels fall across real customers, and why the thresholds sit where they sit.
Application procedure
Instructions for staff, including the rules for manual decisions and how to document them.
Timing
Closer to the lower end when the enterprise risk assessment already exists and the customer base is uniform. Closer to the upper end when the model is built from scratch and tested on a large sample.
Frequently asked questions
We have a table of points. Is that enough?
A table is part of a model, not the model. An inspector wants to know where the weights came from, what happens when customer behaviour changes, and how manual decisions are recorded.
Can scoring be built without the enterprise risk assessment?
Technically yes, but there will be nothing to justify the choice of factors and weights. We say so at the start and suggest closing the enterprise assessment first.
Would an off-the-shelf industry model do?
As a starting point yes, as an end point no. Identical weights for a payment institution and a crypto platform mean the model reflects neither.
Do you implement it in our system yourselves?
We describe the logic, brief your team or your vendor, and check the result against control cases. We do not build the system for you.
What does it cost?
The fee depends on the size and uniformity of the customer base, on whether the enterprise risk assessment exists, and on whether help is needed to move the model into a system. We name an exact figure after a short conversation.
Shall we look at your case?
Tell us the task and we will say whether it needs the full piece of work or a narrower one.
Book a consultationNorthhold Advisory is an independent consultancy. We are not affiliated with, and do not represent, the AFM of Kazakhstan, the AIFC (AFSA) or the National Bank of Kazakhstan.