Explainable risk assessment

A risk score is a way to prioritise work. It is neither a permanent label on a person nor evidence of a crime. In a financial relationship, distinguish inherent risk arising from customer features, product, delivery channel and geographic activity from residual risk after institutional controls. Do not reduce a rating because an analyst feels comfortable; identify a control that actually operates and can be evidenced. A customer may be lower risk on one factor and higher on another. A single category without its factors hides the reason for the decision. FATF Recommendation 1 calls for risks to be identified and understood and for measures to be proportionate. The weights and numerical categories below are a fictional institutional training model, not a formula prescribed by FATF or any regulator.

Define the unit of assessment before calculating anything. Are you assessing a customer relationship, a product, or one transaction? Here the unit is the relationship at onboarding. The four factors are ownership complexity, product pattern, delivery channel and geographic activity. Assign each a rank of 1, 2 or 3 against written criteria, and use weights adding to 100%. Rank 3 is not mathematically three times as risky as rank 1; the ranks order judgments. A decimal score cannot rescue an unsupported classification. A reviewer needs to see which fact and document justify each rank.

An unknown factor may change the category. If control documentation is unavailable, do not assign ownership a 1 on the ground that no complexity has been observed. The fact is missing. Mark it unverified, ask for the evidence and show a sensitivity interval: the lowest total with rank 1 and highest with rank 3. If that interval crosses a category boundary, the low category cannot be accepted before the fact is resolved or an authorised exception is recorded. If the whole interval stays within one category, that does not waive a required document. It shows only that uncertainty about this factor does not change the model's category. A missing document and a small numerical effect are different issues.

After assessing inherent risk, examine controls. Independent identity verification, monitoring of activity, or senior approval may reduce exposure if they are well designed and actually carried out. Do not deduct a generic 'control point' merely because the policy lists a control. Look for an execution log, coverage of the relevant channel, alert delay and known failures. If a control fails in a sample, its effect has not been established. Use a bounded residual-risk statement such as 'reduction of exposure in this scenario is not yet evidenced' rather than inventing another number. The policy owner defines categorisation and escalation thresholds. The specialist applies the approved version and records exceptions.

Test the model's sensitivity to weights too. Suppose ownership has a 35% weight, product 30%, channel 20% and geography 15%. This model gives ownership complexity more influence than location. If the model owner changes the geographic weight following a periodic assessment, some customers may change category even when their behaviour has not changed. Separate fact changes from model changes in the review log. Do not quietly increase a factor's weight for one case because you prefer a particular answer. To add a factor, test the effect on a relevant population, record denominators and missing data, and seek approval of the model change rather than editing the customer worksheet in isolation.

Higher risk does not automatically mean rejection. Select a measure suited to the source of exposure and the ability to control it, subject to applicable local law and institutional policy. Complex ownership may call for additional control documents and independent review. A remote channel may call for stronger verification. Do not replace this analysis with blanket exclusion of a social or geographic group. FATF's updated financial inclusion guidance emphasises proportionate controls based on assessed risk and explains how excessive caution may exclude legitimate users from regulated services. Equally, a customer's need for inclusion does not itself establish low risk. Compare facts and controls, not the slogans 'low' and 'high'.

Before approving a worksheet, have another reviewer recalculate it from the inputs. Check that weights sum to 100, ranks use the current factor definitions, the category comes from approved policy, and Arabic and English accounts communicate the same decision. Then read the explanation: 'Ownership rank 3 is provisional because control records are incomplete; the assessment must be revisited when the agreement arrives.' If each rating cannot be traced to evidence, the score is not reviewable. A separate suspicion indicator follows its escalation path immediately; it should not wait for completion of a scoring worksheet.

مخصوصة / Specific review

Run one more sensitivity check before submitting the score: lower only the channel rank from 2 to 1 while other facts stay fixed. The difference equals the channel weight, showing which assumption crosses a category boundary. Ask whether channel evidence actually changed; without new evidence, the alternative is a diagnostic, not the approved result. Record the version of the ranking table because a category's definition may change. A similar product name does not justify copying another customer's score when ownership, purpose and expected activity differ.