AT A GLANCE
RIAs must implement risk-based AML programs by January 2028, with client risk scoring as a core component. FinCEN’s 2028 AML Rule for RIAs under Bank Secrecy Act requirements, meaning RIAs must implement risk-based AML programs just like banks. A risk scoring model assigns numerical values to factors like client type, geography, source of funds, PEP status, and expected activity. Scores determine risk tiers (low, medium, high) that dictate due diligence intensity and monitoring frequency. Modern AML platforms like Flagright automate risk scoring with AI-enhanced analytics, making compliance achievable for firms of all sizes.
What Is Customer Risk Scoring and Why Does It Matter for RIAs?
Customer risk scoring is a systematic process that assigns numerical values to various client risk factors to produce an overall risk rating that determines how intensively the firm monitors and manages that relationship. Rather than treating all clients identically, risk scoring differentiates between a straightforward U.S.-based individual with transparent salary income and a complex offshore entity with unclear beneficial ownership.
Risk scoring for investment advisers . First, FinCEN's 2028 rule mandates that RIAs implement risk-based AML programs. Regulators explicitly expect firms to identify higher-risk customers and apply commensurate controls. Without formal risk scoring, you cannot demonstrate a risk-based approach during SEC examinations.
Second, risk scoring enables efficient resource allocation. Compliance teams cannot apply the same intensive scrutiny to every client. Risk scoring identifies where to focus efforts, ensuring – on high-risk clients and activities receive enhanced due diligence while low-risk clients move through streamlined processes.
Third, effective risk scoring significantly improves your ability to detect money laundering and terrorist financing. When you understand each client's risk profile, unusual behavior becomes more apparent. A $50,000 wire transfer might be perfectly normal for a high-net-worth client but highly suspicious for someone whose expected activity is modest retirement account contributions.
Understanding FinCEN's 2028 AML Rule for RIAs
In August 2024, FinCEN issued its final rule extending AML/CFT requirements to SEC-registered investment advisers. This historic change ends a long-standing gap in AML coverage and brings RIAs under Bank Secrecy Act requirements beginning January 1, 2028.
The rule requires RIAs to develop written, risk-based AML compliance program that include customer due diligence procedures, suspicious activity monitoring and reporting, internal controls, compliance officer designation, employee training, and independent testing. The emphasis on "risk-based" means your program must identify and focus on RIA’s AML program must be risk-based, with special focus on higher-risk clients.
How Can I Build a Risk Scoring Model Using Financial Behavior Data?
Building a risk scoring model using financial behavior data involves identifying relevant risk factors, collecting accurate client information, assigning numerical weights to each factor based on its risk significance, calculating total scores, and mapping those scores to risk categories that trigger specific due diligence requirements. This step-by-step approach creates a defensible, consistent methodology.
Step 1: Identify Key Risk Factors
Start by defining which client characteristics correlate with money laundering risk. The factors you choose should reflect both regulatory guidance and your firm's specific risk environment.
Client type and structure matter significantly. Individual clients with straightforward backgrounds present baseline risk. Business entities require more scrutiny, particularly those with complex ownership structures, shell companies, or cash-intensive operations.
Geographic risk factors are critical. Clients located in or transacting with FATF-identified high-risk jurisdictions, countries with weak AML enforcement, or sanctioned territories all elevate risk substantially.
Source of wealth and funds provides essential context. Transparent sources like verified employment income or documented business revenue are low risk. Unclear sources, cash-based wealth, or funding from high-risk jurisdictions increase risk.
Occupation and industry influence risk assessment. Politically exposed persons (PEPs), their family members, and close associates automatically qualify as high risk. Industries like money service businesses, casinos, real estate, and cannabis businesses carry elevated risk.
Expected transaction behavior establishes your monitoring baseline. Consider anticipated account values, transaction frequency and volumes, types of transactions expected, and geographic areas of activity.
Step 2: Collect and Validate Client Data
Effective risk scoring requires accurate, comprehensive information. During client onboarding and periodic refreshes, gather complete identification details, occupation and industry information, source of wealth and funds documentation, country of residence and citizenship, expected account activity parameters, beneficial ownership information for entities, and screening results for sanctions, PEPs, and adverse media.
Data quality is paramount. Inaccurate or incomplete information skews risk scores and undermines your entire model. Establish verification procedures using reliable databases for country risk assessment, official registries for entity verification, and reputable screening services for PEP and sanctions checks.
Step 3: Assign Weights and Values to Risk Factors
Design your scoring methodology by assigning point values to each risk factor based on its significance. Most models use simple numeric scales where higher numbers indicate higher risk. A common approach uses 1-3-5 scoring: 1 point for low-risk characteristics, 3 points for medium-risk characteristics, and 5 points for high-risk characteristics.
Sample Risk Scoring Matrix:
Client Type:
- U.S. regulated financial institution = 1 point
- Standard individual or established business = 3 points
- Shell company, cash-intensive business = 5 points
Geography:
- U.S. or FATF member with strong AML controls = 1 point
- Moderately risky jurisdiction = 3 points
- FATF high-risk country or sanctioned region = 5 points
Source of Funds:
- Verified salary, public company proceeds = 1 point
- Partially documented or mixed sources = 3 points
- Unclear sources, significant cash, offshore trusts = 5 points
PEP Status:
- Not a PEP, no adverse media = 0 points
- Politically exposed person or significant adverse news = 5 points
Expected Activity:
- Low transaction volume, simple activity = 1 point
- Moderate volume or complexity = 3 points
- High volume, complex transactions = 5 points
Step 4: Calculate Scores and Calibrate Thresholds
Calculate each client's total risk score by summing points from all applicable factors. A client who is a U.S. individual (3 points) with verified salary (1 point), no PEP connections (0 points), and moderate expected activity (3 points) scores 7 points.
Map total scores to risk categories by defining thresholds:
- Low risk: 0-10 points
- Medium risk: 11-20 points
- High risk: 21+ points
Calibration is critical. Test your model on a sample of existing clients. If 60% score as high risk, your thresholds are too sensitive. If only 2% score as high risk but you know you have concerning relationships, your model is too lenient. Adjust factor weights or category thresholds based on testing.
Step 5: Define Risk Tier Actions
Each risk category should trigger specific due diligence and monitoring procedures:
Low-risk clients: Standard customer due diligence, annual risk reassessments, standard transaction monitoring thresholds.
Medium-risk clients: Enhanced documentation collection, semi-annual risk reassessments, more frequent transaction reviews.
High-risk clients: Enhanced due diligence including source of wealth verification, senior management approval, quarterly or more frequent risk reassessments, stricter transaction monitoring with lower alert thresholds, intensive investigation of any unusual activity.
What Factors Should Be Included in Customer Risk Rating?
Customer risk rating factors should include client type and structure, geographic risk, source of wealth and funds, politically exposed person status, occupation and industry risk, expected transaction behavior, beneficial ownership complexity, and adverse media or sanctions screening results. These factors collectively provide a comprehensive view of money laundering risk.
Client type and structure forms the foundation. Individual clients generally present lower baseline risk than entities, but this varies significantly. A straightforward individual professional differs substantially from an individual with complex international holdings.
Geographic factors significantly influence risk. Country of residence, citizenship, location of business operations, and jurisdictions where transactions occur all matter. Clients connected to FATF high-risk jurisdictions require enhanced scrutiny.
Source of wealth and source of funds distinction is important. Source of wealth explains how the client accumulated their total net worth. Source of funds explains where money for specific transactions originates. Both should be verified, particularly for high-value relationships.
PEP status automatically elevates risk. Politically exposed persons hold prominent public positions where corruption opportunities exist. This includes senior government officials, military leaders, executives of state-owned enterprises, and their immediate family members and known close associates.
Beneficial ownership and control must be understood for entities. Complex ownership structures with multiple layers, use of nominees or trusts, frequent ownership changes, or beneficial owners in high-risk jurisdictions all increase risk.
How Can RIAs Streamline AML Risk Scoring Across Customer Types?
RIAs can streamline AML risk scoring across different customer types by implementing standardized risk assessment frameworks that adapt to client characteristics, using technology to automate data collection and scoring calculations, creating customer type-specific questionnaires, and leveraging modern AML platforms that dynamically adjust risk profiles in real-time. Standardization doesn't mean treating everyone the same—it means having consistent processes that efficiently handle diverse client profiles.
Develop Type-Specific Assessment Templates
Create tailored assessment questionnaires for common client categories. Individual retail investors might complete a basic form covering occupation, income sources, and expected investment activity. Business entities require additional information about ownership structure, business activities, and revenue sources. Templates ensure consistent information collection while adapting to client complexity.
Automate Data Collection and Verification
Manual data entry and verification consume enormous time and introduce errors. Modern systems integrate with data sources to automate verification. Identity verification platforms confirm identities against government databases. Sanctions and PEP screening tools automatically check clients against global watchlists. PEP (Politically Exposed Person) status, adverse media, and so on.
Use Technology for Dynamic Risk Scoring
Traditional risk scoring evaluates clients periodically. Modern approaches use continuous or dynamic risk scoring where risk ratings update automatically as new information becomes available. When adverse media emerges about a client, their risk score increases immediately. When transaction patterns change significantly, the system flags this for review. Dynamic scoring ensures risk ratings remain current rather than becoming stale between periodic reviews.
How Does Customer Risk Scoring Improve Money Laundering Detection?
Customer risk scoring improves money laundering detection by establishing client-specific baselines that make unusual activity more apparent, enabling risk-based transaction monitoring that applies stricter scrutiny to higher-risk relationships, helping prioritize investigative resources on the most concerning alerts, and providing context that distinguishes legitimate unusual activity from genuinely suspicious behavior. Effective risk scoring transforms transaction monitoring from a one-size-fits-all approach to a targeted, intelligent system.
When you know a client's risk profile, you understand what "normal" looks like for them. A $100,000 wire transfer from a high-net-worth individual with established wealth might be routine. The same transaction from a client with modest expected activity raises immediate red flags.
Risk-based transaction monitoring uses client risk ratings to calibrate alert thresholds and sensitivity. High-risk clients might trigger alerts at lower transaction amounts than low-risk clients. This focused approach catches suspicious activity from risky relationships while reducing false positives from legitimate clients.
Investigation prioritization becomes more effective with risk context. When your monitoring system generates 100 alerts per week, you need a way to triage. Alerts involving high-risk clients naturally receive priority investigation. Understanding the client's risk profile helps analysts quickly determine whether flagged activity fits their expected pattern or represents genuine concern.
SAR filing decisions benefit from risk context. Suspicious Activity Reports require judgment about whether activity could involve illegal activity. A client's risk rating provides essential background. High-risk clients engaged in unusual activity warrant more aggressive SAR filing.
How Do You Integrate Risk Scoring with Transaction Monitoring?
You integrate risk scoring with transaction monitoring by using client risk ratings as input parameters for monitoring rules, calibrating alert thresholds based on risk levels, incorporating risk scores into alert prioritization and case assignment workflows, and creating feedback loops where monitoring findings trigger risk rating reassessments. Integration transforms both systems into a unified, intelligent AML program - it directly feeds into your transaction monitoring for RIAs, banks and suspicious activity reporting processes.
Risk-Based Monitoring Rules
Configure your transaction monitoring system to apply different thresholds based on client risk ratings. High-risk clients should face more stringent monitoring with lower alert thresholds, more sensitive pattern detection, broader geographic triggers, and shorter time periods for aggregation rules.
For example, your monitoring rules might flag wire transfers to high-risk jurisdictions when they exceed $10,000 for high-risk clients but only when exceeding $50,000 for low-risk clients.
Alert Prioritization and Assignment
Use risk scores to prioritize investigation queues. Many AML platforms allow risk-based alert routing where high-risk client alerts automatically escalate to senior investigators, while low-risk alerts might receive initial review by junior analysts.
Continuous Risk Profile Updates
Transaction monitoring findings should trigger automatic or prompted risk reassessments. When monitoring reveals activity significantly different from expected patterns, the system should flag the client for risk rating review. Material changes—new adverse media, sanctions list additions, significant transaction increases—should automatically initiate reassessment workflows. As McKinsey noted, modern approaches to customer risk rating integrate aspects of transaction monitoring and screening to identify high-risk customers far more effectively.
What Is the Best Practice for Ongoing Risk Assessment and Monitoring?
Best practice for ongoing risk assessment includes conducting periodic risk reassessments on schedules tied to risk levels, implementing trigger-based reassessments when material changes occur, maintaining continuous screening for sanctions and adverse media, documenting all risk rating changes with clear rationale, and regularly validating the risk scoring model. Ongoing assessment ensures risk ratings remain accurate as client circumstances evolve.
Risk-Based Review Frequencies
Low-risk clients: Annual or biennial full reassessments suffice. Focus reviews on confirming information remain accurate and no material changes occurred.
Medium-risk clients: Semi-annual or annual reviews are appropriate. Reviews should verify continued accuracy of risk factors and watch for any elevation in risk.
High-risk clients: Quarterly or more frequent reviews are essential. These intensive reviews verify sources of wealth and funds remain consistent, check for new adverse information, analyze transaction patterns for irregularities, and ensure all documentation remains current.
Trigger-Based Reassessments
Certain events should prompt immediate risk reassessment: significant transaction volume increases, changes in beneficial ownership, client expansion into new high-risk jurisdictions, adverse media reports, sanctions list additions, and unusual transaction monitoring alerts.
Documentation Requirements
Document every aspect of risk assessment and reassessment. Maintain records of initial risk scores and supporting factors, all periodic reassessments with dates and findings, trigger events that prompted off-cycle reviews, risk rating changes with detailed justification, and senior management approvals for high-risk relationships. FinCEN expects RIAs to demonstrate their risk-based approach through documentation.
Practical Tips for Building Your RIA Risk Scoring Model
Start simple and add complexity gradually. Begin with a straightforward model covering essential factors like client type, geography, PEP status, and expected activity. Once this foundation works reliably, add more nuanced factors. A simple model implemented well beats a sophisticated model that's too complex to maintain.
Document everything from day one. Demonstrating a documented risk scoring methodology shows regulators you are meeting the “risk-based” program expectations of FinCEN and the SEC. This documentation is your defense during SEC examinations.
Use your existing client base for calibration. Test your model on current clients before rolling it out. You likely have instinctive knowledge about which clients present higher concern. Does your model identify them? If not, adjust your weights and thresholds.
Build in flexibility for professional judgment. While consistency is important, allow experienced compliance officers to override model outputs when warranted. Document these overrides and the reasoning—they demonstrate thoughtful risk management.
Plan for the FinCEN 2028 deadline now. Starting in 2026 gives you time to build, test, and refine your model. Last-minute implementation in late 2027 will be stressful and likely produce a weaker program.
Consider technology solutions seriously. Building and maintaining a risk scoring model manually is extremely time-consuming. Modern AML platforms automate data collection, calculations, continuous screening, and documentation.
Leveraging Technology: AML Software for Investment Advisers
Implementing comprehensive AML programs challenges RIAs, particularly smaller and mid-sized firms. Purpose-built AML software for investment advisers addresses this challenge by automating risk scoring, transaction monitoring, screening, and case management. Flagright’s platform is designed to help RIAs quickly deploy a complete AML solution that meets the 2028 requirements Key capabilities include rapid deployment in days rather than months, ensuring you can establish compliance infrastructure quickly.
AI-enhanced risk scoring provides dynamic risk assessment that updates in real-time as new information emerges. The platform uses both rule-based logic and machine learning to identify patterns that static models miss. Risk profiles adjust automatically based on transaction behavior, screening hits, and external data.
Comprehensive transaction monitoring includes a high-performance rules engine with customizable scenarios tailored to investment advisory contexts. Machine learning augmentation reduces false positives while improving detection accuracy.
Automated watchlist screening checks clients continuously against sanctions, PEP, and adverse media databases. When screening hits occur, risk scores update automatically, triggering appropriate review workflows.
Integrated AML case management organizes alerts, client profiles, investigation notes, and documentation in a unified platform. Compliance analysts can escalate cases, document findings, and manage SAR filing workflows efficiently.
Audit-ready reporting provides dashboards showing risk tier distribution, alert volumes, investigation outcomes, and compliance KPIs. Comprehensive audit trails log all actions and changes, demonstrating program effectiveness to examiners.
Frequently Asked Questions
What is customer risk scoring in AML?
Customer risk scoring in AML is a quantitative method that assigns numerical values to various risk factors (like client type, geography, source of funds, PEP status) and calculates a total score that classifies clients into risk categories such as low, medium, or high risk. This classification determines the level of due diligence and monitoring intensity required.
How do you build a risk scoring model using financial behavior data?
Build a risk scoring model by identifying relevant risk factors, collecting accurate data on each factor, assigning point values based on risk significance (typically using scales like 1-3-5), calculating total scores for each client, defining category thresholds that map scores to risk tiers, and validating the model through back-testing and calibration.
What factors should be included in customer risk rating?
Customer risk rating should include client type and structure, geographic risk based on residence and transaction jurisdictions, source of wealth and funds, politically exposed person (PEP) status, occupation and industry risk, expected transaction behavior and volumes, beneficial ownership complexity, and adverse media or sanctions screening results.
How can RIAs streamline AML risk scoring across different customer types?
RIAs can streamline risk scoring by creating standardized assessment frameworks with customer type-specific templates, automating data collection and verification through integrated technology platforms, implementing flexible factor weighting that adapts to client characteristics, and using dynamic risk scoring that updates automatically as new information emerges.
How often should customer risk assessments be updated?
Update customer risk assessments based on risk levels: low-risk clients annually or biennially, medium-risk clients semi-annually or annually, and high-risk clients quarterly or more frequently. Additionally, conduct trigger-based reassessments whenever material changes occur such as significant transaction increases, ownership changes, adverse media, or sanctions additions.
What is the FinCEN 2028 rule for RIAs?
The FinCEN 2028 rule, issued in August 2024, extends Bank Secrecy Act AML/CFT requirements to SEC-registered investment advisers beginning January 1, 2028. RIAs must implement written risk-based AML programs including customer due diligence, suspicious activity monitoring and reporting, internal controls, compliance officer designation, employee training, and independent testing.
How does risk scoring improve money laundering detection?
Risk scoring improves detection by establishing client-specific baselines that make unusual activity more apparent, enabling risk-based transaction monitoring with stricter scrutiny on higher-risk relationships, helping prioritize investigative resources on the most concerning alerts, and providing context that distinguishes legitimate unusual activity from genuinely suspicious behavior.
What technology helps RIAs comply with AML requirements?
AML compliance platforms designed for investment advisers help RIAs comply by automating risk scoring with AI-enhanced analytics, providing transaction monitoring with customizable rules engines, conducting continuous sanctions and PEP screening, offering integrated case management for investigations and SAR filing, and generating audit-ready reports and documentation.
Can small RIAs implement risk scoring models effectively?
Yes, small RIAs can implement risk scoring models effectively by starting with simplified models covering essential factors, using modern AML software platforms that automate calculations and screening, focusing on clear documentation of methodology and decisions, and partnering with compliance technology providers that offer expert guidance and support throughout implementation.
What happens if an RIA doesn't implement AML compliance by 2028?
RIAs that fail to implement AML compliance by January 1, 2028, face regulatory enforcement actions from both FinCEN and the SEC, including substantial monetary penalties, operational restrictions or license suspensions, reputational damage affecting client relationships, and increased regulatory scrutiny with more frequent examinations and risk regulatory enforcement.
Conclusion
Building an AML client risk scoring model is essential for RIA compliance under FinCEN's 2028 rule. By implementing a structured approach that identifies risk factors, assigns appropriate weights, calculates scores consistently, and integrates with transaction monitoring, RIAs can establish effective risk-based AML compliance solution that satisfy regulatory requirements.
Starting now gives you ample time to develop, test, and refine your model before the mandatory deadline. Technology makes this achievable for firms of all sizes.
Ready to establish your RIA AML compliance solution? Flagright platform provides everything you need: automated risk scoring, transaction monitoring, screening, case management, and regulatory reporting. Contact us today to schedule a free demo.
