If you are using the list of high risk businesses, they list restaurants, grocery stores, etc.etc. So, does this mean that we would be expected to list all restaurants...all car dealerships, etc.? If not, how have you "risked out" certain businesses within a group? Ex. a McD's franchise compared with a sole prop. restaurant?

You should identify all customers classified as high risk by the regulatory agencies as well as those ineligible for exemption from CTR filing. How you rate them in terms of risk is a secondary issue, you must first identify them.

Using the recent regulatory guidance on MSBs as an affirmation of this concept, you can consider factors which would tend to limit the risk posed by a particular customer. Your example is good, a franchise restaurant should pose less risk of being used to launder money than a stand alone operation. That, combined with a long term relationship with your institution and no suspicious activity noted during that period, might reduce their risk rating. Assuming your institution uses a five point scale with 5 being the highest level of risk, the restaurant's rating might drop from a 5 to a 3 (average risk).

In my opinion, it is not reasonable to conclude that any combination of factors could reduce the risk level to a "1" or a "2." In addition, I would not think it reasonable to assign any restaruant a rating below "5" at account inception. You should have some experience with the customer before you claim there are mitigating factors.

After grouping the accounts I took the 'Cash Intensive' ones, which includes restaurants, and downgraded those that are not really cash intensive, such as the more expensive restaurants that in reality have little cash.
I further downgraded those restaurants that were really well known in the area, long established etc.