Currently using Yellow Hammer BSA software: Internal auditor recommended using NAICS codes for all business accts. I have assigned all "high risk" industry accounts with a score of "50", which automatically puts the customer in the high risk category; example-Real Estate Broker.

Should I leave the high risk assignment based solely on the industry or should I consider the account activity also?

Thank you.

Here's a link to the FFIEC section on Risk Assessment that you should find helpful, specifically the section on customers and entities.

http://www.ffiec.gov/bsa_aml_infobase/pages_manual/olm_005.htm

I wouldn't base the risk assessment on any single category, it should be a composite score based on several factors.

In yellow hammer you can set up peer groups with the use of the NAICS codes. Which will make monitoring transactions better, There is two separate areas to consider one is the customer risk rating and the other is transactional. It is confusing to try to explain in this (additionally as an auditor and not a user) but JHA can walk you through the scenarios. hopefully someone else will chime in.
But I agree with the NAICS codes as this will be the first step.

There are certainly high risk customers, but I encourage you that there is no such thing as a "high risk industry." Personally, I think the codes have the most utility in general banking and even marketing applications. They are helpful in BSA, but I would not implement their use solely for that purpose.

Appreciate all your input.

Should we be getting NAICS codes for loans or just transaction accounts?

We obtain them at the customer level. Not the account level.

Many if not most of the banks that use NAICS codes began using them first on the lending side. They are very helpful in identifying concentrations of credit. BSA was the secondary rationale for their use.

That is a true statement. When we first began obtaining them, we started by pulling all the ones we already had off the commercial lending system and uploading them to our global customer file. They were in a loan level field in Commercial Loans. It gave us a good start.

We assign a NAICS code to every single client regardless of the product. Our risk classification model incorporates industry via NAICS code groupings that have been previously established. However, no single variable causes a high risk classification.

Our risk classification model segments clients based upon higher risk industries and uses more aggressive thresholds to escalate client risk. For example, cash intensive businesses may be considered high risk based upon a specific amount of cash activity, while a generic lower risk business may be considered low or medium risk if they performed the same amount of activity.

Our automated risk scoring systems then imitate this model.