The regulators have been critical of our overall risk assessment process and while we successfully pushed back on our a number of things we did agree to transfer ownership to the AML Department and to revise our scoring methodology.

My question relates to how others are coming up with the final rating. I plan to keep high, medium, and low (Ratings of three, two, and one, respectively) and I'm leaning towards taking the sum of each category score and dividing it by the total categories. Is anyone taking this approach? If so, how are you determining the score ranges for high, medium, and low for the final rating?

If you're doing something different, I would be interested in hearing about it (Posted hear or through PMs).

It really might depend on the categories that you are scoring. I can think of some categories that if scored a 3 would make the customer high risk regardless of what other categories that you might consider. What you are suggesting would only probably work if all categories had the exact same level of risk.

I'm not sure I follow Randy? We have higher risk customers but we believe that our controls mitigate inherent risk from a three down to a two (Residual Risk). Maybe I'm misunderstanding your post?

Our regulators also were critical of the H-M-L levels and recommended a 1-2-3 scale. I use this method but also review each category and its mitigation in my scoring of each - documenting of course. So far no questions at the last 2 exams.