When I teach BSA webinars and conferences, my standard joke is, "If you make every customer who fits one of the higher risk criteria in the Manual high risk, you end up with high risk Girl Scouts as an NGO. Granted they may put addictive elements into those cookies, but that doesn't make them high risk."
Nature of business is one risk factor to consider when evaluating risk, but you should also consider other risk factors such as frequency and volume of activity (cash, ACH, wires, etc.). Also consider geography of the business, the geography of its customers and the geography of its transactions. You may also consider whether it uses higher risk products such as ACH origination or RDC.
To avoid being criticized for making subjective decisions about risk, having some type of matrix, whether manual or automated =, that is customized based on your risk profile can be helpful.
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!www.tcaregs.com