Small community bank has recently discovered it has lots of accounts (both deposit and loan) on its core system where the Risk Rating (BSA) field was never completed. Some of these accounts date back to the 1980s but I'm not too concerned about the checking account that has been on the system without a RR since 1980. However, ther are a number of accounts new to the system, 2021 opening dates, which also do not have risk ratings.

There are some individual accounts - both transactional and loan accounts - and some business accounts, e.g. accounting service, church, apartments management, etc. Any good rule of thumb as to how far back a bank shoudl go in trying to clean-up the emply risk rating field and shouild they focus on non-personal accounts? FYI - the bank doesn't have any automated software so risk rating is an entirely manual process. Thanks in advance.

Sounds like the risk rating might be a worthless endeavor. What is done with these risk ratings? Most of the time a customer is risk rated at the customer level and not at an account level. A customer has a risk - individual accounts do not. Just plugging something in an available field is not a solution without more background on the overall goals here.

Does not having a Risk rating in the "field" equate to not reviewing these accounts? Since it is not automated someone could have conducted it manually. (at least on the old ones)


"t I'm not too concerned about the checking account that has been on the system without a RR since 1980."

Long time customers go bad all the time. There is a lot of financial hard time and desperate long term customers could have financial issues that you may uncover during these reviews.

Great points Mr. Carey and edAudit. Unfortunately there is no automated system such as Verafin that might throw off alerts or from which we could otherwise glean some type of score. Good point Randy for discussing rating at the customer versus account level.

The bank uses a 3 point system where a "1" is a low risk customer and a "3' is a high risk customer. The 1s stay 1s unless there is activity such as SARs filed, unexpected CTRs, high wires usage, etc. The 2s are Moderate Risk and have their accounts reviewed every 12-24 months, per bank BSA Policy, for unusual transactional activity whereby they could be moved into the "3" category or they could be moved down to a "1" since their account is now more seasoned and their activity is commensurate with what was indicated at account opening.

My concern with leaving the Risk Field blank, in addition to criticism from our regulatory friends, is that some of these accounts, non-profits, automobile dealership, etc perhaps should have have been rated as "2" which needsome type of periodic review. in particular, I don't like seeing the auto dealer with no risk rating and that concern also extends to a professional service provider such as a local accounting business.

There is no initial documentation to show expected types or amounts of transactions so my initial thought is to pick out the higher risk asccounts, auto dealer and accountant and perhaps non-profits and rate them as a '2' on a provisional basis where they undergo their first review in a year but otherwise rate the John Doe individual checking account as a "1" unless there is complelling info such as unexpected CTRs, purchased of numerous monetary instruments, SAR of course, etc.

Any additional thoughts would be helpful. I guess my biggest question is whether banks have gone into their databases and tried to assign everyonoe a risk rating, even those accounts that date back to the 1980s.

Have a great day everyone.