We have already risk rated our commercial customers but are now needing to risk rate our consumer accounts.

Could I please have some input as to the criteria anyone uses to risk rate your consumer accounts?

Thanks!

I think if you look at those consumer customers who conduct international activity, you frequently file CTRs on, have filed a SAR on, send a lot of wires, have cross-border ACH transactions, live outside of the bank's primary trade area, non-resident aliens, etc. all would be criteria to enhance a consumers risk rating.

So, do you not conduct a risk rating on ALL consumer accounts?

The only types of individual accounts identified in the examination manual as being subject to "expanded examination overview" are non resident aliens, foreign individuals, and politically exposed persons. I would suggest that your process must identify those customers at account inception and specifically assess their risk.

Notunter...'s supplementary suggestions are reasonable and it's worth noting that most of them are based on activity not status. (They will be identified by due diligence efforts conducted after account opening.)

As a matter of opinion, I would risk rate all consumer customers only after I had lost a significant, bloody battle with the on-site examination staff. The practice is a pathetic waste of time and is based entirely on supposition... Allocate the bulk of your resources where you are most likely to find something.

The rating of the consumers is now a part of our opening account process - just another field to input a 1, 2 or 3.
It has not been a burden to the staff.
All consumers are a 1 unless they are a Non US Person, a PEP or if they state in the opening process that they will have foreign wire activity.
When I review relationships, I will put the personal accounts of attorneys and CPAs to a 2, which is the risk rating I have for them on the commercial side.
This is to assist me with my BSA software when I review activity by industry.
It allows me to capture both the personal and business activity for the group.

Thanks for all your responses.

I guess that I have talked with numerous other banks and they have risk rated ALL their accounts (not just PEP's, Non-resident, etc.). Gosh, if we honestly do NOT have to risk rate everyone, Great!

We are an FDIC bank - have any other FDIC'ers out there have any recent exams they could comment on?

KP ... I definitely agree with your concept of resource allocation ... it's too bad that "theory" does not intersect with "reality" more often ... outside forces do not always allow this to happen ...

Anyway ... like cinbo ... I also was under the impression that the entire database had to be risk-rated in regard to the CDD program. The CDD core exam overview and procedures respectively state that processes should be in place for the following: (1) ongoing due diligence of the customer base; and (2) identification of changes to customer risk ratings and profile. Can a bank have these processes in place if the entire database has not been risk-rated already? Or am I simply mis-interpreting the exam manual?

We have our system default to a 1 for consumers and then if they are identified as a NRA, PEP, or foreigner they are rated higher. With our CDD program we have individually rates some customers (unusual foreign wires,unusual cash activity)as a higher risk based on activity,etc

I can't find one of your phrases in the manual, but here's the other:

The concept of CDD begins with verifying the customer’s identity and assessing the risks associated with that customer. Processes should also include enhanced CDD for high-risk customers and ongoing due diligence of the customer base.

Consumer customers, absent an objective, relevant characteristic that sets them apart, e.g. being an NRA or frequently sending wire transfers, are fungible; they represent a single level of risk, not two or three. (Some other relevant status and experiential characteristics are mentioned earlier in this thread.) As Magic City suggests, rate them all a 1 unless you have a tangible reason to rate them higher, but don't go through some painstaking analysis.

Whether the consumer is a factory worker, police officer or a pharmacist is not a basis for a risk rating. Whether he makes $45,000 or $345,000 a year is not a basis for a risk rating. Neither is whether he lives 4 miles or 4 blocks from his branch or gets paid by check rather than direct deposit.

After account opening, the due diligence necessary for consumer customers consists of reviewing daily reports looking for transactions that just don't fit consumers, not a single transaction that doesn't fit this consumer. Consumer activity is so generic that aberations worth investigating will show up on daily reports...you consider upgrading a consumer's risk rating when you find her on one of those daily reports.

The Manual consistently focuses on the identification of potentially high risk customers. There is no suggestion that every customer must be individually evaluated, that belief belongs to individual examiners who really don't grasp the concepts. I believe in meeting regulatory expectations whenever and wherever possible, but not when common sense says it's a misallocation of resources.

I'm not campaigning for bankers not to risk rate every account. (A "default" rating of "1" is no different than not rating them at all.) I'm just asking bankers to think about it critically rather than marching in lockstep with what one banker (unnamed) was told by one examiner (also unnamed).

KP ... your blue-text excerpt includes one of the phrases (... customer base...) and Core Exam Procedure #2 (Page 59 of the manual) includes the other phrase.

Regardless ... I definitely agree with your thoughts and with Jerseygirls' default rating process unless circumstances dictate otherwise. And by leaving a customer rating at 1 ... the bank actually has made an evaluation of that customer - IMO - by not increasing the rating ...

I've seen national and state examiners make the recommendation to Texas community banks that you referenced ... but the banks did not want to fight the battle and simply used the process described by Jerseygirl.

To further discuss this topic....

Page 18 of the revised manual states that the Risk Rating process is a two steps: 1 "Identify the specific risk categories (i.e products, services, customers, entities, and geographic locations". This first step clearly states that all we have to do is IDENTIFY any potential risks. The criteria to be used on this first step is based upon your FI assets size, products, services, geographic locations, and so forth. In other words, we do not need to individually assess every customer, but simply identify any potential risk.

step 2 "Conduct a more detailed analysis of the date identified to better assess the risk within these categories" This step requires analysing the data collected from step one. Example: If in step one we identified that wire transfers is a high risk product, then we need to review wire transfer activity to better identify those customers utilizing this service. Furthermore, we need to take into consideration" Frequency, domestic/foreign, consumer/business, $ amount, countries involved, and so forth......I'm sure that once we reviewed the information collected, we'll be able to identified certain customers performing wire transfers in a high pace, $amount, and with/without business purpose.

To summarize in step one we identify the risks, step two we analyze the data collected....It does not make business sense to individually assess every single customer that you have (whether you have 2 thousands or 2 million customers).....

I know a bank that used the rationale that if the account does NOT have a risk rating, then the account is considered Low Risk. That eliminated the need to go back and code ALL of the accounts in their database. As far as I know, the examiners were okay with that.