so just because there are identified high risk businesses - lawyer / auto dealership - does that mean we HAVE to put them on the high risk list?
i have never been questioned as to why customers in these categories have not been on my list before so my thought is they are simply guidelines an to just be aware.

comments?

I am going thru my list right now because previously we were not using the list provided to us by our AML provider. Just because they are identified as a high risk business, they may not necessarily be a high risk customer and with good notes, you can lower their risk so that only the ones who are truly high risk are on your list. Also make sure your BSA policy lines up with what you want on your high risk list.

There is no federal guidance out there that states lawyers, car dealers, etc. are high risk across the board. Not all law firms present the same level of risk and the same can be said for almost all types of businesses.

What you should have is a tested and tuned risk rating methodology which allows you to identify high risk customers based on multiple factors and not solely on the type of business they engage in.

When I teach BSA webinars and conferences, my standard joke is, "If you make every customer who fits one of the higher risk criteria in the Manual high risk, you end up with high risk Girl Scouts as an NGO. Granted they may put addictive elements into those cookies, but that doesn't make them high risk."


Nature of business is one risk factor to consider when evaluating risk, but you should also consider other risk factors such as frequency and volume of activity (cash, ACH, wires, etc.). Also consider geography of the business, the geography of its customers and the geography of its transactions. You may also consider whether it uses higher risk products such as ACH origination or RDC.

To avoid being criticized for making subjective decisions about risk, having some type of matrix, whether manual or automated =, that is customized based on your risk profile can be helpful.

We are going through this nightmare right now. We had an existing risk scoring place in process before I got here which included a short questionnaire but never a standardized model. The selection of the customer's risk score was subjective and it was reviewed by me, the BSA Officer, as a 2nd review. This was purely based on experience. Although the examiners wouldn't tell us how to get to the correct end product, they basically forced us into a standardized scored KYC questionnaire. Those high risk business types as mentioned above, are included in my job aid that front line employees use.

all very appreciated feedback - we don't have a "risk rating model", nothing standardized, outside of our CIP form utilized at account opening. as the BSAO, i review the risk rating which was assigned and rely on my experience and other similar businesses. i agree geography plays a larger roll. i like the Girl Scout analogy. maybe it's time to do some sort of matrix so we have a rational behind why we rate what we do.