Determining High Risk Customers

Posted By: Compliance Lover

Determining High Risk Customers - 11/03/08 04:00 PM

I have several different samples regarding determining your high risk customers. Some show any type of high-risk business, such as check cashers, MSB's, restaurants, etc. should be on your high risk list. Others put them as moderate risk. Some models only have a high or a low to choose from. I've had an examiner tell me that not all MSB's would have to be considered high risk. What does everybody else do? I'm basically talking about what risk factor to assign the account at the time of account opening. How do you determine that?
Posted By: WonderWoman

Re: Determining High Risk Customers - 11/03/08 04:28 PM

We use a point system.

They get 5 points for Foreign Wires
3 points for being out of our servicing area ... etc ... etc ...

Then I have a provision in my policy that states we may upgrade or downgrade a risk at any time, based on the activity.

Not all of my MSBs are High and certaintly NONE of my restaurants are high risk ...
Posted By: Compliance Lover

Re: Determining High Risk Customers - 11/03/08 04:48 PM

But how do you rate them when the are a brand new account? Do you use your same system, just based on what is expected acvitity? Then adjust it later if needed? Do you use Low/Moderate/High tied to your numbers?
Posted By: WonderWoman

Re: Determining High Risk Customers - 11/03/08 06:13 PM

It's based on expected activity ...

PM me your email & I can chat with you more about it ...
Posted By: Kelsey D

Re: Determining High Risk Customers - 11/04/08 06:28 PM

I dump all of my potentially high risk businesses into one of two categories:

1) Moderate Risk - Business included in a potentially high risk category, yet is not classified as Potentially High Risk due to daily monitoring; or

2) High Risk - Business included in a potentially high risk category, classified as Potentially High Risk, and due to daily monitoring does not qualify for a reduced rating.

There are other categories as well, but these are the two that relate to the business types you're referring to (NBFI's, cash intensive businesses, professional service providers, etc.). The CSR's code all accounts at account opening.

I recently had an independent consultant recommend that I categorize all of these as high risk, but my Fed examiner disagreed. He liked that I had identified them but agreed that just because they're labled as potentially high risk, doesn't mean that they are in fact high risk.
Posted By: Kathleen O. Blanchard

Re: Determining High Risk Customers - 11/04/08 07:11 PM

I agree with your examiner. Those customers in high risk industries get additional attention at account opening, and may be tentatively classed as high risk pending activity review. If all activity is normal, they should not stay in a high risk category just because of their industry. You may want a code so that you can pull a list of your customers in certain industries, but you do not have to carry them as high risk because of that industry. That is an old concept that has changed in the past few years.
Posted By: Dolly Nugent

Re: Determining High Risk Customers - 11/05/08 12:33 AM

Your independent consultant is way behind the times. A few years ago we were told that customers engaged in certain types of businesses should be considered high risk. I can remember being told to used NAICS codes to identity our high risk customers. So we did and 98% of them didn't have activity that we considered suspicious.

We have since learned that this approach is not necessary. Just because your customer is in a line of business that is often used by money launderers doesn't mean your customer is high risk. Same goes for professionals like attorneys and CPAs, etc. They usually know the rules relevant to BSA recordkeeping and reporting, so they can do some funny things once in a while, but I would imagine that most of your customers in these professions do not have unusual activity on their accounts. So it makes no sense to classify them as high risk.

I would be concerned that your consultant isn't keeping up-to-date on BSA issues by attending seminars etc. You might want to ask about the consultant's training.
Posted By: Kathleen O. Blanchard

Re: Determining High Risk Customers - 11/05/08 05:46 AM

The NAICS codes can still be a big help to figure out just what types of customers you do have (like "inherent risk"), but it is not the deciding factor for the risk rating.
Posted By: Kelsey D

Re: Determining High Risk Customers - 11/05/08 01:41 PM

I agree that that is not the best risk-based approach. Needless to say, I did not implement the recommendation. We have identified several potentially high risk accounts, but only a handful are truly considered high risk and coded as such.
Posted By: KC Danimal

Re: Determining High Risk Customers - 11/05/08 02:56 PM

I work for a consulting firm and we tell all our clients that NAICS codes are a starting point. Actual classification as a high-risk entity must be based on transactions.
Posted By: BrendaC

Re: Determining High Risk Customers - 11/05/08 03:58 PM

I consider the nature of business to be a factor in determining risk rating. Other factors would include ownership, geographic location(s), types of products and services utilized and transaction history (or anticipated transaction pattern).
Posted By: Trees

Re: Determining High Risk Customers - 11/05/08 05:45 PM

We have some types as high risk when they are a new account for us. For example, restaurants or car dealers. Then, after one year we perform an annual review of all highs and, if no issues, they are off the list. Others, such as non-res aliens and import/export stay on the list until 5 years (for us that is not very many accounts). Beyond that we look for out of town ownership or out of towners buying existing customer, significant changes in their risk score (we use Patriot Officer), etc. At the end of the day we do not have the "expected" 1% of our customer base coded high risk.
Posted By: WonderWoman

Re: Determining High Risk Customers - 11/05/08 08:20 PM

We use NAICS codes ... it helps when comparing "like" businesses to see if the activity is normal or not.
Posted By: nbk2yj2

Re: Determining High Risk Customers - 11/06/08 02:50 AM

If the business fell into the "high risk category", we would open the account (we filled out a KYC that profiled the expected activity of the business client). The "file" would be scanned to the aml/bsa department for monitoring. If the actual activity did not match the profile that was completed upon account opening give or take then there was enhanced due diligence....