Customer risk assessment (CRA) accounted for 54 findings in fscom’s 2026 fincrime compliance report, double the 27 recorded in 2025 and the first time CRA has entered the top five review areas in the report’s ten-year history.
But the increase doesn’t necessarily mean firms are getting customer risk assessments wrong more frequently.
Across the 104 anti-money laundering, counter-terrorist financing and anti-financial crime (AML/CTF/AFC) audits, a significant proportion of CRA findings related to a gap between the risk scoring methodology firms had designed and approved, and how it was being applied in practice.
The challenge was not necessarily the design of the model. It was ensuring that the model was fully implemented and operating as intended.
As firms develop more sophisticated approaches to customer risk scoring, this distinction matters. An approved methodology can only support effective risk management when it is consistently applied across the relevant customer population.
What did we find?
Of the 54 CRA findings, 34 arose from a common implementation issue identified across multiple entities within the groups reviewed. The remaining 20 findings highlighted other weaknesses in CRA frameworks and methodologies.
Two distinct themes emerged.
- The gap between design and implementation
The most significant concentration of findings related to a revised customer risk scoring methodology that had been designed and approved but not fully implemented.The firm’s ongoing risk scoring model, as designed, did not match the risk ratings applied to customers in practice. The issue was identified across multiple entities of multi-jurisdictional groups reviewed, demonstrating how implementation challenges can affect the consistency of customer risk assessments across a wider organisation.
Importantly, the concentration of these findings provides context for the year-on-year increase. Excluding the 34 findings associated with this implementation issue, the remaining 20 CRA findings present a more nuanced picture than the headline figure alone suggests.
The lesson for firms is that approving an improved methodology is only one stage of strengthening customer risk assessment. The transition must also be completed, monitored and tested to ensure the intended approach is operating in practice.
- Recurring framework weaknesses
The remaining findings were more varied, but three areas stood out:
- CRA framework effectiveness: Six findings related to CRA frameworks that were not functioning as intended, were insufficiently documented, or were not aligned with the firm’s whole firm risk assessment (WFRA).
- Merchant risk assessment: Four findings related to payment and card-acquiring firms without a sufficient AML/CTF-specific risk assessment for merchant relationships.
- Risk scoring methodology: Three findings related to methodologies that reduced a customer’s risk score based on non-AML factors, such as the presence of an environmental, social and governance (ESG) policy.
The final point is particularly important. Factors unrelated to financial crime risk should not reduce a customer’s risk rating in a way that obscures relevant AML/CTF risk indicators.
These findings reinforce the importance of ensuring that customer risk assessments are based on relevant financial crime risks and operate consistently across the business.
Why is implementing the approved methodology so important?
A customer’s risk rating does more than describe them. It determines the level of due diligence applied, how often the relationship is reviewed, and in many firms, how closely transactions are monitored. Where the rating applied in practice does not reflect the firm’s approved methodology, there is a risk that controls will not be applied consistently or proportionately to the customer’s actual financial crime risk.
In the UK, under Regulation 28(12) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs 2017) firms must apply customer due diligence measures that reflect both their whole firm risk assessment and the level of risk in each case.
Where firms cannot demonstrate that their customer risk scoring methodology is operating as intended, it becomes more difficult to demonstrate a genuine risk-based approach, however well documented the methodology is.
These arrangements are not necessarily problematic in themselves, as model transitions naturally carry this risk. During a rollout, part of the customer book may still sit under legacy ratings while new customers are scored under the new model. Group entities may also be at different stages. The problem arises when no one is tracking or managing the gap.
Firms moving to a revised customer risk scoring methodology should manage implementation as a distinct project risk, with clear milestones, defined accountability and appropriate interim controls.
CRA readiness check: is your model operating as intended?
When reviewing the effectiveness of your customer risk assessment, consider the following questions:
- If you have approved a new or revised scoring methodology, do you know what proportion of your customer book it currently covers?
- Is there a defined deadline for full rollout, and does someone own it?
- What interim controls apply to customers not yet migrated to the new model?
- Have you tested a sample of production ratings against what your documented methodology should produce?
- Where you operate across group entities, can you evidence the same methodology being applied consistently in each one?
- Does your methodology include any inputs, such as ESG credentials or positive reputational factors, that could reduce a risk score for non-AML reasons?
- If you onboard merchants or sub-merchants, do you assess them for AML/CTF risk specifically, and not only commercial or credit risk?
- Is your CRA explicitly cross-referenced to your WFRA?
When gaps are identified, firms should consider whether their CRA gives an accurate and current view of each customer’s financial crime risk.
Five priorities for strengthening your customer risk assessment
Our findings highlight five practical areas firms should consider when reviewing their CRA frameworks.
- Track implementation through to completion
Where a new or revised methodology has been approved, establish clear implementation milestones, accountable owners and a defined timetable for rollout across the relevant customer population. Firms should also consider what interim controls are needed while customers remain on legacy ratings. - Test customer ratings against the approved methodology
Periodically compare the ratings a sample of customers carry in your systems with what the documented methodology would produce. This can help identify inconsistencies between model design and operational implementation before they become embedded across the customer population. - Assess merchant-specific AML/CTF risks
Payment and card-acquiring firms should ensure that their approach to merchant and sub-merchant risk assessment appropriately considers relevant financial crime risks, rather than relying solely on commercial or credit risk assessments. - Review non-AML inputs within the scoring methodology
Assess whether factors such as ESG credentials, sustainability commitments or positive reputational factors could inappropriately reduce a customer’s financial crime risk rating. Scoring methodologies should ensure that relevant AML/CTF risk indicators are appropriately reflected in the overall assessment. - Align customer risk assessments with the WFRA
Customer risk assessments should not operate in isolation. As explored in our recent blog, Is your whole firm risk assessment keeping pace with your business?, the WFRA provides the foundation for understanding a firm’s financial crime risk exposure.
The CRA should translate those risks into how individual customer relationships are assessed, rated and monitored. Firms should ensure that their CRA methodology is aligned with their WFRA and that material changes to the firm’s risk profile are appropriately reflected in customer-level assessments.
From model design to operational effectiveness
The findings from our 2026 fincrime compliance report highlight an important distinction between having an appropriate CRA methodology and demonstrating that it works effectively in practice.
The key takeaway? A customer risk assessment is only as effective as the controls and processes that support its consistent application across the business.
For firms moving to a more dynamic scoring model, the priority should not end with design and approval. Implementation, ongoing testing and effective oversight are equally important.
How fscom can help
fscom Compliance Maturity Specialists™ supports regulated firms in assessing and strengthening their customer risk assessment frameworks, from methodology design through to testing whether ratings in production reflect the approved model.
Through AML/CTF/AFC audits, CRA methodology reviews and wider financial crime framework reviews, we help firms identify gaps, manage model transitions and evidence a risk-based approach that holds up in practice.
We are also appointed to the FCA Skilled Persons Framework 2026–2030 across Lot C (Controls and Risk Management), Lot E (Financial Crime) and Lot I (Prudential Risk). Under section 166 (s166) of the Financial Services and Markets Act 2000 (FSMA), the FCA can require a firm to appoint an independent skilled person to review specific aspects of its operations. Financial crime is the most common trigger for these reviews. A skilled person will test how controls operate in practice, not only how they are documented. Firms that can already evidence their CRA working as designed are in a stronger position if that scrutiny comes.
Explore the findings in our 2026 fincrime compliance report, or get in touch with our team to discuss how we can support your firm.
This post contains a general summary of advice and is not a complete or definitive statement of the law. Specific advice should be obtained where appropriate.
