Customer risk assessment
Also written Customer risk rating · Assessing customer AML risks
The IFSCA requirement to assess every customer and give it a high, medium or low ML/TF risk rating before CDD begins — the rating that decides simplified, standard or enhanced due diligence.
In plain language
Under the IFSCA Guidelines, the order of operations is fixed: first rate the customer, then do the due diligence the rating calls for.
The customer risk assessment is that first step. It uses what the regulated entity learned about its own exposure in its business risk assessment, applies it to one customer, and produces a single output: a risk rating of high, medium or low, proportionate to the ML/TF risk.
Everything downstream reads that rating — which CDD measures apply, how closely the account is monitored, and how often the customer's KYC must be refreshed. And the customer never gets to see it.
How it works
The obligation (Chapter 6, section 6.1.1). A regulated entity shall undertake a risk-based assessment of every customer and assign a risk rating proportionate to the ML/TF risks. For new customers it is completed prior to undertaking CDD; for existing customers, where the entity feels it necessary.
What the assessment must take into account — eight items: identify the customer and beneficial owner; the purpose and intended nature of the relationship; the nature of the customer's business; the nature of the customer, its ownership, control structure and beneficial ownership; the nature of its relationship with the entity; its country of origin, residence, nationality, place of incorporation or place of business; the relevant product, service or transaction; and, for life insurance, the beneficiary and the beneficiary's beneficial owner.
Factors that may indicate high risk fall under three heads — customer (high-risk sectors, unusual or excessively complex ownership, nominee shareholders or bearer shares, personal asset holding vehicles), country or geographic (inadequate AML/CFT measures identified by FATF, sanctions or embargoes, terrorism funding) and product, service, transaction or delivery channel (private banking, anonymity, non-face-to-face without adequate safeguards, payments from unknown third parties). Low-risk indicators include government entities, listed public companies with disclosure requirements, FATF-standard regulated foreign institutions, and certain insurance and pension products. One factor alone may not always indicate high or low risk; the entity examines the overall risk.
What the rating drives.
| Rating | CDD | Periodic updation (general) | Resident Indian with Financial Group relationship in India |
|---|---|---|---|
| High | CDD plus enhanced CDD | Annually | Once every 2 years |
| Medium | CDD | Once in 3 years | Once every 8 years |
| Low | Simplified CDD | Once in every 5 years | Once every 10 years |
Where the Financial Group entity's categorisation differs from the regulated entity's, the stricter periodicity applies.
Confidentiality. The risk categorisation and the specific reasons for it shall be kept confidential and not revealed to the customer, to avoid tipping off.
Records. The customer risk assessment and the determination of risk rating are among the risk assessment documents to be provided to the Authority immediately on request.
A worked example
Illustrative customers of an IFSC fund management entity.
Sabarmati Global Fund Management (IFSC) onboards three investors in one week.
| Customer | Key facts from the assessment | Rating | What follows |
|---|---|---|---|
| A pension scheme for employees of a listed Indian company, contributions deducted from wages, no assignment of member interest | Low-risk product indicators; transparent sponsor | Low | Simplified CDD; updation every 5 years |
| Ms R. Shah, a resident Indian who already banks with the group's Indian bank, investing USD 250,000 from her own account | Straightforward individual; group relationship in India | Medium | Standard CDD; group periodicity of 8 years — unless the group bank rates her differently, in which case the stricter applies |
| A BVI company owned through two further companies with nominee shareholders, paying USD 3 million from an account in a third country | Excessively complex ownership; nominee shareholders; unassociated payer | High | CDD plus enhanced CDD; senior management approval; annual updation |
Order of work. Each rating was assigned before CDD started — the BVI company's file does not begin with a passport copy but with the decision that it needs enhanced measures.
The phone call. The BVI company's director asks why his onboarding is taking longer than a friend's. The relationship manager may explain the documents needed; he may not disclose that the customer has been rated high risk or why.
Why NISM asks about it
Chapter 6 (IFSCA Guidelines for KYC Norms), sections 6.1 to 6.1.3, carries the customer risk assessment, the high- and low-risk factor lists and the confidentiality rule; section 6.2.1 ties CDD to the rating; section 6.10 gives the updation periods; and Chapter 5, section 5.8.1, lists the risk documents. The chapter's own sample question asks what the regulated entity must ensure while performing customer risk assessment.
Common exam traps
- Rating comes before CDD for new customers — not after.
- Every customer is assessed. There is no exempt class of customer from the assessment.
- The rating and the reasons are confidential, to avoid tipping off.
- One risk factor alone may not make a customer high or low risk — the overall risk is examined.
- Updation: 1, 3 and 5 years generally; 2, 8 and 10 years for resident Indians with a Financial Group relationship in India — and the stricter periodicity wins where the two ratings differ.
- High risk means CDD plus EDD, not EDD instead of CDD.
- Customer risk assessment is not the business risk assessment. The business assessment looks at the entity's own exposure and feeds the customer assessment.
Check yourself
1.While performing customer risk assessment, which factor or factors will a Regulated Entity ensure?
- a)Both of the above
- b)Identify the customer and Beneficial Owner
- c)Obtain information on the purpose and intended nature of the business relationship
- d)None of the above
Show the answer
Answer: (a) Both of the above
Both are listed factors — the first two of eight.
When undertaking an assessment... a Regulated Entity shall: i. identify the customer and Beneficial Owner, if any; ii. obtain information on the purpose and intended nature of the business relationship;
The remaining six: obtain information on, and take into consideration, the nature of the customer's business; take into consideration the nature of the customer, its ownership, control structure, and its Beneficial Ownership; the nature of the customer's business relationship with the Regulated Entity; the customer's country of origin, residence, nationality, place of incorporation or place of business; the relevant product, service or transaction; and the beneficiary of the policy including any Beneficial Owner of such beneficiary, in life insurance.
Eight in all.
The duty is universal: a Regulated Entity shall: i. undertake a risk-based assessment of every customer; and ii. assign the customer a risk rating proportionate to the ML/TF risks.
And the sequence matters: the customer risk assessment... shall be completed prior to undertaking Customer Due Diligence for new customers, and also where the Regulated Entity otherwise feels necessary, for existing customers.
Assessment first, diligence second — because the rating decides how much diligence is required: enhanced measures in case of high-risk customers and simplified measures in case of low-risk customers.
Its input comes from the previous chapter: risks identified while assessing the business risks shall be used for the customer risk assessment.
And its output stays inside the firm: the risk categorization of a customer and the specific reasons for such categorization shall be kept confidential and shall not be revealed to the customer to avoid tipping off.
2.Which of the following is NOT true about the Customer Due Diligence process?
- a)Not obtaining information on the purpose and intended nature of the business relationship
- b)Identifying the customer and verifying that customer's identity
- c)Conducting ongoing due diligence on the business relationship and scrutiny of transactions
- d)Knowing the customer's business and risk profile, including, where necessary, the source of funds
Show the answer
Answer: (a) Not obtaining information on the purpose and intended nature of the business relationship
Option A states the opposite of a core CDD requirement — obtaining that information is precisely what is required, so the statement is not true of CDD.
**Rule 9 of the PML Rules requires an entity to identify its clients, verify their identity using reliable and independent sources of identification, obtain information on the purpose and intended nature of the business relationship, where applicable.
Purpose and intended nature are expressly part of the process — and they are asked again where doubt arises: on suspicion or where there are doubts about the adequacy or veracity of previously obtained client identification data, the reporting entity shall review the due diligence measures including verifying again the identity of the client and obtaining information on the purpose and intended nature of the business relationship.
Option B is the first limb of CDD — identify its clients, verify their identity using reliable and independent sources of identification.
Option C is the ongoing limb — every reporting entity shall exercise ongoing due diligence with respect to the business relationship with every client and closely examine the transactions in order to ensure that they are consistent with the knowledge of the client, his business and risk profile.
Option D restates the rest of that sentence — consistent with the knowledge of the client, his business and risk profile and where necessary, the source of funds.
The Guidelines make source of funds explicit for higher risk too: entities must follow robust KYC (Know Your Customer) procedures, including enhanced diligence for high-risk clients, identification of beneficial owners, source of funds, and ongoing monitoring.
CDD is Chapter V of the Guidelines, with Chapter-IV Customer Risk Assessment before it and Chapter-VI Third Party Reliance after — all taken up in the next chapter of this workbook.
And the classification principle governs its intensity: enhanced measures in case of high-risk customers and simplified measures in case of low-risk customers.
Where this is taught
Free preparation for NISM Series IFSCA-01Related terms
- ControlIn the beneficial-ownership tests, the right to appoint a majority of directors or to control management or policy decisions — the limb that catches an owner holding no shares at all.
- Enhanced Due DiligenceThe additional customer due diligence a Regulated Entity must perform where ML/TF risk is high — including source of wealth, Senior Management approval and enhanced ongoing monitoring.
- Ongoing due diligenceThe continuing duty to scrutinise a customer's transactions against what is known of the customer, its business and risk profile, and to keep CDD data current, for the whole life of the relationship.
- Simplified Customer Due DiligenceThe lighter version of CDD an IFSC regulated entity may apply to a customer rated low risk — never where there is a suspicion of money laundering or terrorist financing.
- Politically exposed personsA higher-risk class of client that SEBI treats as a client of special category: the intermediary must detect them, obtain senior management approval to deal with them, and verify their source of funds and wealth.
- Risk Based ApproachApplying each due diligence measure in proportion to the money-laundering risk a client poses — enhanced diligence for higher-risk clients, simplified for lower-risk, never simplified where suspicion exists.
- Suspicious transactionAny transaction or attempt, cash or not, that to a person acting in good faith suggests proceeds of crime or terrorist financing, or looks unjustifiably complex or without economic rationale.
- Deferred verificationOpening a business relationship before verification of the customer or beneficial owner is complete — allowed in the IFSC only on four conditions, with suspension at 30 days and termination at 120.
- Listed-entity exemptionThe rule that no shareholder or beneficial owner need be identified where the customer, or the owner of its controlling interest, is listed in India or a notified jurisdiction, or is a subsidiary of such an entity.
- V-CIPVideo based Customer Identification Process: identifying a customer through a live, secure, consent-based audio-visual interaction with facial recognition — treated on par with face-to-face identification.
- UNSC sanctions listsThe UN Security Council's ISIL (Da'esh) & Al-Qaida Sanctions List and 1988 Sanctions List — no IFSC regulated entity may hold an account in a listed name, and resembling accounts go to FIU-IND and MHA.
- FATF Style Regional BodiesThe nine regional counterparts of the FATF — APG, CFATF, EAG, ESAAMLG, GABAC, GAFILAT, GIABA, MENAFATF and MONEYVAL — which with FATF form the global AML/CFT network; India belongs to APG and EAG.
- Financial GroupA parent company, or other legal person exercising control and coordinating functions, together with the branches and subsidiaries that are subject to AML/CFT policies and procedures at group level.