Client Risk Assessment

A client risk assessment is the step in which a firm decides how risky one client is, before it decides how closely to check that client. Article 20(2) of the Anti-Money Laundering Regulation (AMLR) requires an individual analysis of the risks of money laundering and terrorist financing. The analysis has regard to the specific characteristics of the client and of the business relationship or occasional transaction.

The regulation does not use the phrase "client risk assessment". It calls the exercise an individual analysis and calls the result the customer's risk profile. That profile is then the yardstick for ongoing monitoring: under Article 26(1) a firm checks that a client's transactions are consistent with it.

The assessment is part of customer due diligence, so it is made whenever due diligence applies. Article 19(1) names those moments. They include the start of a business relationship and an occasional transaction of at least EUR 10,000.

A business-wide risk assessment looks at the firm. A client risk assessment looks at one client. Article 10 requires each firm to identify the risks it is exposed to across its whole business: its services, its clients as a group, the countries it works with, the way it delivers its work.

The business-wide assessment is drawn up by the compliance officer, approved by the management body, kept up to date and made available to supervisors on request. Under Article 10(3), a supervisor may decide that firms in a sector with clear and understood risks do not each need a documented one. That option does not extend to banks, other financial institutions or crowdfunding providers.

The two are linked. Article 20(2) says the individual analysis must take the business-wide assessment into account. If the firm has concluded that one of its services is exposed to misuse, a client who wants that service starts from a higher position. Both draw on the same lists in Annexes I to III. The business-wide assessment also takes in the EU-level and national risk assessments (Article 10(1)).

The AMLR gives three lists. Annex I sets out risk variables, the things a firm must look at. Annex II gives factors of potentially lower risk. Annex III gives factors of potentially higher risk. The table shows how they fit together, with examples from each annex.

All three lists are described as non-exhaustive. For higher risk, Article 34(3) requires a firm to take into account at least the Annex III factors, together with other indicators such as notifications from the financial intelligence unit. Article 20(3) set 10 July 2026 as the deadline for the EU's Anti-Money Laundering Authority to issue guidelines on the variables and factors.

The regulation does not say how to weigh the factors against each other. It contains no scoring model. A factor points in a direction, and the firm forms an overall view of the client.

The result decides which of three levels applies. Where the firm identifies an increased risk, it must apply enhanced due diligence. Where it identifies a lower risk, it may apply simplified due diligence. Otherwise the standard measures apply (Article 20(2)).

The assessment is not free in every case. Article 34(1) requires enhanced measures in listed situations whatever the firm's own view, among them politically exposed persons and links to high-risk third countries. Article 33(5) forbids simplified measures where the firm doubts the client's information or suspects money laundering.

The result also sets the review interval. Under Article 26(2) the period between updates of client information depends on the risk, with a limit of 1 year for higher-risk clients under enhanced due diligence and 5 years for all others. The assessment itself is revisited when the client's relevant circumstances change or the firm learns a relevant fact (Article 26(3)).

In writing, with the reasons. Article 21(3) requires a firm to keep a record of the actions it takes to apply customer due diligence, including the decisions taken, the supporting documents and the justifications. The record is updated each time due diligence is reviewed.

The AMLR prescribes no form. A record that serves its purpose states which factors the firm considered, what information it relied on, the conclusion it reached, the level of due diligence that follows, who decided and on what date. A decision to treat a client as lower risk on the basis of additional factors must be documented under Article 33(2).

The test is Article 20(4). A firm must be able to demonstrate to its supervisor at all times that its measures are appropriate to the risks it identified. A rating with no reasons behind it cannot do that.