Why the model must start from the business
Payment institutions combine speed, scale, digital activity and often a cross-border dimension. Risk cannot be understood through a single indicator. It must reflect products, customers, distribution channels, geographies and actual patterns of use.
From the BWRA to the customer
The business-wide risk assessment defines overall exposure and guides priorities and controls. The customer risk assessment translates those factors into an individual relationship. Both levels must be consistent: categories treated as high risk in the BWRA cannot disappear from scoring criteria or operational rules.
Control does not end at onboarding
The initial profile is an informed hypothesis. Transaction behaviour, new products, ownership changes, geographies and adverse information may change it. Review events, clear accountability and an audit trail of the decision are therefore required.
- documented definitions and data sources;
- review triggers during the relationship;
- alignment between risk, depth of due diligence and monitoring;
- periodic effectiveness testing and management of exceptions.
Practical scenario
Two customers process the same payment volume, but one operates in a stable market with recurring counterparties while the other uses several jurisdictions, changing beneficiaries and flows inconsistent with its stated profile. Volume alone does not describe risk.
Concrete test: when new beneficiaries or out-of-profile flows appear, which trigger opens a review? The file should record the explanation requested, the evidence supporting it and how the outcome changes monitoring. Measures depend on actual risk, not an automatic conclusion about geography.
Sources and references
Informational content. It does not replace an assessment of a specific case.
EBA — ML/TF Risk Factors Guidelines: versions and amendmentsAMLR — Regulation (EU) 2024/1624