Step 01 of 06
Choose the assessment approach.
In Risk Setup, configure property-based risk assessment or switch to a questionnaire-based assessment for corporate or individual clients.
CUSTOMER RISK ASSESSMENT
Customer Risk Assessment Software for Informed Compliance Decisions
Assess corporate and individual clients against risk rules your team configures, score them with the method your policy specifies and see which factors produced each rating. When an assessment calls for further action, First Compliance carries it into mitigation and case review, with every change kept on record.
Turn Your Risk Policy Into Rules Every Assessment Follows
A customer risk assessment template in a spreadsheet is a reasonable place to start. It serves well enough until the criteria change, the client book grows or an inspector asks why one client was rated Medium rather than High. First Compliance turns your customer risk rating methodology into configured rules, evaluates every client against the same rules and shows the factors behind each result.
Corporate and Individual Clients
Assess legal entities and natural persons, with rules assigned to the relevant onboarding interface for each client type.
Two Assessment Approaches
Score clients on their onboarding properties or on answers to a risk assessment questionnaire your team writes.
Configurable Rules and Scoring
Decide how much each property or answer contributes, and calculate the overall score as a sum or an average.
Transparent Risk Profiles
Review the overall rating, the contributing factors and, where mitigation rules apply, the mitigated risk value.
Make Every Risk Rating Count With a Configurable Customer Risk Assessment Software
A customer risk rating decides how much due diligence a relationship receives and how often it is reviewed. The value of a customer risk assessment software therefore lies in three things: how faithfully it reflects your own criteria, how clearly it explains each result and how well it controls changes to the rules over time.
Assess Risk Around Your Own Criteria
Every regulated business assesses customer risk differently, depending on the clients it serves, the products it offers and the jurisdictions it operates in. First Compliance lets your organisation decide which factors matter and how much weight each one carries. You can score clients on onboarding information, such as country of incorporation, business activities, customer type and geographic risk, or on answers to a risk assessment questionnaire your team creates. Every client is then assessed against your criteria rather than a generic template.
Understand What Drives Each Risk Rating
A rating without its reasons is an answer without its working. The Risk Profile breaks each assessment into its contributing factors and shows the score given to each property or questionnaire answer. A reviewer can see why a client landed in its category and explain the result to a senior manager, an auditor or a supervisor without rebuilding the calculation by hand.
Distinguish Initial Risk From Mitigated Risk
The risk a client presents and the risk that remains after controls are applied are different figures, and both belong in the file. When the Calculate Risk function runs, the platform displays the initial risk score and rating and, where mitigation rules apply, the mitigated risk value alongside them.
Define Review Requirements by Risk Category
Risk Score Settings let you define Low, Medium and High categories with their own score ranges, colour indicators, review frequencies and compliance review requirements. A client’s score places it in a category, and the category indicates the level of oversight your policy sets for it.
Keep Changes to the Rules Under Control
Risk methodologies change as policies, regulations and business lines change. Each risk rule carries an effective date and can be modified or deactivated when a policy is updated. Administrators also decide when the Calculate Risk function becomes available and which users or roles may run it, and the audit trail records field-level changes to risk assessment records with the user and timestamp.
Security and Data Residency
Risk assessment records hold personal and corporate information that must be protected and, in some jurisdictions, stored locally. First Compliance can be deployed on-premises or hosted in your own region, with encryption, access controls and regular backups protecting every record. Role-based access control lets administrators decide who can view, add, edit or delete records, supporting segregation of duties. The platform is certified to ISO 27001:2022 for information security and ISO 9001:2015 for quality management.
Assess Your Client’s Risk in Six Steps
Customer risk assessment in First Compliance follows six steps, from deciding how risk will be measured to deciding what a result requires. The first two steps are set up once and revisited when your policy changes; the remaining four apply to each client. Customer risk assessment automation here means the consistent application of your rules, while the decision on what a result requires stays with your reviewers.
Step 02 of 06
Define your risk rules.
Create rules, assign them to the corporate or individual onboarding interface, set their effective dates and define how strongly each property or question influences the overall score.
Step 03 of 06
Capture the relevant information.
Record client information during onboarding, or answer the configured risk assessment questions, so that the assessment has the inputs it needs.
Step 04 of 06
Calculate the risk score.
An authorised user runs Calculate Risk from the Compliance section of the onboarding form. The platform evaluates the client data against the configured rules and displays the risk score, the risk rating and any mitigated risk value.
Step 05 of 06
Review the risk profile.
Open the Risk Profile to examine the overall and mitigated ratings, the contributing risk factors and the property-level or question-level scores, and print the report for the client file.
Step 06 of 06
Determine the required follow-up.
Use the client’s risk category, its review requirements and any applicable mitigation rules to decide whether further action, such as enhanced due diligence or manual review, is needed.
Choose How You Assess Customer Risk
Some organisations measure risk through the facts they already hold about a client; others prefer to ask a structured set of questions. Administrators select the approach in Risk Setup, and both feed the same scoring, classification and risk profile functions.
Property-Based Risk Assessment
Assess risk using selected client and onboarding properties, with configured rules determining how each one influences the overall score.
- Country of incorporation
- Company status
- Business activities
- Customer type
- Geographic risk
Questionnaire-Based Risk Assessment
Build risk assessments around your own questions and assign them to corporate or individual client onboarding interfaces.
- Custom risk assessment questions
- Assignment to corporate or individual onboarding
- Answers that contribute to the overall score
- Internal compliance questionnaires and due diligence checks
Core Capabilities of First Compliance Customer Risk Assessment Software
Four capabilities support the assessment workflow described above. The first three concern the assessment itself; the fourth shows how its findings connect to the wider Risk Management module.
Configure Risk Rules Around Your Assessment Criteria
Risk Rule Management defines how the platform evaluates each property or questionnaire answer and how much it contributes to the overall score. Rules can be changed without rebuilding the assessment, which keeps the methodology in step with your policy.
- Rule creation and management. Create new risk rules and maintain them in one place.
- Defined impact. Set how strongly each property or question influences the overall risk score.
- Assignment by client type. Assign rules to the corporate or individual client onboarding interface.
- Effective dates. Set when each rule takes effect, and modify or deactivate rules when policies change.
Calculate and Classify Customer Risk
Customer risk scoring depends on two decisions: how individual scores combine into a total and what each total means. Both are configured to match your risk model.
- Sum-based or average-based scoring. Add risk values together or average them, according to your methodology.
- Risk classifications. Define Low, Medium and High categories with configurable score ranges and colour indicators.
- Review settings by category. Attach review frequencies and compliance review requirements to each category.
- Calculation access control. Decide when the Calculate Risk function becomes available and which users or roles may run it.
Understand the Factors Behind a Risk Rating
The Risk Profile presents customer risk profiling at the level of detail a reviewer needs, for both corporate and individual clients.
- Overall and mitigated ratings. See the overall risk rating and, where mitigation rules apply, the mitigated risk rating.
- Contributing factors. View the breakdown of the risk factors behind the overall result.
- Property-level or question-level scores. Examine how each property or answer contributed to the assessment.
- Printable reports. Print the risk profile report for compliance documentation and audit purposes.
Connect Assessment Findings to Mitigation
When an assessment calls for further action, the Risk Management module records what was done, why it was done and how long it remains valid.
- Configurable mitigation rules. Define when mitigation is required, for example enhanced due diligence for high-risk clients or additional verification for medium-risk clients.
- Mitigation records. Upload supporting documents, add remarks and investigation notes, adjust residual risk values and record the justification for each decision.
- Mitigation status tracking. Follow each record through Unresolved, Resolved, Expiring and Expired.
- Case creation and escalation. Create cases under configured conditions, such as a risk score exceeding a defined threshold, and escalate them to senior management where required.
- Profile deactivation rules. Configure the platform to disable client profiles under conditions such as a high-risk classification or a confirmed sanctions match.
Support Every Role in Your Compliance Team
Different members of a compliance function use the customer risk assessment module for different tasks. Find the description that matches your responsibilities.
Compliance Leaders and MLROs
Set the risk categories and review requirements that reflect the organisation’s risk policies and risk appetite.
Risk Managers
Define assessment rules, scoring methods, score ranges and risk classifications, and keep them current as policies change.
Onboarding and KYC Analysts
Capture client information, run the KYC risk assessment from the onboarding interface and see the resulting KYC risk rating.
Compliance Analysts and Investigators
Review risk profiles, examine contributing factors and document mitigation or investigation information where required.
Customer Risk Assessment Software for FIs, DNFBPs and VASPs
A risk-based approach to AML applies across regulated sectors, but the factors that matter differ from one business to the next. The examples below show how financial institutions (FIs), designated non-financial businesses and professions (DNFBPs) and virtual asset service providers (VASPs) can configure the same assessment framework around their own policies.
Financial Institutions: Configurable Risk Criteria
Banks, exchange houses, finance companies and insurers serve varied client bases and may evaluate them through different combinations of onboarding information, risk factors and assessment questions.
- Property-based assessments. Evaluate configured client and business properties across a large client book.
- Questionnaire-based assessments. Incorporate custom questions into corporate or individual client risk assessment.
- Defined risk categories. Set score ranges, risk classifications and review frequencies.
- Risk profile reports. Examine contributing factors and print reports for the client file.
DNFBPs: Risk Assessment Around Client and Business Profiles
Real estate businesses, corporate service providers, dealers in precious metals and stones, lawyers and accountants may work with complex ownership structures and high-value relationships. Their assessments need to reflect the client in front of them without imposing a bank’s process on a smaller team.
- Corporate and individual assessment. Configure risk assessment for both client types.
- Business and geographic factors. Use supported properties such as business activities, customer type and geographic risk.
- Policy-based rules. Define the impact of each assessment factor on the overall score.
- Mitigation records. Document supporting evidence and residual risk when further action is required.
VASPs: Configurable Customer Risk Assessment
Virtual asset service providers assess individual and corporate customers according to their own risk policies, alongside the separate review of wallet activity.
- Corporate and individual assessments. Apply the relevant risk assessment configuration to each client type.
- Custom questionnaires. Include the assessment questions your policy requires.
- Risk scoring and classification. Configure calculation methods and risk categories.
- Mitigation and escalation. Use the wider Risk Management functions to record mitigation and escalate cases under configured conditions.
- Clear boundaries. This module assesses customers, while Wallet Screening covers wallet addresses and their exposure.
Customer Risk Assessment Software: Frequently Asked Questions
What is customer risk assessment software?
Customer risk assessment software evaluates the money laundering and terrorist financing risk that each customer presents, using defined criteria and a scoring method, so that a regulated business can apply due diligence in proportion to that risk. The process is also described as AML customer risk assessment or KYC risk assessment. In First Compliance, the customer risk assessment module scores corporate and individual clients against configurable rules and presents each result as a risk profile.
How does Customer Risk Assessment work in First Compliance?
Administrators choose a property-based or questionnaire-based approach, create risk rules and define how each property or question affects the score. An authorised user then runs Calculate Risk from the onboarding form, and the platform evaluates the client’s data against the rules and displays the risk score, rating and any mitigated risk value.
Can I assess both corporate and individual clients?
Yes. Risk rules and questionnaires can be assigned to the corporate or individual client onboarding interface, and the Risk Profile is available for both client types.
What is the difference between property-based and questionnaire-based risk assessment?
Property-based assessment scores clients on information captured during onboarding, such as country of incorporation, company status, business activities, customer type and geographic risk. Questionnaire-based assessment scores clients on their answers to custom risk assessment questions your team creates.
Can I configure my own risk assessment questions?
Yes. Administrators can create custom questions, assign them to corporate or individual onboarding and have the answers contribute to the overall score, which lets you bring internal compliance questionnaires and due diligence checks into the assessment.
Can I define how individual risk factors influence the overall score?
Yes. Risk Rule Management lets you set the impact of each property or question on the overall score, assign effective dates to rules and modify or deactivate them when your policy changes.
Which risk scoring methods does First Compliance support?
The platform supports sum-based scoring, where risk values are added together, and average-based scoring, where they are averaged. Administrators select the method that matches their customer risk rating methodology.
Can I configure Low, Medium and High risk categories?
Yes. Risk Score Settings let you define each category with its own score range, colour indicator, review frequency and compliance review requirements.
Can I view the factors contributing to a client’s risk rating?
Yes. The Risk Profile shows the overall rating, the mitigated rating where applicable, a breakdown of contributing risk factors and the score for each property or questionnaire answer.
What is the difference between initial risk and mitigated risk?
Initial risk is the rating produced when the client’s data is evaluated against your rules. Mitigated risk reflects the effect of mitigation measures where mitigation rules apply. First Compliance displays both, and users can record residual risk values and justifications in mitigation records.
Can I generate a risk profile report?
Yes. The risk profile report can be viewed and printed for corporate and individual clients to support compliance documentation and audit purposes.
How does risk assessment connect to risk mitigation and case management?
Mitigation rules define when an assessment requires further action, such as enhanced due diligence or manual review. Users then record documents, remarks, residual risk and justifications, and completed mitigation actions are escalated as cases. Cases can also be created when configured conditions are met, such as a risk score exceeding a defined threshold, and they remain open until closed under your configured policies.