How to Assess Customer Risk Under AML Rules

Customer risk assessment is a duty of every obliged entity under Poland’s AML Act. It is based on six criteria: customer type, geography, sales, economics, behavior and entity status. This guide explains each one and lists questions to ask before starting or continuing a business relationship.

If you follow the law firm’s AML publications, you may already know whether your company is an obliged entity and why it must apply anti-money laundering and counter-terrorist financing rules. We discussed this in an earlier article here.

One part of the AML process is a risk assessment connected with starting or continuing a business relationship with a particular customer. Read more here.

This article explains how to assess customer risk. The best approach is to examine the six basic criteria below. They are discussed in full in the SiP AML program.

Customer type

Natural person or legal entity

Assess whether your customer is a natural person or a legal entity. The principle is that the more complex the entity’s organization, such as an elaborate company structure, the higher the AML risk.

Customer with PEP status

If you identify a customer as a PEP, or politically exposed person:

• The person responsible for implementing AML procedures in your company must approve entering into an agreement with that customer.
• You automatically treat the risk of the relationship as elevated.
• You apply enhanced customer due diligence measures.

Geographic criterion

Check and answer these questions:

• Is the customer from Poland, the EU or outside the EU?
• Is the customer connected with places where terrorism is ongoing or where armed conflict is taking place?
• Is the customer from a country known for the production or smuggling of drugs?
• Does the customer have connections to a so-called tax haven?

The full list of questions is available in the SiP AML Program. It also includes a “Sanctions Checklist” to help you verify which countries are considered higher risk in connection with money laundering and terrorist financing.

Sales criterion

This criterion helps you assess:

• the customer’s product or service type
• how the products are distributed
• the customer’s industry

Consider whether the products or services offered could conceal the identity of the end customer.

Economic criterion

Assess the following circumstances:

1. Whether the transaction fits the business profile: compare the planned transaction with the type of business the customer conducts.
2. Pricing irregularities: check whether goods are sold below market value or follow a pattern of “expensive sale followed by a quick, cheap repurchase,” or the reverse.
3. Ownership links: check whether shareholders, management board members or beneficial owners come from countries at high risk of money laundering.

Behavioral criterion

Assess the following:

• Can you have direct contact with the customer?
• Does the customer have a genuine connection to the business they conduct, or is that connection absent?

Entity criterion

Check these circumstances:

1. Has the customer been subject to sanctions?
2. Has the customer previously been subject to penalties imposed by competent authorities?
3. Can you identify and verify the beneficial owners’ information?
4. Does the customer repeatedly register new companies, or make unusual capital or registration changes?
5. Does the customer conceal transaction information, or is it difficult to contact them at that time?

How to assess risk: next steps

These six criteria let you examine a customer’s risk. To complete the assessment, you need additional materials:

• Customer Risk Assessment Form, included in the KYC Procedure
• The “Risk Categories” checklist

We can provide these materials together with training through the SiP AML platform.

Once you have completed a customer risk assessment, proceed to the next steps and apply appropriate customer due diligence measures to that customer.

What is the SiP AML Program?

Our law firm’s team prepared a platform that enables you or a designated person in your company to carry out all duties imposed by the Polish Act on Counteracting Money Laundering and Terrorist Financing, from start to finish.

After registering with SiP AML, you can use ready-made procedures and video instructions. You can also request verification of completed documents and arrange a consultation with our AML experts.

What SiP AML includes

Training and educational materials:

• A one-hour training session explaining what AML is.
• An AML guide with a practical explanation of all the topics.
• Six e-learning videos covering:
  • How do you conduct a risk analysis?
  • What are the risk assessment criteria?
  • What are customer due diligence measures and the KYC procedure?
  • How do you apply customer due diligence measures and perform KYC in practice?
  • What are suspicious and above-threshold transactions?
  • How do you make a report to the General Inspector of Financial Information?

Documents and procedures:

• A universal internal AML procedure.
• A universal money laundering and terrorist financing risk assessment.
• An interactive form for carrying out a risk assessment in the company.
• A KYC procedure with editable PDFs to complete.
• A template for anonymous reporting of violations.
• A template for notifying authorities of a suspected crime.

Checklists:

• What are the risk criteria?
• What customer due diligence measures are required?
• Have sanctions been imposed?
• What steps should you take to report to the General Inspector of Financial Information?

Guides and explanations are available for most of the documents listed above.

Frequently asked questions

Which criteria should you check when assessing customer risk under an AML procedure?
Assess customer risk using six criteria: customer type (natural or legal person and PEP status), geography (country of origin and connections), sales (product, distribution and industry), economics (whether a transaction fits the business profile), behavior (whether contact is possible and whether the customer is genuinely connected to the business), and entity status (sanctions, penalties and whether beneficial owners can be verified). Each criterion requires answers to specific questions before you start or continue a relationship with a customer.

How does a customer’s PEP status change an AML risk assessment?
If a customer is a PEP, meaning a politically exposed person, you automatically treat the relationship risk as elevated. The person responsible for implementing AML procedures in your company must approve entering into an agreement with that customer, and you must apply enhanced customer due diligence measures.

How do you assess a customer’s AML risk geographically?
Check whether the customer is from Poland, the EU or outside the EU; whether they have connections to places where terrorism or armed conflict is ongoing; whether they are from a country known for producing or smuggling drugs; and whether they have connections to a so-called tax haven. Each circumstance affects the level of money laundering and terrorist financing risk.

What does the economic criterion cover in an AML customer risk assessment?
The economic criterion covers three elements: whether the planned transaction fits the customer’s business profile; whether there are pricing irregularities, such as sales below market value or an “expensive sale followed by a quick, cheap repurchase” pattern; and ownership links, including whether shareholders, management board members or beneficial owners come from countries at high risk of money laundering. Treat discrepancies in any of these areas as warning signs in your risk assessment.

What documents and tools do you need to complete an AML customer risk assessment?
After reviewing the six criteria, you need the Customer Risk Assessment Form included in the KYC Procedure and the “Risk Categories” checklist. Once the assessment is complete, proceed to applying appropriate customer due diligence measures to the customer.