AML Risk Scoring: Turning Employee Judgment into a Repeatable Decision System

If your company is an obliged entity, the General Inspector of Financial Information (GIIF) asks one question during an inspection: what was the basis for your decision to accept this client? “An employee thought the client looked trustworthy” is not enough. Supervisory authorities treat the absence of a formal, documented risk assessment as a failure to meet the obligation, even if the decision itself was sound.

Poland’s 2023 National Risk Assessment rated the money-laundering threat as very high: 4 on a four-point scale. Estimated proceeds of illegal activity amount to about 3.34% of GDP. Poland ranked 131st out of 160 countries in the 2024 Basel AML Index, with a score of 4.34. In this regulatory environment, a management board without visibility into how its team makes client-acceptance decisions exposes the company to administrative sanctions and personal liability.

This article explains how to turn an employee’s subjective judgment into a repeatable decision system based on an AML risk-scoring matrix. It covers six criteria, assigning scores, setting decision thresholds and building a form that the team will actually use. It is intended for management boards, compliance officers and people responsible for legal services to obliged entities.

Key terms you need to know

Before building the matrix, it helps to clarify terminology used in the rest of this article in the context of the AML Act.

Why “the client seems fine to me” is not enough in a GIIF inspection

An employee’s subjective assessment may rely on intuition, personal relationships, market reputation or the length of a relationship. It is vulnerable to cognitive biases, including the halo effect, familiarity and stereotyping. It is not transparent, reproducible or comparable across clients, and, most importantly, leaves no trace in AML records.

GIIF assesses what can be objectively verified from documents. Administrative court decisions confirm that no document evidencing the risk assessment means the obligation has not been met. The AML Act imposes both a substantive obligation to perform the assessment and a formal obligation to document and retain it for at least 5 years after the business relationship ends.

Common deficiencies identified by GIIF

GIIF inspections repeatedly identify:

1. No formally adopted risk-assessment procedure.
2. A procedure that is generic, lacks specific criteria and is not used in practice.
3. Procedures copied from other entities without adapting them to the business.
4. Formality without substance, with every client assigned the same risk category and no distinguishing rationale.
5. Brief justifications such as “no indications of elevated risk” that do not refer to specific data.
6. No updates to client assessments, which are completed once at onboarding and left unchanged for years despite changes in transaction profiles.

Subjective judgment versus a documented scoring matrix

Consequences include administrative fines that may reach millions. GIIF may sanction the people responsible for implementing the AML system, including management board members. It may also publish information about penalties, creating reputational risk.

Contact us if you want to check whether your current risk-assessment procedure meets statutory requirements.

Six risk criteria and how to turn them into scores

Article 33(3) of the AML Act lists six categories of risk factors that every obliged entity must include in its documented assessment. This is a minimum list: you may expand it, but may not omit any listed factor.

The Act does not prescribe a specific scoring method. The Polish Financial Supervision Authority (KNF) allows quantitative, qualitative and mixed methods, provided the methodology is described and applied consistently. Documentation should explain how factors are weighted, what scoring scales are used and how results are aggregated.

Criterion 1: type of customer

Consider the legal form, complexity of ownership, PEP status, business sector, reputation and relationship history.

An individual acting on their own behalf without complex affiliations may receive a lower score. A complex corporate structure with multiple layers of companies in different jurisdictions may receive a higher score. If the beneficial owner cannot be identified, refusing to establish a relationship may be justified under Article 41 of the AML Act.

GIIF Communication No. 73 notes that institutions must not automatically exclude entire customer groups without an individual risk assessment. A matrix must not trigger automatic exclusion based on a single criterion alone.

Criterion 2: geographic area

Consider the customer’s country of residence, the entity’s country of registration, countries where it has substantial business relationships, and the origin and destination of funds.

Pay particular attention to sanctioned countries, FATF-listed jurisdictions, tax havens and countries with underdeveloped AML/CFT systems. A customer or beneficial owner appearing on a sanctions list, including the Polish Ministry of the Interior and Administration, EU or UN lists, should receive the highest score.

Criterion 3: purpose of the account

Consider the account’s function in the relationship, such as current, savings, fiduciary, escrow, pooled or project-specific use.

Fiduciary, pooled or multi-customer accounts create higher risk, especially where the entitled parties are not transparent. A change in purpose, such as sudden use of a personal account for large commercial transactions, should prompt a review and may justify a higher assessment.

Criterion 4: products, services and distribution method

Products identified as highest risk in the 2023 National Risk Assessment include cash-based products, rapid cross-border transfers, highly anonymous products and services provided entirely remotely.

EBA guidelines identify fully remote relationships, without in-person contact, as a risk factor requiring enhanced due diligence.

Criterion 5: value of assets and transactions

Higher transaction volumes generally entail higher risk, but the relationship is not linear. Volumes should be consistent with the customer’s economic profile.

Score not only absolute values but also changes over time, concentration of transactions within a short period, the share of cash operations and transaction values compared with the customer’s declared income.

Criterion 6: purpose, regularity and duration of the business relationship

A stable, long-standing relationship with predictable patterns may receive a lower score for this criterion. Short or occasional relationships involving high-value transactions, especially cash or high-risk jurisdictions, may receive a higher score.

GIIF Communication No. 22 states that ongoing monitoring includes checking whether transactions match the declared purpose of the relationship and the customer’s business profile.

Example weighting and scoring illustration

The table is illustrative only. Neither the AML Act nor supervisory guidance prescribes specific scales or weights. Each institution should tailor weights to its business and customer profile.

For each risk factor, assign a score, apply the weights and calculate the customer’s risk result. The result is repeatable, comparable and, above all, documented.

Role of online screening

Online screening is not expressly named in the AML Act, but follows from the general obligation to apply customer due diligence and monitor relationships continuously. Annex D to KNF guidance recommends, as good practice, collecting data from reliable public sources, including the internet and public registers.

Many relevant items, such as adverse media, criminal proceedings and links to tax havens, can be found online. Screening results must be documented so internal audit and supervisory authorities can verify them later.

Important qualification: the absence of negative information in reliable sources cannot be the sole basis for lowering a score. Screening has limitations and may not reveal proceedings that have not yet become public.

Decision thresholds: when to accept a customer, escalate or refuse

The AML Act does not set numerical risk thresholds. It follows a risk-based approach and leaves institutions to design and document thresholds appropriate to their business profile. This is a deliberate choice, not a gap in the law.

Financial-sector practice indicates at least three risk levels: low, normal and high. A common extension adds an “unacceptable” level, meaning the relationship is not established or is terminated under Article 41 of the AML Act.

When refusal is mandatory

Article 41(1) of the AML Act is mandatory. If an institution cannot apply the required due-diligence measures, it must not establish a business relationship, must not carry out an occasional transaction, or must terminate an existing relationship. There is no room to negotiate this requirement. International sanctions are an additional reason for mandatory refusal. In both cases, the institution should consider notifying GIIF.

When escalation is mandatory

The AML Act requires senior-management approval in two situations:

1. PEPs: a company board member must approve entering into an agreement with a politically exposed person, their family member or a close associate. The relationship must immediately be treated as higher risk.
2. Correspondent relationships with respondent banks in third countries: the institution must conduct a detailed assessment of the respondent bank and obtain senior-management approval.

Example decision-threshold model

This table is illustrative only and is not prescribed by law. Each institution should calibrate thresholds to its business model.

Model calibration and validation

Thresholds are not fixed forever. Calibration should draw on:

1. The institution’s historical data;
2. Internal and external inspection results;
3. Findings of the National Risk Assessment;
4. Practical experience of the AML function; and
5. Changes in customer and product profiles.

Validate the model systematically and periodically. If the weighting of risk factors changes, reassess the risk of existing customers using the revised model.

How to build a risk-assessment form the team will actually use

The form is used for each new customer and each review of an existing relationship. If it is too complicated, employees avoid it. If it is too generic, it will not meet GIIF expectations. Good design balances usability and regulatory compliance.

The AML Act does not prescribe a form template; the institution chooses its format. Several design principles make actual use more likely.

Seven sections of the form

Design principles that improve usability

1. Conditional logic: if the customer is an individual, omit the corporate-structure section. If PEP screening is positive, display a senior-management approval field. Guide employees through the process instead of asking irrelevant questions.
2. Closed scoring scales: replace an open “assess the risk” field with a 1-to-5 scale describing each level. For customer type, for example, 1 may mean an individual with known identity and no high-risk jurisdiction links; 5 may mean a complex, multi-level structure where the beneficial owner cannot be fully established.
3. Required rationale: request a short justification of 2 to 3 sentences for each criterion. This prevents superficial assessments and gives GIIF material to review.
4. Automatic totals: the form should calculate the final score and category. Employees should not have to calculate weights manually.
5. Date and signature: every form should show its completion date and identify the assessor. An escalation should also show the approving person’s date and signature.

Risk assessment is not a one-time exercise

A customer’s risk changes as the relationship develops and the institution learns more about the customer and its behavior. The institution should schedule periodic reviews based on risk:

Source: Annex D to KNF guidance on AML principles for domestic payment institutions.

The process cannot rely only on contract terms requiring customers to report changes. The Act expressly requires active steps by the obliged entity. For higher-risk customers, reviews should be more detailed and individualized.

Management dashboard: what the board should see and what it need not micromanage

A scoring matrix generates data. The board needs that data in a form that supports decisions without requiring individual review of every form. An AML dashboard gives management visibility into the risk-assessment system.

The AML Act does not expressly define a dashboard. The need for oversight follows indirectly from the duty to supervise the AML system and the board’s responsibility for its proper operation.

Areas the board should monitor

What the board need not micromanage

The board should not approve every individual low- or moderate-risk assessment. Thresholds exist to delegate decisions to the appropriate organizational level. The board should become directly involved in three situations:

1. A customer is rated very high or unacceptable risk.
2. Mandatory escalation applies, such as for a PEP or correspondent relationship with a third-country bank.
3. The dashboard reveals systemic problems, such as a sharp rise in higher-risk customers without a change in the business profile.

Risks associated with dashboards

Two problems occur most often:

1. Too much data: a dashboard with 50 indicators creates noise rather than visibility. Limit it to 8 to 12 indicators grouped into 4 to 6 areas.
2. Managing to the metric: if employees know the board tracks the proportion of higher-risk customers, they may understate scores to “improve” the figures. Internal audit should periodically review assessment quality, not only numerical results.

Report to the board at least quarterly, and immediately after incidents or regulatory changes.

How we can help your business implement an AML matrix

Implementing risk scoring is not a one-off documentation project. It changes how your organization makes and records customer-acceptance decisions. It requires legal expertise and an understanding of your business, including customer types, products, distribution channels and team structure.

We support obliged entities, including fintechs, payment institutions, cryptocurrency exchanges, accounting firms and real estate intermediaries, in building AML systems that work in practice, not only during inspections. We combine legal advice with the AMLtrack tool, which guides teams through the process step by step.

Our support includes:

1. Reviewing existing procedures: comparing actual practice with the AML Act, KNF positions and GIIF communications.
2. Designing a scoring matrix: selecting criteria, weights and decision thresholds for your institution’s profile.
3. Preparing a risk-assessment form: designing a form the team will use, with conditional logic and automatic totals.
4. Implementing escalation procedures: setting clear rules on who decides, when to involve the board and how to document refusals.
5. Training the team: practical scenarios for completing forms, assessing customers linked to tax havens and responding to positive PEP screening.
6. Ongoing support and monitoring: updating procedures when regulations change, legal alerts and support during GIIF inspections.

An AML matrix as the foundation for responding to GIIF: summary

AML risk scoring removes subjectivity from decisions and gives the board oversight of how the team accepts customers. The six criteria in Article 33(3) of the AML Act are the minimum; your institution may add to them but cannot omit any. Decision thresholds for acceptance, escalation and refusal must be described, calibrated to the business profile and applied consistently. The form must be designed to be used, not avoided.

If your company is an obliged entity and you want to improve customer risk assessments, build a scoring matrix or prepare for a GIIF inspection, contact us. We can help design a system that meets regulatory requirements and works in your team’s day-to-day operations.

Frequently asked questions

Does the AML Act prescribe a specific customer risk-assessment form?

No. The AML Act of 1 March 2018 does not prescribe a form or a particular scoring method. KNF allows quantitative, qualitative and mixed methods, provided the methodology is documented internally and applied consistently to all customers. The institution may choose the format, but GIIF treats the absence of a form or documented assessment as a failure to meet the obligation.

How many risk levels should a matrix have?

Financial-sector practice indicates at least three: low, normal and high. A common addition is a fourth, “unacceptable,” which means the relationship is not established or is terminated under Article 41 of the AML Act. The number of levels should reflect the scale of the institution and the diversity of its customers.

How often should a customer risk assessment be updated?

It is not a one-time exercise. Annex D to KNF guidance recommends reviews every 4 to 5 years for low-risk customers, every 2 to 3 years for standard-risk customers and at least annually for high-risk customers. Update the assessment sooner when circumstances change, for example, a transaction profile or ownership change, or adverse screening information.

Is online screening mandatory?

The AML Act does not expressly name online screening, but it follows from the general duty to apply customer due diligence and monitor relationships. Annex D to KNF guidance recommends collecting information from reliable public sources, including the internet and public registers. Document screening results. The absence of negative information cannot by itself justify a lower score.

What are the consequences of failing to document a customer risk assessment?

Consequences may include administrative fines reaching millions, personal sanctions against board members and people responsible for the AML system, and publication of GIIF penalties, creating reputational risk. Administrative court decisions confirm that a missing document is treated as a failure to meet the obligation, even if an employee says an informal assessment took place.

When must the board personally approve a customer relationship?

The AML Act requires senior-management approval for establishing or continuing a relationship with a PEP, their family member or close associate, and for correspondent relationships with respondent banks in third countries. Internal procedures may require additional escalations, for example for customers in the matrix’s highest risk category.