Need business rules for risk-based KYC flows

Below is a practical set of business rules for risk-based KYC flows that you can adapt into policy, requirements, or workflow logic.

1) Core principle

Every customer is assigned a risk rating using a defined risk model.
The KYC depth, review frequency, approval level, and required documents are determined by that risk rating.

---

2) Risk rating inputs

Risk should be calculated from a combination of factors such as:

• Customer type: individual, sole proprietor, SME, corporation, trust, nonprofit
• Geography: country of residence, incorporation, operating locations, sanctions/high-risk jurisdictions
• Product/service used: deposits, payments, lending, crypto, cross-border transfers, trade finance
• Delivery channel: branch, digital, intermediary, non-face-to-face onboarding
• Expected activity: transaction volume, cash intensity, international activity
• Ownership/control complexity: beneficial owners, nominee structures, layered entities
• Occupation/business sector
• Source of funds / source of wealth
• PEP status
• Negative news/adverse media
• Sanctions exposure
• Historical behavior: prior alerts, account activity, fraud/chargeback patterns

---

3) Risk tiers

Use at least these tiers:

• Low risk
• Standard/Medium risk
• High risk
• Prohibited/Restricted where onboarding is not allowed or requires executive approval

---

4) Customer due diligence rules by tier

Low risk

Minimum requirements

• Identity verification
• Basic screening: sanctions, PEP, adverse media
• Address/contact verification where applicable
• Basic purpose of account / relationship
• Simple source of funds declaration for higher-value activity

Typical controls

• Standard approval
• Simplified onboarding journey
• Longer review cycle

Standard/Medium risk

Requirements

• Full identity verification
• Sanctions, PEP, adverse media screening
• Occupation/business verification
• Purpose of account
• Source of funds and expected activity
• Beneficial ownership checks for entities
• Additional document verification as needed

Controls

• Operations/compliance review
• Periodic refresh more frequently than low risk

High risk

Requirements

• Enhanced Due Diligence (EDD)
• Senior compliance approval
• Stronger identity and document verification
• Detailed source of funds and source of wealth
• Open-source and adverse media investigation
• Beneficial ownership and control analysis
• Face-to-face or higher-assurance verification if required
• Verification of business legitimacy, licenses, website, invoices, contracts, etc.

Controls

• Reduced transaction thresholds where appropriate
• Tighter monitoring rules
• More frequent reviews
• Potential limits on products/services

Prohibited/Restricted

Examples

• Sanctioned persons/entities
• Illegal businesses
• Unacceptable jurisdictions or sectors
• Customers failing required identification or screening
• Anonymous or opaque ownership where not permitted

Outcome

• Decline onboarding or escalate to executive/compliance exception process, if your policy allows

---

5) Trigger rules for EDD

EDD must be automatically triggered if any of the following are true:

• Customer is a PEP or close associate/family member of a PEP
• Customer is in or linked to a high-risk jurisdiction
• Customer uses high-risk products or channels
• Complex or opaque ownership structure
• Adverse media indicates financial crime, corruption, fraud, or sanctions risk
• Expected activity is inconsistent with declared profile
• Customer is in a high-risk industry
• Cash-intensive or cross-border business beyond threshold
• Non-face-to-face onboarding with limited assurance
• Prior suspicious activity or internal risk flags

---

6) Document and verification rules

Define required evidence by risk tier:

Low risk

• Government ID
• Basic address verification
• Basic sanctions/PEP screening result

Standard risk

• Government ID
• Proof of address
• Business registration documents
• Ownership documents for entities
• Tax ID where applicable
• Proof of business activity

High risk

• All standard docs
• Beneficial owner IDs
• Corporate structure chart
• Source of funds/wealth evidence
• Financial statements / bank statements / contracts / invoices
• Licensing or regulatory permissions
• Additional proof of operating presence

---

7) Approval rules

Set approval thresholds:

• Low risk: frontline or automated approval
• Standard risk: compliance review for exceptions or failed checks
• High risk: mandatory compliance approval, possibly second-level approval
• Prohibited: onboarding blocked unless formally overridden by designated authority

---

8) Ongoing monitoring rules

Customer risk should be dynamic, not static.

Reassess risk when:

• New sanctions/PEP/adverse media hits appear
• Transaction behavior changes materially
• Ownership changes
• Address, business activity, or jurisdiction changes
• Periodic refresh date is reached
• Alert or investigation occurs

Monitoring intensity by risk

• Low risk: standard transaction monitoring
• Standard risk: enhanced scenario coverage
• High risk: tighter thresholds, more frequent review, manual analyst review for alerts

---

9) Periodic review frequency

A common rule set:

• Low risk: every 24–36 months
• Standard risk: every 12–24 months
• High risk: every 6–12 months
• Prohibited/restricted: no periodic review unless exception handling applies

You can adjust based on regulatory requirements and your risk appetite.

---

10) Negative outcome rules

If screening or due diligence results in unresolved issues:

• Match unresolved and potentially true sanction hit → block onboarding / freeze as required
• PEP hit without required approval → escalate and hold
• Adverse media with serious allegations → EDD and senior review
• Ownership cannot be verified → reject or restrict
• Source of funds cannot be substantiated → decline or limit activity

---

11) Product restriction rules

Restrict products based on risk:

• Low risk: full product access
• Standard risk: limited high-risk products unless approved
• High risk: no cash products, no cross-border transfer, or reduced limits unless approved
• Prohibited: no onboarding/product activation

---

12) Example decision logic

A simple rule sequence:

1. Screen customer for sanctions, PEP, adverse media
2. Determine customer type and jurisdiction
3. Calculate base risk score
4. Apply risk modifiers:
   • high-risk geography +20
   • PEP +30
   • cash-intensive industry +15
   • complex ownership +20
   • non-face-to-face onboarding +10
5. Map final score to tier
6. Apply KYC package for that tier
7. If hard trigger exists, override to EDD or reject
8. Route for approval and activate monitoring

---

13) Sample policy statements

You can use language like:

• “The institution shall apply a risk-based approach to customer due diligence.”
• “Customers shall be assigned a risk rating prior to onboarding and periodically thereafter.”
• “High-risk customers shall undergo enhanced due diligence and senior compliance approval.”
• “Customers subject to unresolved sanctions concerns shall not be onboarded.”
• “KYC refresh frequency shall be determined by assigned risk level.”
• “Transaction monitoring rules shall be calibrated based on customer risk.”

---

14) Suggested control matrix

Risk Tier	CDD Level	Approval	Refresh	Monitoring	Product Restrictions
Low	Standard CDD	Automated/frontline	24–36 mo	Standard	None/minimal
Medium	Standard CDD + extra checks	Ops/Compliance	12–24 mo	Enhanced standard	Select limits
High	EDD	Senior Compliance	6–12 mo	Tight/manual	Significant limits
Prohibited	N/A	Blocked	N/A	N/A	No onboarding

---

If you want, I can turn this into one of these formats:

1. formal policy language,
2. a BPMN/workflow rule set,
3. decision table, or
4. user stories + acceptance criteria.