Choosing point values for your risk rating rules

Before you start

Risk scoring works like a running total. Each fact you choose to score adds points to a customer's total, and the total decides their risk rating. Three terms to know:

• Points: the number a fact adds to a customer's total
• Band: a risk level, such as Low, Medium or High
• Threshold: the score a customer has to reach to move up into the next band

Before you give any fact a number, decide your thresholds. For example, decide how many points it takes to move from Low to Medium, and from Medium to High. A number only means something once you know where those lines sit.

There is no standard set of point values to copy, because the right numbers depend on your own compliance program. For background on how points add up to a rating, see Understanding risk scoring points vs checklists.

Choose what to score

Pick the facts you want to count. These are common choices:

• A suspicious matter report (SMR) filed about the customer in a recent window, often the last 12 months. An SMR is the report you send to AUSTRAC when you suspect something is wrong. It's usually the most serious of the activity-based facts.
• An unusual activity report (UAR) filed in the same window. A UAR is an internal report staff raise when something looks out of the ordinary. It's usually less serious than an SMR, and several in the window are more serious than one.
• Other events or forms recorded against the customer in a recent window, such as incident reports, payout checks, source-of-funds checks (where the customer's money came from) and large-transaction flags.
• Screening results. Screening checks a customer against lists of people who carry higher risk. A confirmed match to a politically exposed person (PEP, someone in a prominent public role) or to a sanctions list (people and organisations that governments have restricted) is the most serious. Adverse media (negative news coverage), regulatory enforcement and 'profile of interest' results are less serious.
• Answers to your own custom fields, which are the extra questions you've added to customer profiles. Examples are a geography, conduct or liquidity risk assessment, or a net worth threshold.
• Basic details about the person, such as an occupation on a higher-risk list, their nationality, or missing citizenship details.
• Already being rated High, combined with recent activity. This keeps someone at High until the activity is old enough to fall outside the window.

Which of these belong in your program, and how many points each is worth, is your decision.

Set the points

Three rules help.

Serious facts should reach a new band by themselves

If a fact should put a customer in front of a person straight away, give it enough points to reach the next band on its own. For example:

• A confirmed sanctions match. Nobody wants to wait for a second warning sign before someone looks at it.
• An SMR filed last month. Someone has already judged that something was wrong.

Small facts shouldn't push anyone up a band alone

If one small fact moves a customer up a band, too many customers end up Medium or High. Your team is buried in reviews and stops trusting the rating. For example:

• Not holding Australian citizenship. Most people who aren't citizens are perfectly ordinary customers.
• Working in a cash-heavy job, like a hospitality owner or a tradesperson. It's worth noting, but it says very little on its own.

Small facts should still add up

Several small concerns together say more than any one of them does. Give them enough points that a handful together will reach the next band, even though no single one does. That's why scoring works better than yes/no rules: it spots the pattern. For example, someone who:

• works in a cash-heavy job,
• lives overseas,
• has an identity check that's overdue,
• has a low-level adverse media hit, and
• had an unusual activity report filed on them a few months ago.

None of these would trigger a review alone. Together they describe a customer your compliance officer would want to look at.

Test your numbers

Once you've set your points:

1. Find the smallest number of points you've given any fact. Count how many facts at that score it would take to reach the next band. If 1 or 2 would do it, the points are too high. If realistic customers would never get there, they're too low.
2. Pick a few customers whose right rating you already know. Check what rating your points give them, and adjust until it matches your judgement.

Points are only as good as the numbers behind them, so revisit them as your risk appetite (how much risk you're comfortable accepting) changes.