The Risk Matrix is the final decision point of the compliance workflow. This tool consolidates all collected data, World-Check validations, and automatic jurisdiction analysis to support client acceptance or refusal, ensuring compliance with U.S. anti-money laundering (AML) requirements under the Bank Secrecy Act (BSA), the USA PATRIOT Act, and FinCEN regulations.
Availability condition
- The Risk Matrix will only become available and active after all matches have been manually resolved by the Compliance Officer. Integration with LSEG World-Check acts as an independent and mandatory verification layer before proceeding to the final assessment.
- The risk matrix is only available if the World-Check option was activated.
Risk Hierarchy
The system is based on the following practical hierarchy, aligned with the FinCEN Customer Due Diligence (CDD) Rule (31 CFR 1010.230), BSA requirements, and a risk-based approach to AML compliance:
| Level | Trigger | Core Obligations |
|---|---|---|
| SDD (Simplified) | Low-risk customers under the institution’s AML program. E.g.: Domestic client, established local banking relationship. | Identification and verification with reduced measures; less frequent monitoring where permitted. |
| Standard CDD | Baseline for all customers and business relationships. | Identify and verify the customer and Beneficial Owner (BO); understand the nature and purpose of the relationship. |
| EDD (Enhanced) | High risk (Basel >= 4.70, PEPs, complex structures). | CDD + Source of Funds, Source of Wealth, senior management approval. |
| Mandatory EDD | High-risk jurisdictions (FATF lists, FinCEN advisories) or PEPs; OFAC-sanctioned parties. | Enhanced measures required by regulation; no discretion to treat as standard risk. |
| Refusal | Inability to complete CDD/EDD or verify customer identity. | Do not establish the relationship; assess whether a Suspicious Activity Report (SAR) must be filed under the BSA. |
Integrated Risk Matrix Structure
The Matrix is organized into strategic sections that guide the Compliance Officer from geographic analysis to the final decision:
- Country Risk Matrix: This is the initial structuring section. Automated jurisdiction assessment based on the Basel Index, FATF lists, and OFAC sanctions. For jurisdictions designated as high risk by FATF or subject to FinCEN advisories, enhanced due diligence measures are mandatory.
- Refusal Factors: Immediate identification of criteria that prevent client acceptance.
- High-Risk Indicators: Critical points (PEPs, unusual transactions) requiring enhanced due diligence (EDD).
- Other Risk Indicators: Additional factors influencing the entity’s final classification.
- Reduced Risk Indicators: Criteria that may mitigate the entity’s overall risk.
- Document Checklist: Verification of compliance and validity of all customer identification and verification records required under the BSA and FinCEN CDD Rule.
- Additional Questions: Final assessment focused on source of funds and absence of suspicions of Money Laundering or Terrorist Financing (ML/TF).
Legal Obligations
- Suspicious Activity Reporting (SAR — 31 CFR 1010.320): If there are grounds to suspect money laundering, terrorist financing, or other reportable activity, a SAR must be filed with FinCEN within the applicable timeframe under the BSA.
- Confidentiality / No Tipping-Off (31 U.S.C. § 5318(g)(2)): It is prohibited to notify any person involved in the transaction that a SAR has been filed or is being prepared.
- Record Retention (31 CFR 1010.430): Customer identification, due diligence, and transaction records must be retained for at least five years and are stored in a secure cloud repository for audit purposes.
Automatic AI Pre-filling
The Risk Matrix is automatically pre-filled by AI, based on all responses already provided in the VeriKYC process. VeriAssistant can also help fill in the remaining fields, make changes directly in the matrix, and clarify questions during the assessment. For more information, see the VeriAssistant guide.
Note: It is always recommended to carefully review AI suggestions before confirming the final risk assessment.
Automatically Saved Drafts
Risk Matrix drafts are automatically saved. If the user leaves the page and returns later, the answers already entered remain saved, allowing them to resume the assessment where they left off.
Step-by-Step to Generate the Risk Matrix
- Go to the VeriKYC Details page of the process in question.
- Locate and click the “Open Risk Matrix” button.
- Evaluate the structured sections (Refusal Factors, Risk Indicators, Document Checklist, and Additional Questions).
Note: Make sure your user role (Compliance Officer) has permission to access the Risk Matrix, otherwise the button may not appear due to profile restrictions.