The Risk Matrix is the final decision point of the compliance workflow. This tool consolidates all collected data, World-Check validations, and automatic jurisdiction analysis to support client acceptance or refusal, ensuring compliance with U.S. anti-money laundering (AML) requirements under the Bank Secrecy Act (BSA), the USA PATRIOT Act, and FinCEN regulations.
The workflow has two pages:
- Risk Matrix — score the entity (Yes/No factors and indicators) and review the resulting values, including Country Risk Analyses.
- Final Check — review everything that must be considered for the risk decision, complete recommended extra steps as a checklist, and generate the Final Report.
Senior approval is a separate decision from the risk level. A lower risk classification can still require senior approval when the case warrants it.
Availability condition
- The Risk Matrix will only become available and active after all matches have been manually resolved by the Compliance Officer. Integration with LSEG World-Check acts as an independent and mandatory verification layer before proceeding to the final assessment.
- The risk matrix is only available if the World-Check option was activated.
Risk Hierarchy
The system is based on the following practical hierarchy, aligned with the FinCEN Customer Due Diligence (CDD) Rule (31 CFR 1010.230), BSA requirements, and a risk-based approach to AML compliance:
| Level | Trigger | Core Obligations |
|---|---|---|
| SDD (Simplified) | Low-risk customers under the institution’s AML program. E.g.: Domestic client, established local banking relationship. | Identification and verification with reduced measures; less frequent monitoring where permitted. |
| Standard CDD | Baseline for all customers and business relationships. | Identify and verify the customer and Beneficial Owner (BO); understand the nature and purpose of the relationship. |
| EDD (Enhanced) | High risk (Basel >= 4.70, PEPs, complex structures). | CDD + Source of Funds, Source of Wealth; senior approval when required as a separate decision. |
| Refusal | Inability to complete CDD/EDD or verify customer identity. | Do not establish the relationship; assess whether a Suspicious Activity Report (SAR) must be filed under the BSA. |
Senior approval is not a risk level. It is recorded independently of Risk Level, Decision, and Periodicity, so enhanced oversight can be applied even when the scored risk is lower.
High-risk jurisdictions (FATF lists, FinCEN advisories) or PEPs, and OFAC-sanctioned parties, still require enhanced measures as mandated by regulation. There is no discretion to treat those situations as standard risk.
Risk Matrix page
From the Verifica Details page, click “Open Risk Matrix”. You land on the Risk Matrix page, which shows:
Values field
A summary of the current assessment:
- Total Score — calculated from the Yes/No answers to factors and indicators.
- Risk Level — the resulting classification (for example SDD, Standard CDD, EDD, or Refusal).
- Decision — acceptance or refusal of the relationship.
- Periodicity — recommended review frequency.
- Senior approval — whether senior/superior approval is required. This field is independent of risk level.
Country Risk Analyses
Automated jurisdiction assessment based on the Basel Index, FATF lists, and OFAC sanctions. Country Risk Analyses may change the values field (score, risk level, decision, periodicity, and/or senior approval). For jurisdictions designated as high risk by FATF or subject to FinCEN advisories, enhanced due diligence measures are mandatory.
Each analysis includes a plain-language explanation of how it affects the Total Score and other values. For example:
The country risk analyses resulted in a recommended minimum Score of 4 + senior approval.
Score explanations (corporate and jurisdiction inputs)
On the Risk Matrix page, selected inputs from the Verifica form are summarized with an explicit score impact, not only a raw value:
-
Incorporation date — the system states the company age at the time of form completion, the incorporation date shown on the form, and whether that age is treated as a higher or lower risk indicator, including points added to the score. Example:
At the time of form completion, the company is 4 months old (incorporation date: 06/01/2026), which is considered a Higher risk indicator — Score + 2.
-
Economic activity (NAICS) — the registered activity code is shown together with whether it adds risk. Example:
The company’s economic activity code (NAICS) is 513210, which carries no additional risk. — Score 0.
These explanations appear alongside Country Risk Analyses so reviewers can see why the Total Score and related fields changed before they confirm factors and indicators.
Changes to Risk Matrix answers are recorded in Case History.
Factors and indicators
All factors and indicators are answered Yes or No. Those answers drive the Total Score. Sections typically include:
- Refusal Factors — criteria that prevent client acceptance.
- High-Risk Indicators — critical points (PEPs, unusual transactions) requiring enhanced due diligence (EDD). Scoring distinguishes PEPs, their family members, and close associates.
- Other Risk Indicators — additional factors influencing the entity’s final classification.
- Reduced Risk Indicators — criteria that may mitigate the entity’s overall risk.
When scoring is complete, click “Go to Final Check”.
Final Check page
The Final Check page is the last review before the report. It includes:
- An overview of all factors that must be taken into account when deciding the risk level.
- Instructions where extra steps are recommended.
- Everything presented as a checklist. Each item that is checked is recorded as done and will appear on the Final Report as completed.
- The document checklist, where you can indicate whether there are red flags on identification and verification records required under the BSA and FinCEN CDD Rule. Compliance officers can open and review the underlying documents directly from the checklist section, without leaving the Final Check page.
- For corporate cases, incorporation date (from the submitted form) is shown here with a score explanation on the Risk Matrix page and included in the risk level calculation (see Score explanations (corporate and jurisdiction inputs)).
When the review is complete, click “Generate Final Report”.
VeriAssistant can also help on this page — it can clarify checklist items and make adjustments directly on the Final Check page. For more information, see the VeriAssistant guide.
Final Report
The Final Report clearly states:
- Relevant information of the entity.
- What was considered and done to decide the risk level, including completed Final Check items and, for corporate entities, incorporation date as a factor in the risk assessment.
- The PEP type (PEP, family member, or close associate).
- The final Risk Level, Decision, Periodicity, and Senior approval if needed.
Legal Obligations
- Suspicious Activity Reporting (SAR — 31 CFR 1010.320): If there are grounds to suspect money laundering, terrorist financing, or other reportable activity, a SAR must be filed with FinCEN within the applicable timeframe under the BSA.
- Confidentiality / No Tipping-Off (31 U.S.C. § 5318(g)(2)): It is prohibited to notify any person involved in the transaction that a SAR has been filed or is being prepared.
- Record Retention (31 CFR 1010.430): Customer identification, due diligence, and transaction records must be retained for at least five years and are stored in a secure cloud repository for audit purposes.
Automatic AI Pre-filling
The Risk Matrix is automatically pre-filled by AI, based on all responses already provided in the Verifica process. VeriAssistant can also help fill in the remaining fields, make changes directly in the Risk Matrix and on the Final Check page, and clarify questions during the assessment. For more information, see the VeriAssistant guide.
Note: It is always recommended to carefully review AI suggestions before confirming the final risk assessment.
Automatically Saved Drafts
Risk Matrix drafts are automatically saved. If the user leaves the page and returns later, the answers already entered remain saved, allowing them to resume the assessment where they left off.
Step-by-Step
- Go to the Verifica Details page of the process in question.
- Click “Open Risk Matrix”.
- Review the values field (Total Score, Risk Level, Decision, Periodicity, Senior approval) and Country Risk Analyses.
- Answer each factor and indicator Yes or No. Senior approval can be set independently of a lower risk level.
- Click “Go to Final Check”.
- Work through the checklist: factors to consider, recommended extra steps, and the document checklist (including any red flags). Checked items will appear on the report as done.
- Click “Generate Final Report” and confirm the entity information, what was considered and completed, and the final Risk Level, Decision, Periodicity, and Senior approval if needed.
- Return to the Verifica Details page and click “Close case” when the compliance review is complete.
Note: Make sure your user role (Compliance Officer) has permission to access the Risk Matrix, otherwise the button may not appear due to profile restrictions.