How do you successfully operationalize your client risk rating model?

What are the key challenges of CRR models and how can they be mitigated with best practices?

We observe four key challenges of CRR models. For each of these, there are certain best practices that financial institutions can adopt to optimize the quality and results of their CRR models.

1. Upstream data accuracy
   Data is only as good as what is requested by the financial institution and provided by the client. Therefore, policies on minimum data requirements and data validation controls are essential to ensure the front office obtains the required data from the client and it is validated effectively. Data validation and corroboration controls are especially important for information that depends more on the client’s input and has a higher degree of AML risk such as source of wealth/funds and rationale for third- party transactions. Moreover, putting these controls into practice is typically driven by the tone from management and the AML risk culture within the financial institution.
   In addition to information capture policies and controls, system controls are also very useful to drive data accuracy. All data required for the CRR model should be captured once in the respective gold-source system (e.g., CRM) and required fields should be made mandatory, taking into account the dependent question logic required by the model. The CRR model should simply operate in the background as a consumer of data from the gold source. Duplicate data entry should be discouraged so as to remove the risk of data in the golden source not matching that in the CRR model. Other relevant data sources for CRR can be the actual transactions of the client, negative news search results or sanctions lists.
   
   
2. Client risk rating model accuracy and calibration
   Due to the complexity of identifying clients involved in money laundering, it is very common for client risk rating models to produce false positives, which may drive unnecessary due diligence effort, and false negatives, which may result in fines or penalties for not identifying the money laundering activities. Due to the implications of these false positives and false negatives financial institutions are increasingly seeking to test and calibrate their models to reduce these false results.
   A common approach to calibration is to run simulations on the model, applying different weightings on the risk factors and comparing results to independent sample checks of clients where expert guidance on the desired client risk classification is known. This approach seeks to ensure those risk factors with the higher degree of AML risk contribute toward the overall rating of the client.
   Certain financial institutions are also exploring AI/machine learning models to classify the clients and produce explanations on the rationale behind the risk classification. While this appears to be the mid to long term-trend, many regulatory complexities remain in properly complying with current regulations and explaining why the model made certain decisions.
   
   
3. Client risk rating model governance
   Client risk rating model governance can become complex given the coordination and alignment required between the front office and compliance. In simple terms, compliance should typically own the model while the front office should own the data which is directed into the model. That said, both the compliance team and the front office should ensure alignment in how the model operates within the financial institution so as to ensure an efficient front office approach while applying an effective model to identify money laundering risk.
   Relating to the governance involved around the model, a financial institution typically has a dedicated client risk rating team that owns the model and is responsible for ensuring all risk factors are properly considered and the model has a high degree of accuracy. In practice this typically translates into a regular (e.g., annual) review of the risk factors in the model relative to regulatory requirements and how these risk factors contribute to the risk ratings of clients within the bank. Furthermore, the financial institution should incorporate a regular (e.g., annual) calibration and/or validation of the model to maximize model accuracy.
   Regular reviews of the model may result in potential model changes. Financial institutions should have a clearly defined governance that dictates how model changes are tested and approved prior to being rolled out. If the model change does not require any new data, this change is typically simulated and substantially tested to understand the impact it would have on the client population. If the change requires new data from the client, the financial institution needs to assess whether proactive outreach is critical to obtain this information or if it can be captured during the next periodic review cycle.
   
   
4. Dynamic risk factors
   In addition to static risk factors (e.g., domicile), which do not change or only change very infrequently, certain risk factors are dynamic and change frequently. Examples of these dynamic factors include transaction behavior, assets with the financial institution and product types owned by the client. Generally, it is expected that financial institutions incorporate dynamic factors on a regular basis (e.g., quarterly, semi-annually) to ensure the risk correctly reflects the current client situation. This is especially important with transaction behavior as this risk factor is relatively important to detect money laundering activities.
   Incorporating dynamic transaction behavior into the client risk rating model can be very complex due the vast amounts of data, fragmented IT landscapes and differences between the transaction monitoring system lens and CRR lens. We often see financial institutions setting up specific transaction behavior scenarios for the CRR model that differ from the scenarios currently set up in the transaction monitoring system. There is also often the need to define different thresholds depending on specific client groups due to differences experienced across business lines (e.g., transaction volume in retail vs. corporate banking).