ML-Enhanced AML Customer Risk Rating Model

Customer Overview

The client is a regulated financial institution operating across retail, SME, corporate, and private banking segments, with exposure to domestic and cross-border transaction corridors. Operating under AML/CFT obligations governed by FATF, RBI, OCC, and FinCEN, the institution maintained a rules-based Customer Risk Rating framework to classify customers and drive due diligence decisions. Growing regulatory scrutiny, rising investigation costs, and mounting false positives from an insufficiently risk-sensitive model created pressure to modernize the CRR program without introducing governance risk.

Project Overview

The client partnered with TenUp to redesign and implement a Customer Risk Rating model capable of producing defensible Low, Medium, and High risk classifications across its full customer base. The existing rules-only framework treated customers with similar profiles identically regardless of behavioral differences, and could not satisfy regulators' expectations for dynamic, proportionate risk assessment. TenUp was engaged to deliver a hybrid model combining policy-driven scoring with a controlled machine learning layer, fully aligned to FATF, RBI, OCC, and FinCEN supervisory requirements.

Challenges

Modernizing the CRR model required balancing regulatory explainability, ML governance constraints, and risk precision, without relaxing existing AML controls or increasing operational burden.

• Rules-based scoring applied uniform weights regardless of customer behavior, leaving customers with identical profiles but different transaction patterns at the same risk level.
• High false positive rates drove disproportionate EDD escalations, overloading investigation teams with low-value reviews without a corresponding improvement in risk coverage.
• Static, backward-looking assessments could not detect behavioral anomalies early, limiting the effectiveness of ongoing monitoring and STR workflows.
• Regulatory and audit resistance to ML created a hard constraint; any model incorporating ML required full explainability, traceability, and governance approval before deployment.
• Scoring logic lacked the granularity to assess customer type, product exposure, geography, onboarding channel, and transaction behavior as independent, auditable risk dimensions.
• Poor investigator prioritization meant high-risk customers were not consistently surfaced first, weakening the defensibility of EDD and case escalation decisions.
• Any model redesign had to remain fully aligned to FATF's Risk-Based Approach, RBI proportionality requirements, and OCC and FinCEN model governance expectations without relaxing existing controls.

Solution

TenUp designed and implemented a hybrid AML Customer Risk Rating model combining policy-driven scoring with a controlled ML layer to deliver explainable, regulator-defensible risk classifications across the full customer base.

• Built a rules-based scoring framework assessing customer type, products and services, geography, onboarding channel, transaction behavior, and regulatory history as independent, auditable risk dimensions with policy-defined weights approved by Compliance, Risk, and Governance.
• Mapped country-level exposure against FATF grey and black lists and RBI high-risk country designations to keep geography-based scoring aligned with current supervisory expectations.
• Deployed a supervised ML model as a bounded behavioral overlay to detect whether a customer was transacting riskier than peers with a similar inherent risk profile, without modifying policy weights or overriding rules-based scores.
• Applied strict caps, adjustment thresholds, and governance controls to the ML layer, keeping all behavioral adjustments within compliance-approved limits and subject to model validation and periodic review.
• Mapped final scores to Low, Medium, and High classifications, each tied to defined due diligence outcomes: simplified monitoring, targeted review, or mandatory EDD with senior approval.
• Maintained score-level traceability for every customer, with documented risk logic and regulatory rationale per contributing factor to support audit response and regulatory examination.
• Delivered the model via API for integration with existing AML monitoring and case management platforms without requiring infrastructure changes.

Benefits

The customer risk rating model TenUp built for reliable AML compliance across multiple financial institutions offered the following benefits:

• Reduced false positives and unnecessary EDD escalations, enabling investigators to focus on genuinely high-risk customers.
• Earlier detection of behavioral outliers across customers with similar profiles, strengthening EDD prioritization and case decisions.
• Score-level explainability and audit traceability ensured defensibility across RBI, FATF, OCC, and FinCEN examinations.
• Bounded ML adjustments and policy-defined controls introduced behavioral intelligence without compliance or governance exposure.

Technology

• Python
• Pandas
• Scikit-Learn
• Django
• SQL Server

Industry

• FinTech