Running an AML risk assessment
Overview. IdentityCheck's Tranche 2 module rates each client's money-laundering risk as high, medium or low. The client gives consent, completes an intake form and passes an identity check; then one of your designated staff assessors completes the risk-assessment form and the platform records a defensible rating. That rating is what drives enhanced due diligence, periodic reviews and ongoing monitoring.
IdentityCheck helps you carry out and evidence a customer risk assessment. It does not write your AML/CTF program or decide your firm's risk appetite; those remain your firm's responsibility.
How do I rate a client's AML risk?
Every assessment follows the same fixed flow, so each client is handled the same way and every step is recorded:
- Consent. The client gives their consent before anything else happens, and that consent is captured as part of the record.
- Intake. The client completes your intake form, including any file uploads you ask for.
- Identity check. The client's identity is verified with a biometric check. This step is built into the Tranche 2 flow, so it always runs as part of an assessment.
- AML screening. As soon as the identity check passes, the client is screened against PEP, sanctions and adverse-media sources, so the screening result is ready for the assessor to weigh up. See PEP and sanctions screening and adverse media screening.
- Risk rating. One of your staff assessors opens the assessment, reviews what has come back, completes the risk-assessment form, and the platform records the rating.
Each step is saved as an immutable response, along with a snapshot of the form used at the time, so you have a clear audit record of exactly what was asked and answered.
When the assessor opens the assessment, they see the identity result, the sanctions, PEP and adverse-media screening results, and the client's intake answers together in one place, then submit the rating. Once the decision is made, the assessment becomes read-only.
How does the risk score work?
Each risk-assessment form is set to one of two scoring modes, and you choose the mode per form:
- Manual. The assessor reads the picture and selects low, medium or high directly.
- Calculated. Each answer carries points; the platform adds them up and maps the total to a rating using two thresholds you set (one for medium, one for high). Calculated (automated) scoring is available on the Growth plan and above, not on Starter.
Scoring is worked out on the server. If a submitted rating does not match the score the platform calculates, it is rejected, so a rating cannot be quietly changed. On a calculated form, the assessor can still record a manual override where their judgement differs, and that override is the rating that stands. Either way the completed assessment keeps a full scoring summary: the mode used, the score, the thresholds, and the per-answer breakdown, plus a record of who completed it and when.
The end result is a single, defensible high, medium or low rating for the client that the rest of your Tranche 2 workflow relies on.
Who can complete an assessment?
Risk assessments are deliberately restricted. Only your account owners and admins, plus the specific users you designate as assessors, can open or complete one. You set who those assessors are in your Tranche 2 settings, along with the forms that drive each step. You build and edit those forms, including the risk-assessment form, in the form builder. The Tranche 2 flow cannot be switched on until you have chosen your consent, intake and risk-assessment forms.
You can also generate a time-limited, PIN-protected link so an eligible reviewer who is not logged in can review the context and submit the decision, protected by their own six-digit PIN.
Frequently asked
How do I rate a client's AML risk?
You run the client through IdentityCheck's Tranche 2 flow: they give consent, complete an intake form, pass an identity check, and then a staff assessor completes the risk-assessment form. The result is a clear high, medium or low rating recorded against that client.
How does the risk score work?
Each risk-assessment form uses one of two modes. In manual mode the assessor picks the rating directly. In calculated mode the client's answers score points that are added up and mapped to a rating by set thresholds. The scoring is worked out on the server, so a rating cannot be altered by hand.
Who can complete a risk assessment?
Only your account owners and admins, plus the specific staff you designate as assessors, can open or complete a risk assessment. You choose who those assessors are in your Tranche 2 settings.
Can I edit the assessment forms?
Yes. You install ready-made consent, intake and risk-assessment templates from the StackGo catalog with one click, then edit them freely in the form builder. Each installed form keeps its type so it drives the right step of the flow.