KYB risk assessment: risk factors, scoring and a worked example

What is a KYB risk assessment?

A KYB risk assessment is the customer risk assessment, or customer risk scoring, of a business customer: you score the company, its owners and the relationship you are about to open against defined risk factors, and the resulting level decides how much due diligence you apply and how often you review it. A risk matrix is the written rulebook that turns those factors into a level, so that two analysts looking at the same file reach the same answer.

The law asks for the analysis, not for a formula. Under the AMLR, the extent of due diligence follows "an individual analysis of the risks" of each customer (Article 20(2), Regulation (EU) 2024/1624), and you must be able to show your supervisor that the measures fit the risk (Article 20(4)). Then the matrix meets the analysts. On Dotfile, when an analyst overrides the engine, nearly two times in three they lower the level: the rulebook is stricter than the people applying it. Below: the factors, 6 steps, a worked example and what to do with your overrides.

Business-wide or customer risk assessment: what is the difference?

The business-wide risk assessment looks at your firm: which customers, products, channels and countries expose you to money laundering, terrorist financing and sanctions evasion. Today it is required by Article 8, Directive (EU) 2015/849 as transposed in each country; from 10 July 2027 it is Article 10, Regulation (EU) 2024/1624, which adds that the compliance officer draws it up and the management body approves it.

The customer risk assessment applies that picture to one customer. Today it rests on Article 13(2) and (3), Directive (EU) 2015/849: due diligence on a risk-sensitive basis, taking into account at least the Annex I variables. Article 20(2), Regulation (EU) 2024/1624 ties it explicitly to the business-wide assessment. Your matrix is where the two meet: the firm-level view decides which factors and weights it carries.

Which risk factors does a KYB risk assessment score?

A risk factor is a characteristic of the customer or the relationship that raises or lowers the likelihood of money laundering. The AMLR lists them in its annexes: risk variables in Annex I, lower-risk factors in Annex II and higher-risk factors in Annex III of Regulation (EU) 2024/1624. Directive 2015/849 has the same structure today, with Annex III applied through Article 18(3). For a business customer, they group into five families:

The EBA Guidelines on ML/TF risk factors (EBA/GL/2021/02) detail the same families for financial institutions, on the risk-based approach of FATF Recommendation 1. AMLA's own guidelines on risk factors, due by 10 July 2026 under Article 20(3) AMLR, are not out yet: build on the EBA ones until they land.

The ownership row is where KYB differs from KYC: you cannot score it without first mapping the ownership structure, verifying the UBOs and screening the people at the top of it.

How do you run a KYB risk assessment in 6 steps?

1. Pick the factors your business-wide assessment says matter. Ten factors you can source beat thirty you guess.
2. Define a scale for each, such as 1 to 3. Put long lists (countries, sectors) in lookup tables, so a list change is one edit.
3. Weight them to reflect your exposure: a payments firm weights geography and flows, a lender weights sector. Weights add up to 100%.
4. Set thresholds that turn the score into levels, and fix them before you look at the portfolio.
5. Add flags that override the score. Some facts end the discussion whatever the arithmetic says. A confirmed sanctions match means prohibited: an asset freeze leaves nothing to weigh (Article 2, Council Regulation (EU) No 269/2014), and from 2027 Article 20(1)(d), Regulation (EU) 2024/1624 makes the check part of due diligence. A confirmed PEP should floor the level at high, since PEP rules require (Article 20(b), Directive (EU) 2015/849 today; Article 42 of the AMLR from 2027) senior management approval, source of wealth and funds and enhanced ongoing monitoring anyway.
6. Tie each level to consequences. Each level should set the due diligence depth, the approver and the review date. Under Article 26(2), Regulation (EU) 2024/1624, the period between updates may not exceed 1 year for customers under enhanced due diligence and 5 years for everyone else. Today's directive sets no maximum; it asks for reviews "at appropriate times" on a risk-sensitive basis (Article 14(5), Directive (EU) 2015/849).

Then version it. A matrix changes, and a supervisor asking why a file was rated medium in March wants the March rules, not today's.

Worked example: a medium score with a high result

A fictional Dutch freight forwarder, Van Loon Forwarding BV, applies for a business account to pay carriers across Europe and Turkey. Its managing director owns 30%. The other 70% sits in a Cyprus holding company wholly owned by one person, Kees. The matrix scores each factor from 1 (low) to 3 (high):

With thresholds at under 1.7 for low, 1.7 to 2.3 for medium and above 2.3 for high, Van Loon scores medium.

Then screening comes back. Kees left office as a deputy minister eight months ago, and the analyst confirms the PEP hit. A former PEP stays subject to at least one of the enhanced measures listed in Article 34(4) for at least 12 months after leaving the function (Article 45(2), Regulation (EU) 2024/1624; "appropriate and risk-sensitive measures" under Article 22, Directive (EU) 2015/849 today). The PEP flag floors the level at high and your policy applies two of them: senior management signs off and the analyst documents Kees's source of wealth and the source of the funds. The file is reviewed within a year.

The score was right about the business. The flag was right about the person. A matrix that only adds numbers would have opened this account as medium.

How often do analysts overrule the risk engine? 1 in 140 cases

Based on cases created on Dotfile over the past year; aggregates only.

• 98% of current risk levels were set by a risk engine, 2% by hand. Across all of them, 68% were low, 24% medium, 5.8% high and 1.2% prohibited.
• Analysts overrode the engine on about 1 in 140 engine-scored cases. When they did, they lowered the level nearly two times in three (64%) and raised it a third of the time (33%).
• 63% of the high levels set by an engine carried at least one flag, a rule that fires regardless of the score.

Act on the second point. Overrides that mostly go down mean the matrix is stricter than the people applying it. Either the analysts are wrong or the weights are: read the override comments every quarter and fix whichever it is.

Frequently asked questions

What is the difference between a risk score and a risk level?

The score is the arithmetic: weighted factors added up. The level is the decision (low, medium, high, prohibited) that the score and the flags produce together. Due diligence, approvals and review dates follow the level.

Is a risk matrix mandatory?

The format is not. The analysis is: Article 13(2) to (4), Directive (EU) 2015/849 today and Article 20(2) and (4), Regulation (EU) 2024/1624 from 2027 require a risk analysis per customer and the ability to show it was appropriate. A written, versioned matrix is the simplest way to show it.

What is a risk engine?

A risk engine is software that applies your risk matrix automatically: it reads the case data, runs the scoring rules and the flags and sets the risk level, every time the case changes. Dotfile's risk engine runs those rules as versioned low-code.

Can an analyst override the risk engine?

Yes, and they should be able to, with a written reason kept on the file. An override without a reason is a decision nobody can audit.

How often should a KYB risk assessment be updated?

At each periodic review and whenever something material changes: a new owner, a new country, a screening hit. See our guide to ongoing KYB monitoring and to AML screening.

What is the difference between a risk matrix and a risk assessment?

The assessment is the obligation; the matrix is the tool. Our risk matrix guide covers the format, and the KYB process shows where scoring sits.

Where Dotfile fits

Dotfile's risk engine runs your matrix as low-code rules on the data already in the case: the company, its individuals and their checks, including confirmed AML hits by list type. Country and sector lists live in lookup tables uploaded as spreadsheets. Each run sets a level, a score, its components and the flags that fired, and the engine is versioned, so a past rating points to the rules that produced it. Risk scoring is recomputed as the case changes, and an analyst can override the level in manual mode, with a comment required by default.