Customer risk assessment — factors, levels and proof on paper.
Customer risk assessment — factors, levels and proof on paper.
An obliged entity assesses the risk of every client and matches the due diligence measures to it: simplified, standard or enhanced. Here are the factors you must consider and how to record the result.
- Sanctions: MSWiA, EU, OFAC
- KNF warnings
- Beneficial owners (CRBR)
- Financials and filings
- Bankruptcy, liquidation, KRZ
- VAT status and accounts
- Press coverage
- 0–100 risk score and PDF
Money back if the report cannot be generated
For companies: the first 2 reports free (in Polish)
What the Act says
An obliged entity identifies the money-laundering and terrorist-financing risk attached to a business relationship or an occasional transaction and assesses its level (art. 33(1)–(2) of the AML Act). The assessment considers in particular factors relating to:
- the customer — type, legal form, ownership structure, industry, purpose of the relationship, time in business;
- the country or geographic area — the client's seat, the owner's country, the counterparties' countries;
- the product, service or transaction — cash, virtual currencies, real estate, anonymity, unusual value;
- the delivery channel — a relationship established remotely or through an intermediary (art. 33(3)).
The assessment is documented (art. 33(4)). It is tied to the entity-wide risk assessment under art. 27 — where the entity describes which factors it treats as raising risk and how it weighs them. The intensity of the measures follows the result: standard measures under art. 34, simplified at lower risk (art. 42), enhanced at higher risk (art. 43). Full text: isap.sejm.gov.pl.
Risk factors in practice
| Group | What to look at | What raises the risk |
|---|---|---|
| Customer | legal form, company age, PKD code, structure, board | an LLC set up a few months ago, minimum capital, frequent board changes, a foreign shareholder, a cash-heavy industry |
| Country | seat, owners, counterparties | a country on the EC or FATF high-risk list, a tax haven, a sanctioned country |
| Product | type of service, value, form of payment | cash, virtual currencies, real estate, gold trading, transactions with no visible rationale |
| Channel | how the relationship was established | a purely remote relationship, through an intermediary or attorney, no contact with the owner |
Levels of measures
SDD — simplified (art. 42): allowed when the risk is lower — e.g. the client is a listed company, a public-finance entity or an EU obliged entity. You still identify the client and monitor the relationship, but with less intensity. SDD is not allowed where money laundering is suspected.
CDD — standard (art. 34): the default set — identification and verification of the client and the owner, assessment of the purpose of the relationship, ongoing monitoring.
EDD — enhanced (art. 43): mandatory, among others, for a PEP client, a client from a high-risk third country, an unusually complex ownership structure, transactions of unusual value or without rationale, and relationships whose context points to higher risk. In practice: extra documents, source of wealth and funds, management approval, more frequent monitoring.
An example assessment card
Client: a construction LLC registered 8 months ago, share capital PLN 5,000, sole shareholder a Cypriot company, a one-person board, relationship established remotely, payments by bank transfer, service: bookkeeping.
| Factor | Finding | Effect |
|---|---|---|
| Customer | young company, minimum capital, foreign shareholder | raises |
| Country | seat in Poland, owner established via the CRBR, EU citizen | neutral |
| Product | bookkeeping, bank transfers, no cash | lowers |
| Channel | remote, no meeting with the owner | raises |
Result: elevated risk, CDD with extra actions — confirm the owner with a document from the Cypriot register, ask about the purpose of the relationship and expected turnover, review after 6 months. Reasoning, date, signature.
Four mistakes in customer risk assessment.
A GIIF inspection does not question the result — it questions the missing reasoning.
How the report helps
The complete AMLA dossier gives a ready basis for the assessment card: a 0–100 score in five domains — I Identification, II Structure and UBO, III Sanctions and PEP, IV Financials, V Reputation — where 0 means no signals, and every point is tied to a factor and the source it came from. The rules are deterministic: the same NIP on the same day gives the same result, with no AI. At the end the report proposes a level of measures — SDD, CDD or EDD — and a list of recommended actions, such as "request a source-of-funds document" or "clarify the CRBR discrepancy".
You carry the report's factors onto your own card: customer (form, age, PKD, structure), country (seat and owners), and add what you know from the relationship for the product and channel factors. The final rating and signature are yours — the report is the evidence of what you based it on. The scoring method is in the methodology. See also: customer identification, financial standing, 5-year records.
Legal status as of October 2026. Information only, not legal advice.
The 0–100 score and the proposed level are in the full report.
The free check shows the registers. Risk factors with points, the proposed SDD/CDD/EDD level and the action list are in the AMLA dossier.
Questions about customer risk assessment.
Assess a client's risk by NIP.
Factors with points and sources, a proposed SDD/CDD/EDD level and an action list — in one PDF, in up to 3 minutes.