High-risk customers require enhanced due diligence and closer monitoring under AML regulations. This guide explains who qualifies as high-risk, why it matters, and what your fintech must do when you identify one.
What Is a High-Risk Customer in AML? A Fintech Guide
Not every customer walks through the door with the same level of money laundering or financial crime risk. Some customers — by virtue of who they are, where they're from, or what they do — require more scrutiny than others.
That's the foundation of a risk-based AML approach: identify which customers pose elevated risk, and apply more robust due diligence to those relationships.
What Makes a Customer "High-Risk" in AML?
A high-risk customer is one whose profile, transaction behavior, geographic exposure, or business activities suggest a materially elevated risk of involvement in money laundering, terrorist financing, sanctions violations, or other financial crime.
High-risk customers typically trigger Enhanced Due Diligence (EDD) — additional information gathering, deeper background checks, senior management approval, and more intensive ongoing monitoring.
Common High-Risk Customer Categories
Politically Exposed Persons (PEPs)
Politically Exposed Persons are individuals who hold or have held prominent public positions — government officials, senior military figures, executives of state-owned enterprises, and their immediate family members and close associates. PEPs are considered high risk because their positions give them access to public funds and influence that can be exploited for corruption and bribery.
Money Services Businesses (MSBs)
Money services businesses — check cashers, currency exchangers, remittance companies, and other non-bank financial entities — are considered higher risk because they aggregate transactions from many individuals, creating complexity that can be used to obscure the source of funds.
High-Risk Geographic Exposure
Customers with significant connections to high-risk jurisdictions present elevated risk. This includes: customers residing in or regularly transacting with FATF grey-listed or blacklisted countries, transactions involving sanctioned countries or territories, and customers with business operations in high-corruption-index countries.
Cash-Intensive Businesses
Businesses that handle large volumes of cash — restaurants, car washes, parking lots, nail salons, laundromats — are inherently higher risk because cash is difficult to trace and easy to commingle with criminal proceeds.
Non-Resident Aliens and Foreign Nationals
Foreign customers without established US residency or credit histories require more verification and often present higher risk, particularly if they are residents of high-risk countries.
Customers With Complex Ownership Structures
Businesses with layered ownership, shell companies, multiple jurisdictions of incorporation, or opaque beneficial ownership structures may be used to obscure the identity of the true owner of funds.
Customers With Prior SAR History
If a customer has previously been the subject of a Suspicious Activity Report, they warrant elevated risk classification and enhanced monitoring going forward.
What Must You Do With a High-Risk Customer?
Once you identify a customer as high-risk, your AML compliance program should require:
- Enhanced Due Diligence (EDD): Collect more information than standard CDD — source of funds, source of wealth, business purpose, ownership documentation
- Senior management sign-off: High-risk relationships should be approved by senior compliance or management before onboarding
- Intensified transaction monitoring: Lower alert thresholds, more frequent review
- More frequent profile review: High-risk customers should be reviewed at least annually, some quarterly
- Clear documentation: Your CDD file for high-risk customers should be especially thorough — showing what was collected, what was verified, and the rationale for onboarding
Frequently Asked Questions
Can I refuse to serve a high-risk customer?
Yes. You are not obligated to accept every customer. If the risk of a relationship cannot be adequately mitigated, declining to onboard is a legitimate compliance decision. This is sometimes called "de-risking."
What's the difference between high-risk and suspicious?
High-risk refers to a customer category that requires enhanced due diligence — it doesn't mean the customer is doing anything wrong. Suspicious activity is specific behavior or transactions that give reason to believe criminal activity may be occurring. A high-risk customer can behave perfectly normally; a low-risk customer can engage in suspicious activity.
Do all high-risk customers require EDD?
Yes — if your risk scoring model classifies a customer as high-risk, EDD is required. The specific elements of EDD will depend on why the customer is high-risk and what additional information is needed to understand and manage that risk.
How do I document a high-risk customer relationship?
Your CDD file should contain: all identification documents, the EDD information collected, the risk rating decision with reasoning, the senior management approval, any ongoing review notes, and transaction monitoring decisions related to the customer.
This article is for educational purposes only and does not constitute legal or compliance advice. Regulations vary by jurisdiction and change frequently. Consult a qualified compliance professional or legal counsel for guidance specific to your business.
