Understanding Your KYC, KYB and Transaction Risk Scores
A plain-English guide to how easyAML assesses risk: the four categories that get assessed, how they combine.
The customer risk rating is calculated from a combination of your firm's baseline Risk Assessment outcome and per-transaction inputs (entity type, structure complexity, country exposure, transaction value) plus the live screening results (PEP, sanctions, adverse media). AUSTRAC's risk-based approach expects exactly this kind of structured scoring - a model that's transparent, repeatable and auditable.
Should I be concerned about a specific Risk Score?
Not in the way you might think. From an AML perspective, there's no "good" or "bad" risk score - a higher score isn't inherently worse than a lower one. The difference is purely procedural: a higher risk rating simply means more checks, questions, or supporting information are required before you proceed. easyAML guides you through exactly what's needed to stay compliant.
Once those steps are complete, you can service the client as normal. High-risk clients require ongoing monitoring, but easyAML manages that for you in the background - it doesn't change how you do business with them.
Why Does Risk Scoring Exist?
The Anti-Money Laundering and Counter-Terrorism Financing Act (AML/CTF Act) - requires businesses in legal, accounting, real estate, and related sectors to understand and document the risk posed by every client and every transaction they handle. This isn't optional, and it isn't just paperwork: it's a legal obligation to avoid being used - knowingly or unknowingly - as a conduit for financial crime.
easyAML automates this obligation. Rather than leaving a compliance officer to make a judgment call from scratch, the system applies a consistent, transparent, evidence-based framework to every transaction. The result is a risk rating - Low, Medium, High, Very High and Prohibited - that tells you how much scrutiny a transaction warrants and what steps you are required to take.
The Building Blocks: What Gets Assessed?
Every transaction is assessed across four major risk categories. Think of these as four different lenses through which the same transaction is examined.
1. Customer Risk
Who is involved?
This looks at the individuals and entities connected to the transaction - directors, trustees, shareholders, beneficial owners, partners, and so on. The key questions are:
- Have all individuals been properly identified?
- Is anyone a Politically Exposed Person (PEP)? - meaning a current or former government official, senior executive of a state-owned enterprise, or their close associates and family. PEPs carry elevated risk because their position creates opportunities for bribery and corruption.
- Is anyone on a sanctions list (US, Australian, or UN)? A sanctions match is an automatic high-risk flag and a potential legal prohibition on proceeding.
- What type of legal entity is involved - a simple individual, a company, a discretionary trust, a foreign-registered entity, a special purpose vehicle? More complex structures generally carry higher risk because they can obscure who truly controls and benefits from a transaction.
2. Geographic Risk
Where are the people and money coming from?
Every jurisdiction in the world is rated using the Basel AML Index - an internationally recognised, independent ranking of countries by their money-laundering and terrorism-financing risk. Countries are rated Low, Medium, or High.
The system looks at:
- Where individuals reside
- The nationality of individuals
- Where a legal entity was established
- Where a legal entity operates
A transaction involving parties in Iceland or Australia scores very differently from one involving parties in Myanmar or the Democratic Republic of Congo. This isn't a judgment about individuals - it's a recognition that different regulatory environments carry different levels of inherent risk.
3. Industry Risk
What business is being conducted?
The industry the client operates in is assessed using Australian Bureau of Statistics industry codes (ANZSIC), cross-referenced against known AML/CTF risk patterns.
Some examples of how industry affects risk:
- Low risk: Farming, standard retail, education, healthcare, government services
- Medium risk: Construction, hospitality, transport, accounting and legal (where they are the client, not the provider), property management
- High risk: Gambling, casinos, financial broking, jewellery dealing, art dealing, pawnbroking, real estate services, legal and accounting services (because of their known exposure to being used for layering and placement of illicit funds)
4. Transaction Risk
What is actually happening, and how is it being funded?
This is an assessment of the transaction itself - the type of activity being undertaken and where the money is coming from.
Transaction Type examples:
- A simple residential property purchase or will preparation = Low risk
- Establishing a company, trust, or SMSF = Low to Medium
- Business restructuring, share sales, acting as nominee director = Medium
- Escrow arrangements, offshore structuring, rapid property flipping, third-party payments, establishing offshore entities = High
Source of Funds examples:
- Salary/PAYG, superannuation, proceeds from selling your home, inheritance via a solicitor's trust account = Low
- Business income, investment property sale, divorce settlement, loan from Australian bank = Medium
- Large cash savings with limited paper trail, cryptocurrency proceeds, funds from high-risk jurisdictions, third-party funding, unexplained wealth = High
How the Score Is Calculated
Each individual factor (country, industry, individual status, transaction type, etc.) is scored on a 1–5 scale:
Within each group, scores are combined as a weighted average in which higher-risk items carry proportionally more weight - so a single high-risk factor is never diluted away by several low-risk ones. These grouped scores roll up into the four categories (Customer, Geographic, Industry, Transaction), and each category is assigned a weighted importance in the overall calculation:
The four category scores are combined as a weighted average to produce a Total Weighted Score between 0 and 5.
That final number maps to a risk rating:
Note: Some assessments are run differently depending on context. A KYC-only assessment (for an individual with no business entity) uses Customer Risk (40%) and Geographic Risk (60%) only. A KYB-only assessment (for a business with no transaction yet) uses Customer Risk (40%), Industry Risk (20%) and Geographic Risk (40%). A full transaction assessment includes all four, using the weights above.
What Happens After a Score Is Produced?
The risk rating drives what happens next. This is the point of the exercise - not to label clients, but to calibrate the level of due diligence required.
Low Risk - Standard due diligence. Identification and verification of the client, basic document collection, and file noting. Needs to be reviewed every 2-3 years.
Medium Risk – The easyAML Platform automatically screens customers for politically exposed person (PEP) status, sanctions matches, and adverse media findings. Where no PEP match, sanctions match, or adverse media finding is identified, Standard Due Diligence will generally apply.
Where a PEP match, sanctions match, or adverse media finding is identified, the easyAML Platform will automatically prompt the user to complete Enhanced Due Diligence.Review medium risk clients at least every 2 years, or earlier if a trigger event occurs.
High Risk - Enhanced Due Diligence (EDD) is required. This means actively obtaining and verifying the source of wealth and source of funds, escalating to a senior compliance officer, increasing transaction monitoring frequency, and potentially declining to act if the risk cannot be adequately mitigated. In some cases, a Suspicious Matter Report (SMR) may be required to AUSTRAC. Needs to be reviewed annually.
Sanctions override
Before the rating is finalised, the model checks whether any individual or legal entity in the assessment returned a sanctions match in Step 1. If so, the total weighted score is forced to 5 and the risk rating is set to Prohibitive and EDD, overriding the calculated result. This ensures a sanctions hit can never be diluted by otherwise low-risk attributes.
Why Gives this Score its Reliability?
It's based on authoritative external data. Country risk ratings come from the Basel AML Index, an independent global benchmark used by compliance professionals worldwide. Industry codes are drawn from the official ANZSIC classification system.
It's consistent. Every transaction of the same type, from the same jurisdiction, with the same parties, will receive the same score. There's no variability based on who happens to be reviewing the file that day.
It's documented. Every score is traceable - you can see exactly which inputs drove the result. This is essential for demonstrating to AUSTRAC or a court that your compliance decisions were made on a reasoned, evidence-based basis.
It's calibrated to Australian obligations. The scoring thresholds, the transaction types, and the due diligence triggers are all designed with the AML/CTF Act and AUSTRAC guidance in mind.
It's a floor, not a ceiling. The system produces a score, but your professional judgment still applies. If something about a client or transaction doesn't feel right - even if the score says Low - you retain the ability and obligation to apply greater scrutiny. The score ensures you never do less than is required; it doesn't prevent you from doing more.
A Simple Example
Imagine a transaction where:
- The client is a domestic individual, fully identified, no PEP, no sanctions (Customer: Low)
- They live and operate in Australia (Geographic: Low)
- They work in real estate services (Industry: High)
- They are purchasing a residential property funded by savings and a bank loan (Transaction: Low)
The weighted calculation might produce an overall score in the Medium range - not because anything is obviously wrong, but because the industry flag (real estate is a known vehicle for money laundering in Australia) elevates the result enough to warrant enhanced standard due diligence and source of funds documentation.
That's the system working as intended: surfacing the right level of scrutiny automatically, so nothing gets missed.
Related articles