Deterministic weighted scoring models for customer risk rating under MLR 2017

Research Question

To what extent do deterministic weighted scoring models (based on the four main risk factors: customer, geographic, product/service, and delivery channel) effectively support a proportionate risk-based approach to customer due diligence (CDD) under the Money Laundering Regulations 2017 (MLR 2017), and what are their limitations compared to hybrid or machine learning-enhanced alternatives?

Findings

Executive Summary

Deterministic weighted customer risk rating (CRR) models are a legally defensible but only partially validated way to implement the Money Laundering Regulations 2017 (MLR 2017) risk-based approach, because the regulations require proportionate factor-based assessment but do not require fixed weights or prove that static scores predict suspicious outcomes.

Their main advantage is auditability: firms can explain which customer, geography, product or service, and delivery-channel inputs drove a risk rating and then show why that rating led to standard or enhanced customer due diligence (CDD).

Their main weakness is that public evidence reviewed here does not connect onboarding risk bands to suspicious activity report (SAR) or investigation outcomes, while both practitioner and banking-governance sources point to stale data, inconsistent factors, and missing behavioral context as recurring failure modes.

Hybrid models that keep an interpretable deterministic backbone and add behavioral, statistical, or network overlays are the best-supported improvement path, because open literature shows machine learning (ML) is more credible on richer behavioral data than on sparse labeled onboarding data, while prior finance-sector governance research still points toward explainability and human oversight as non-negotiable controls.

Key Findings

1. Deterministic weighted CRR models fit the legal shape of MLR 2017 because Regulation 18 and Regulation 28 require firms to assess customer, geography, product or service, transaction, and delivery-channel risks proportionately, but they do not prescribe a mandatory numeric weighting formula.
2. The main regulatory strength of deterministic CRR is auditability, because firms can show which factors, points, overrides, and thresholds produced a rating and then connect that rating to standard, enhanced, or simplified due-diligence decisions.
3. Published practitioner descriptions show that real CRR models are usually point-based or weighted systems with factor-specific weights and automatic high-risk triggers rather than purely discretionary narratives, but the exact mechanics vary materially by institution.
4. Static deterministic CRR models are vulnerable to stale data, cross-business inconsistency, and missed interactions between factors, which means they tend to drift away from actual risk unless firms recalibrate them and update profiles continuously.
5. Publicly accessible UK evidence supports deterministic CRR as a process control, but it does not validate deterministic customer-risk bands against SAR or investigation outcomes, so claims of predictive effectiveness remain materially under-evidenced.
6. Open-access AML research indicates that supervised ML is constrained by the scarcity of high-quality labeled laundering datasets, while unsupervised, reinforced, and network-oriented methods are more feasible for detecting unusual behavior than for replacing onboarding scores outright.
7. Basel guidance pushes firms beyond one-time deterministic scoring because it expects customer risk profiles to incorporate intended relationship purpose, expected activity, behavior over time, and ongoing monitoring, all of which reward dynamic rather than static models.
8. Hybrid models that keep an interpretable deterministic backbone and add behavioral, statistical, or network overlays are the most regulator-friendly improvement path because they address static-model weaknesses without abandoning explainability, auditability, or human oversight.

Assumptions

• Deterministic CRR design conventions described by EY and Financial Crime Academy are broadly representative of mainstream bank practice rather than outlier implementations.
• Public absence of UK score-to-SAR validation evidence reflects an evidence gap in open sources, not proof that private firms never validate their models internally.

Analysis

The legal and supervisory question was answered primarily from UK statutory text and official guidance, because those sources directly define what counts as an acceptable risk-based approach under MLR 2017.

Those sources consistently support factor-based, proportionate, documented decision-making, but they do not require a fixed weight split, which means practitioner evidence on weighted or point-based CRR mechanics was used only to describe common implementation patterns rather than to infer legal obligation.

Effectiveness had to be judged on weaker public evidence, because the UKFIU publishes aggregate SAR and DAML outcomes rather than customer-risk-band validation, while open AML literature emphasizes sparse labeled datasets, interpretability, and data-quality limits more than direct benchmarking of deterministic onboarding scores.

That evidence pattern supports a split conclusion: deterministic models remain strong on explainability and supervisory defensibility, but hybrid models offer a better balance once firms want more adaptive risk detection without giving up auditable logic or human accountability.

Risks, Gaps, and Uncertainties

• Public UK data reviewed here do not show whether high-risk CRR bands actually produce more valuable SAR or DAML outcomes than lower-risk bands.
• The open-access literature reviewed here is stronger on transaction or network analytics than on pure onboarding CRR, so claims about full ML replacement remain less certain than claims about behavior overlays.
• Publicly accessible primary UK sources reviewed here do not prescribe exact factor weights, so conclusions about detailed weighting conventions rely more on accessible law, regulator material, and practitioner descriptions than on directly quoted JMLSG Chapter 4 wording.

Open Questions

• What internal validation metrics do UK firms actually use to test whether customer-risk bands predict later suspicious activity?
• Which hybrid governance pattern best preserves explainability when a behavioral overlay disagrees with a deterministic base score?
• Will future FCA, HM Revenue & Customs, or JMLSG guidance become more explicit about acceptable use of ML inside customer risk-rating models?

sources

• [x] UK Legislation (2017) Money Laundering Regulations 2017, Regulation 18 - primary statutory text for the business-wide risk assessment requirement.
• [x] UK Legislation (2017) Money Laundering Regulations 2017, Regulation 28 - primary statutory text for customer due diligence and ongoing monitoring.
• [ ] Joint Money Laundering Steering Group (2025) Current Guidance - official industry guidance starting point for current UK convention statements.
• [x] HM Government (2025) Money laundering regulations: risk assessments - official UK guidance on applying a risk-based approach and choosing methodology.
• [x] HM Government (2025) Money laundering regulations: your responsibilities - official UK operational guidance on customer due diligence, enhanced due diligence, and controls.
• [x] Financial Conduct Authority (2019, updated 2025) TR19/4 Understanding the money laundering risks in the capital markets - official FCA thematic-review page highlighting customer risk assessment and due diligence expectations.
• [x] Financial Conduct Authority (2025) FCG 3 Money laundering and terrorist financing - official FCA handbook section used for customer due diligence and risk-based-approach expectations.
• [ ] FATF (2014) Risk-Based Approach Guidance for the Banking Sector - official international comparator for risk-factor taxonomies and proportionality.
• [x] Basel Committee on Banking Supervision (2016) Sound management of risks related to money laundering and financing of terrorism - official banking guidance on customer risk profiles and ongoing monitoring.
• [x] National Crime Agency (2024) SARs Annual Report 2024 - official regime-level outcomes data for SAR and Defence Against Money Laundering activity.
• [x] EY (2023) How do you successfully operationalize your client risk rating model? - practitioner description of point-based CRR mechanics, weights, and triggers.
• [x] Financial Crime Academy (2022) Customer Risk Rating Models in Customer Due Diligence and Know Your Customer - practitioner source on static customer risk models and their operational weaknesses.
• [x] Canhoto (2021) Leveraging machine learning in the global fight against money laundering and terrorism financing: An affordances perspective - open-access academic paper on where supervised, unsupervised, and reinforced ML fit in AML.
• [x] Savage et al. (2016) Detection of Money Laundering Groups: Supervised Learning on Small Networks - open-access example of supervised learning succeeding in group-behavior detection rather than simple onboarding scoring.
• [x] Jensen et al. (2023) Fighting Money Laundering with Statistics and Machine Learning - open-access review of client risk profiling, suspicious-behavior flagging, interpretability, and data scarcity.
• [x] Mitchell (2026) Global artificial intelligence agent regulation in financial services - prior repository item showing that explainability, auditability, and human oversight recur across finance-sector AI regulation.