Risk-Based Onboarding: A Practical Guide

Last updated: September 2026

Risk-based onboarding means every applicant clears the same identity floor, and the risk each applicant presents decides what is added on top of it. The Customer Identification Program (CIP) rule sets the minimum information a bank collects and verifies for every customer. Above that floor, a customer risk profile, which the customer due diligence (CDD) rule requires and the institution designs, decides which extra identity, KYC and fraud checks apply, when enhanced due diligence starts, how often the rating is reviewed, and what the file must show when an examiner asks how the rating was reached.

This guide works from the primary sources: the CIP and CDD rules, the relevant sections of the FFIEC BSA/AML Examination Manual, and the federal banking agencies' 2022 joint statement on the risk-based approach. It is written for risk, fraud and compliance leaders who design or defend an onboarding flow.

TL;DR

• Risk-based onboarding never lowers the floor. Every applicant meets the CIP minimums in 31 CFR 1020.220; risk decides what is added above them.

• The CDD rule, 31 CFR 1020.210(a)(2)(v), requires a customer risk profile built from the nature and purpose of the relationship. The FFIEC manual's CDD section (2018) says there are no required risk profile categories, so the tiers are the institution's to design.

• The agencies' July 2022 joint statement says no customer type presents a single uniform level of risk. It is guidance and adds no new requirement.

• Tiered checks move in both directions: step up when the profile warrants it, even after KYC passes, and remove friction for applicants the profile shows are low risk.

• Enhanced due diligence is more information and closer, more frequent review for higher-risk customers, at opening and for as long as the relationship lasts.

• The rating, its reasons, every step-up and override, and the history of each change belong in the customer's file, because an examiner will ask how the rating was determined.

The short answer: what risk-based onboarding means

Risk-based onboarding is the practice of matching the checks an applicant receives to the risk that applicant presents, on top of a fixed minimum that applies to everyone. Every applicant meets the CIP floor. The customer risk profile then decides what is added: extra identity, KYC and fraud checks, a step-up to more verification, enhanced due diligence, and how often the relationship is reviewed after the account opens.

The rules require the approach but leave its design to the institution. The CDD rule requires risk-based procedures and a customer risk profile, and the FFIEC manual's CDD section (2018) states that "there are no required risk profile categories and the number and detail of these categorizations will vary based on the bank's size and complexity." How many tiers there are, what places an applicant in each and what each tier adds is policy the institution writes, applies and records.

Passing the identity checks settles a narrower question than the one onboarding has to answer. A KYC check confirms that a claimed identity exists and matches its documents at a moment in time. It does not establish intent, and it does not establish that the identity was not assembled specifically to pass the check. The risk profile is where the institution records what it expects the relationship to look like and how risky that is.

A chief BSA officer at a BaaS bank put the whole job in one line: AML is "know who you are and watch what you do." Risk-based onboarding is the first half of that sentence, built so that it feeds the second.

The floor every applicant meets

The CIP rule for banks, 31 CFR 1020.220, requires a bank to obtain, at a minimum and before opening an account, the customer's name, date of birth (for an individual), address and an identification number, and to verify the customer's identity under risk-based procedures. Those minimums apply to every applicant in every tier. A lower-risk rating never removes one of them.

Risk already enters at this level, in how identity is verified. The FFIEC manual's CIP section (2021) says the program "must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable," based on the bank's assessment of relevant risks, including the types of accounts it maintains and its methods of opening accounts. The same section adds: "Based on its BSA/AML risk assessment, a bank may require identifying information, in addition to the required information, for certain customers or product lines."

So the structure of risk-based onboarding is written into the CIP section itself: a fixed set of minimums, then additional information and verification where the risk assessment calls for it. The mechanics of the CIP and verification sequence are covered in our guide to building a KYC compliance programme. The rest of this guide covers what happens above the floor.

What the risk-based approach does and does not change

On 6 July 2022 the Federal Reserve Board, the FDIC, FinCEN, the NCUA and the OCC issued a Joint Statement on the Risk-Based Approach to Assessing Customer Relationships and Conducting Customer Due Diligence (FDIC FIL-28-2022, OCC Bulletin 2022-18, Federal Reserve SR 22-5). The statement says that "no customer type presents a single level of uniform risk or a particular risk profile," and that "Banks must apply a risk-based approach to CDD, including when developing the risk profiles of their customers."

The statement's practical instruction is to assess the relationship rather than the category. It says banks should "manage customer relationships and mitigate risks based on customer relationships, rather than decline to provide banking services to entire categories of customers." A customer type can raise the starting point of a profile, but the rating still has to be reached for that customer.

The statement is guidance, not a rule. By its own terms it "does not alter existing Bank Secrecy Act/Anti-Money Laundering (BSA/AML) legal or regulatory requirements, nor does it establish new supervisory expectations." It states how the agencies read the requirements that already exist.

Banks that sponsor fintech programs meet the same expectation one level up. An SVP of financial intelligence operations at a bank with a fintech banking program said examiners keep asking the team to show how its approach applies to each fintech partner and that partner's risk. The per-relationship logic of the 2022 statement applies to the partner as well as to the partner's customers.

Building a customer risk profile

A customer risk profile is the institution's documented view of what a relationship is for, how it is expected to behave, and how much money laundering, terrorist financing and fraud risk it carries. The CDD rule makes it a requirement: a bank's program must include "appropriate risk-based procedures for conducting ongoing customer due diligence," including "understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile" (31 CFR 1020.210(a)(2)(v)). The rule requires the profile and leaves its contents to the bank.

The FFIEC manual's CDD section (2018) sets the standard the design is judged against. The program for determining customer risk profiles "should be sufficiently detailed to distinguish between significant variations in the money laundering and terrorist financing risks of its customers." It also warns that "Any one single indicator is not necessarily determinative of the existence of a lower or higher customer risk," and allows that a lower-risk profile may be inferred from "inherent or self-evident information such as the type of customer, the type of account opened, or the service or product offered."

Expected activity is part of the profile, and it is where much onboarding friction starts. A BSA officer at a bank described the problem: "when we onboard a customer, the way we're doing that or figuring out expected activity is really cumbersome. It creates a bad onboarding process." Asking every applicant the same long set of questions about expected activity is one reason a flow feels heavy; asking the questions each tier actually needs is part of the design.

A profile built from one product's data misses the customer. An AML compliance leader and MLRO at a global money transfer company said its customer risk scoring was not holistic: it was heavily transaction-focused, with each profile's retail transactions scored on their own. The stronger design is one customer risk profile that onboarding, fraud, credit and compliance all read from and add to, so the rating reached at opening is the same one the monitoring team sees later.

A three-tier customer risk profile

The table below is one way to lay out tiers. The FFIEC manual requires no set number of categories, so an institution sizes the tiers to its own customers and products.

The table describes review frequency relative to the other tiers. The intervals themselves are policy each institution sets and documents for its own risk assessment.

Tiering identity, KYC and fraud checks by risk

Tiering means the set of checks an applicant receives changes with the applicant's risk profile instead of running as one fixed flow. A technical product manager leading a KYB redesign at a payments company described the requirement: "We need verification flow to be dynamic," with "different verification templates depending on the industry, risk level, country or other parameters." Each template is a tier's answer to what that applicant has to prove.

Step up on risk, even after KYC passes

A passed KYC check leaves the risk question open. A senior director of fraud risk management at a payments company said: "I would want to trigger a step up when I have fraud concerns for onboarding, beneficiary, owner verification, even if they pass the kyc." The risk profile triggers the step-up, whatever the result of any one check.

First-party fraud shows why. A director of risk and compliance at an AI lending marketplace said the fraud the team sees most is first-party: applicants who are who they say they are, who will pass identity verification, and who do not intend to repay. Identity checks cannot see intent, so the tier has to draw on other signals, such as device and behaviour data, links between applications, and the fit between stated purpose and the product.

Reduce friction for the lowest-risk applicants

Risk-based works in both directions. A senior director of fraud analytics at a consumer lender said: "if we could identify very low risk applications that we could reduce the friction on from authentication perspective, I think that would help us." If a tier never removes a step for a low-risk applicant, the tiers only ever add checks.

Low friction for most applicants depends on watching behaviour after the account opens. The CEO of a pre-launch consumer fintech described the trade: to keep onboarding light, the company needs "something that's paying attention to everything that the customer's doing," so it can step up verification later when activity looks suspicious. Removing a step at opening is safer when monitoring is ready to add one back.

Design the step-up for genuine customers

Some of the applicants who are stepped up will be genuine. A head of card fraud risk at a consumer lender said: "there will be chances that we inevitably will have to step up genuine customers." The step-up should be something a legitimate applicant can complete quickly, with a clear reason and a clear next step.

The FFIEC's 2021 guidance, Authentication and Access to Financial Institution Services and Systems, supports the same layered approach. It describes layered security as incorporating "multiple preventative, detective, and corrective controls," designed "to compensate for potential weaknesses in any one control," and it expects a risk assessment to support decisions about which authentication techniques to use. The individual fraud controls and what each can and cannot see are covered in our guide to the layers of an account-opening fraud prevention stack.

Where tiered checks go wrong

• One fixed flow for everyone. Every applicant gets the heaviest checks, genuine low-risk customers meet friction they did not need, and the flow produces no tier the institution can use to rate the relationship.

• Every failed check sent to manual review. A risk lead at a remittance company said that for identity verification failures, a manual review often has nothing to act on, and "the customer should be prompted to retry." Route to review only what a reviewer can decide.

• A tier set from one indicator. The FFIEC manual says no single indicator is necessarily determinative. A rating built on one data point is hard to defend and easy to game.

• A rating that stops at the account opening. A step-up signal that never reaches the monitoring or compliance team is lost the moment the account opens.

• Overrides with no reason recorded. Overrides are sometimes right, but an override without a recorded reason and approver leaves the rating impossible to explain later.

When to step up to enhanced due diligence

Enhanced due diligence (EDD) is the collection of additional information about customers that pose heightened risk, followed by closer and more frequent review. The FFIEC manual's CDD section (2018) describes it this way: "Collecting additional information about customers that pose heightened risk, referred to as enhanced due diligence (EDD), for example, in the private and foreign correspondent banking context, is part of an effective due diligence program." It adds that information from higher-risk profile customers and their transactions "should be reviewed more closely at account opening and more frequently throughout the term of their relationship with the bank." Private banking and foreign correspondent accounts have their own due diligence rules, separate from the onboarding practice described here.

The triggers for EDD are set by the institution, in writing, and applied the same way every time. Common triggers include:

• A rating in the higher tier. The customer risk profile places the applicant in the tier the policy assigns to EDD.

• Information that contradicts itself or cannot be verified. Identity, business or expected-activity information that does not hold together, or that the institution cannot confirm under its verification procedures.

• A higher-risk product or relationship. A product, channel or relationship type that the institution's own BSA/AML risk assessment marks as higher risk.

• A combination of indicators. No single indicator is necessarily determinative, so policy defines when several indicators together are enough to move an applicant into EDD.

A bank-partner compliance manager at an auto finance lender said higher-risk applications are routed to the EDD team, whose analysts verify income, confirm that the KYC is right, and hold the authority to decline the application. That authority belongs in the policy, alongside the triggers.

EDD does not end when the account opens. A fraud and compliance manager at a credit union said the institution has an obligation to perform an EDD review on all of its high-risk members on a set cycle. Each customer in the higher tier should have a next EDD review date on the customer record from the day the account opens.

For a legal entity applicant, the beneficial owners are identified and their identities verified under risk-based procedures (31 CFR 1010.230), and choosing a KYB provider for business applicants is a separate evaluation.

Keeping the rating current after opening

The CDD rule has a second limb that starts once the account is open: "conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information" (31 CFR 1020.210(a)(2)(v)). The customer risk profile is maintained for the life of the relationship, and the rating can move in either direction.

Review frequency follows the rating. A client due diligence team member at a payments processor summarised the practice in one sentence: "We have a risk based periodic review." Higher-risk customers are reviewed more often than lower-risk ones, and any event that contradicts the profile, such as activity well outside what the customer said to expect, triggers a review of its own.

The higher-risk population keeps changing, so the list cannot be static. A director of compliance, BSA and strategy at a community bank explained why a fixed list does not work: "you really cannot use the system to keep a list of high risk customers because it's always ever changing." The rating has to live on the customer record and update as the record does.

The onboarding rating should travel with the customer to monitoring and compliance. A fraud orchestration lead at a large regional bank described the case: an account opens with some friction and a few red flags, and soon afterwards a check or a wire arrives; the team handling that payment needs to know the account is new and that its opening did not go smoothly. A synthetic identity flagged at onboarding is of little use if the flag never reaches the transaction monitoring or compliance team.

The same applies to the EDD schedule. A BSA analyst at a community bank described manually tracking the high-risk customer list, when each customer's EDD review is due and when site visits are due. EDD due dates and site visits belong on the customer record, where the rating, the reviews and the history sit together.

What to record for every onboarding risk decision

Every onboarding risk decision should leave a written record that shows how the rating was reached. A director of compliance, BSA and strategy at a community bank described the examiner's question and why the record matters: "how did the system determine this? And if I don't have it in writing, I won't be able to defend it." The record is the answer to that question, prepared before it is asked.

The file for each applicant should show:

• The inputs. The identity, KYC, fraud and expected-activity information the rating was based on, with the source of each.

• The rating and its reason. The tier assigned, and the factors that put the applicant there, in words a reviewer can read.

• The checks run and their results. Which checks ran, in what order, and what each returned, including any retry.

• Any step-up and why. What triggered it, what was asked of the applicant, and the outcome.

• Any override, with its reason and approver. Who changed the rating or the decision, when, and why.

• The EDD due date. For a higher-tier customer, the date of the next EDD review.

• The history of every rating change. Each move between tiers, with its date and reason, not only the current rating.

The history matters as much as the current rating. A BSA analyst at a bank asked whether a system could show every change between low, medium and high, an "audit level of its risk rating history." A rating that can only be seen in its current state cannot show an examiner how it got there.

How the factors are weighted should be documented in a form a reviewer can read. An AML compliance manager at an online sports betting operator asked whether the choice of coefficients for a risk factor "was that documented very clearly and, very readable for regulators or auditors." Where a model produces the rating, the institution has to be able to explain it to itself first. A director of compliance at an auto finance lender said: "So we can make sure that we're understanding it ourselves."

The explanation also has to reach the person working the case. Each decision should carry its reasons, so an analyst in the review queue can see why the applicant was stepped up or referred without reconstructing it. A head of risk and compliance at a mortgage lender described this as the governance piece: how the institution will "have oversight of decisioning and evidencing" and deliver that evidence to the regulator.

Overrides are allowed, but they are the exception. The director of compliance, BSA and strategy at the community bank quoted above described finding a large number of customers scored by hand inside a risk-rating system, and asked what the point of the system was if its scoring had been switched off that way. Each override should carry a reason and an approver, and a rising override count is a sign that the tiers need revisiting.

Each EDD file should be complete in one place. A BSA analyst at a bank said that when auditors request one EDD file, all of the information, including the narrative, needs to be together. A BSA officer at a community business bank described the standard for the output: "All the output has to have is whatever the regulators are asking for."

Who owns the tiers

The tiers express a risk appetite, and the institution owns it. A VP of risk transformation at a merchant acquirer described approval rates as policy: "It's an appetite." When applicants fall outside what the institution has decided to accept, "your approval rate is your approval rate." The tiers, the triggers and the approval authority are policy, approved by the people accountable for that appetite.

For a fintech that operates through a partner bank, the standard may be set by the sponsor bank. A product manager at a BaaS program manager described the arrangement: "We have a process dictated by our sponsor bank." In that model the program manager runs the onboarding flow, and the bank's policy decides what each tier must include.

Risk teams should be able to change tiers, triggers and treatments without waiting on engineering. A tier structure that takes an engineering release to adjust drifts away from the risk it was written for, and the record of why it changed gets harder to keep.

Program rules may change. FinCEN's proposed AML/CFT program rule, published on 10 April 2026, is still a proposal: as of 30 September 2026 no final rule has been issued, and nothing in it is yet an obligation.

Running risk-based onboarding on Oscilar

Oscilar runs onboarding, fraud, credit and AML decisions on one platform, and its consumer onboarding product is built for the tiered approach this guide describes. Oscilar's page on risk-based consumer onboarding describes onboarding workflows that adapt to each user's risk profile, and step-up verifications that trigger enhanced due diligence and additional verification steps when they are needed. Oscilar orchestrates the KYC and identity verification providers an institution already uses, adds device intelligence, behavioural biometrics and data enrichments as signals, and decides on the combined result. The identity and document checks themselves come from those providers.

For the record an examiner will ask for, Oscilar keeps a full audit trail per decision with stored reasoning, and human-in-the-loop by design. Its AI-driven case management gives analysts prioritised queues, a holistic view of each user and a natural-language explanation of why an onboarding case was created. Risk teams can backtest a new workflow on historical data and A/B test changes before deploying them, and the platform's no-code and low-code interface lets them adjust tiers and triggers without waiting on engineering.

Oscilar has auto model monitoring covering data drift, feature drift and concept drift, plus outcome KPIs measured by segment, so a model-driven rating can be watched as the customer population changes. The platform is specified for decisions in under 100 milliseconds. Oscilar was named to Chartis's 2026 FCC50, its ranking of financial crime and compliance technology vendors, with category wins for Low-Code/No-Code Customization and Agentic AI Innovation.

Choosing the onboarding software that runs a risk-based flow is a separate evaluation, with its own criteria.

Frequently asked questions

Is risk-based onboarding a regulatory requirement?

The rules require the risk-based approach, but not a particular design of it. The CIP rule (31 CFR 1020.220) requires risk-based procedures for verifying identity, and the CDD rule (31 CFR 1020.210(a)(2)(v)) requires a customer risk profile and ongoing due diligence on a risk basis. The FFIEC manual's CDD section (2018) says there are no required risk profile categories, so the number of tiers and what each adds is the institution's to decide and document.

Does a low-risk tier mean fewer identity checks?

No. The CIP minimums in 31 CFR 1020.220 (name, date of birth for an individual, address and an identification number, with identity verified under risk-based procedures) apply to every customer in every tier. A lower-risk profile means fewer checks added above that floor, less friction at authentication, and less frequent review after the account opens.

What should trigger enhanced due diligence at account opening?

Enhanced due diligence should start when the customer risk profile places an applicant in the higher tier the institution's policy assigns to EDD. Typical triggers are a product or relationship the institution's risk assessment marks as higher risk, information that contradicts itself or cannot be verified, and a combination of indicators that together outweigh the explanations. The FFIEC manual's CDD section (2018) says no single indicator is necessarily determinative, so the triggers should be written as policy and applied consistently.

How often should a customer's risk rating be reviewed?

A customer's risk rating should be reviewed on a schedule set by the rating itself, with higher-risk customers reviewed more often than lower-risk ones, and whenever an event contradicts the profile. The CDD rule requires ongoing monitoring and, on a risk basis, maintaining and updating customer information (31 CFR 1020.210(a)(2)(v)). The rule sets no interval, so each institution sets and documents its own, and customers under EDD are reviewed on a set cycle.

Can a bank treat a whole category of customers as high risk?

A bank can use a customer type as one input to a profile, but it should not rate or decline an entire category on that basis alone. The agencies' July 2022 joint statement says that "no customer type presents a single level of uniform risk or a particular risk profile" and that banks should manage and mitigate risk relationship by relationship rather than decline service to whole categories of customers. The statement is guidance and adds no new requirement.

What will an examiner expect to see behind an onboarding risk rating?

An examiner will expect to see how the rating was determined, in writing. That means the inputs, the tier and the reasons for it, the checks run and their results, any step-up or override with its reason and approver, the next EDD review date for a higher-tier customer, and the history of every rating change. The FFIEC manual's CDD section (2018) expects the profile to be detailed enough to distinguish significant variations in risk, so the file should show why this customer landed in this tier.

Risk-based onboarding holds up when the floor is the same for everyone, the tiers above it are written down, and every rating can be explained from the file. To see how that runs in practice, read about Oscilar's approach to consumer onboarding.