Last week I found a bug in our own software, and it is the most instructive one we have shipped a fix for.
When a user added a new client, the system worked out a risk rating and stored it. Sensible. Except the form that adds a client never asks the five questions that actually move the rating: is this person a PEP, is there a nominee arrangement, is the structure complex, does it involve virtual assets, is the relationship non face-to-face. The code passed all five as "no" because it had nothing else to pass.
So every new client landed on "low risk". Not because anyone looked. Because nobody was asked.
Then the client file displayed that section as complete and collapsed it, which meant the one place those five questions ever get put was folded shut with a green tick over it.
That is a software bug. But the shape of it is not a software problem, and if you keep client risk ratings in a spreadsheet, you almost certainly have the same one.
A stored rating and an assessment are different objects
Most firms think of the risk rating as a field. Something that has a value: low, medium, high. Filled in or blank.
AUSTRAC does not think of it as a field. It thinks of it as a decision you made, for reasons, about a specific person.
The wording is direct: "When assigning a customer risk rating for CDD, you must use the information and factors in your ML/TF risk assessment, and consider how these apply to the individual customer." (AUSTRAC, assigning customer risk ratings)
And the method it expects your staff to follow is three steps, none of which a default value performs:
- checking whether each risk factor you have identified is present for the customer
- balancing the nature and scale of each risk factor present to reach an overall rating
- considering any indicators of unusual or criminal activity that may be present
A default does none of that. It produces the same output as an assessment, which is exactly what makes it dangerous. The field is populated. The file looks done.
The part that turns it into an evidence problem
Here is the sentence that should worry anyone with a folder of clients rated low by habit. AUSTRAC lists what CDD records you must make and keep, and one of them is:
customer risk identification and assessment, decisions and rationale
Rationale. Not the rating, the reasoning behind it.
A default rating has no rationale, because no reasoning happened. You cannot produce one after the fact without inventing it, and inventing it in a file that an examiner is reading is a considerably worse day than admitting the gap.
This is why a blank rating is genuinely safer than a confident wrong one. Blank is an obvious gap: you can see it, you can fix it, and it does not claim anything. "Low risk, assessed" over an unasked PEP question is an assertion your records cannot support. It is the artefact an evaluation goes looking for, because it is the cheapest possible tell that the process is decorative.
PEP is the one that actually bites
Four of those five questions are judgement calls you could reasonably answer later. One of them is a hard obligation with a deadline attached to it.
"You must establish on reasonable grounds if any of the following individuals are a PEP before you provide a customer with a designated service." (AUSTRAC, politically exposed persons)
Before. Not at the annual review, not when something feels off. And if the answer turns out to be yes for a foreign PEP, enhanced CDD is mandatory, not optional (AUSTRAC, enhanced customer due diligence).
So a client file that was defaulted to low risk is not just missing a rationale. If that client is a PEP, the file is silent on a check that was legally required to happen before you took the engagement, and the silence looks identical to a check that was done and came back clear.
That is the real cost of a default. It destroys the difference between "we looked and found nothing" and "we never looked."
Three things to check on your own files this morning
You do not need software to do this. Open three client files, ideally ones onboarded in a hurry.
1. Pick a client rated low and ask why. Out loud, to yourself. If the honest answer is "because that is what it said" or "because nothing seemed unusual", you have a stored value, not an assessment. Nothing seeming unusual is a conclusion. It needs the questions in front of it first.
2. Find where the PEP answer lives. Not the screening result, the answer. Somewhere in that file there should be a record that someone established, on reasonable grounds, whether this person is a PEP, and when. If you cannot point at it in ten seconds, an examiner will not find it either.
3. Check what the file claims. This is the one people miss. Look at whether the file presents the risk section as settled. A tick, a green badge, a collapsed panel, a "complete" label. If the file is asserting completeness that the underlying record cannot back, that presentation is itself the problem, and it is the part that turns a paperwork gap into a credibility one.
If all three come back clean on three files picked at random, you are in better shape than most. If they do not, the fix is not complicated. It is a short conversation per client, recorded with a date and a reason.
What we did about ours
We added a column that records when a person last ran the assessment, kept separately from when the system last stored a number. Null means nobody has been asked the five questions, and the file says so instead of showing a tick.
The interesting decision was the backfill. We could have stamped every existing client with a plausible timestamp and made the problem disappear. We did not, because that is fabricating exactly the record AUSTRAC asks you to keep honestly. We only backfilled where a stored risk factor could only have come from a human filling in the form, which is proof rather than a guess. Everything else stayed null, and null reads as "we do not know", not as "not assessed", because asserting the second one would have been the same fabrication pointed the other way.
That is the standard worth holding to whether your risk ratings live in our product, in a competitor's, or in a spreadsheet named Clients_FINAL_v3.xlsx. The record either reflects a decision a person made, or it does not. There is no third option that survives being asked about.
If you want the underlying method rather than the audit, we wrote up how to rate a client's risk and the four factor categories AUSTRAC expects separately. And if the answer to "who decided that" turns out to be nobody, ongoing CDD is trigger-based, not calendar-based, so the time to fix it is before the trigger arrives rather than after.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.