Terminology
Risk Rule - a component used to evaluate the level of risk associated with a person. Risk rule evaluates the level of risk of a particular characteristic of the person. Risk rule includes a risk data point, risk score associated with the risk data point and rule weight.
Risk data points - data points, e.g. Age, PEP Status, Country, that you would like to use for risk scoring. Person and Transaction data as well as Monitoring and Screening data can be used.
Risk Rules scores: possible values (0-5) that can be assigned to specific risk data points within a risk rule.
Risk Rule weight - the multiplier value used to differentiate the importance of one risk rule against another. This must be a positive number; decimal values are possible.
Customer Risk Score - the sum of a person’s risk score from all the risk rules.
Final Risk Level - the final risk level based on a customer risk score. See below for the possible risk level options.
💡 Risk Assessment does not trigger or create any alerts on its own! However, risk levels can be used by Monitoring Scenarios, which do trigger alerts.
How Risk Rule scoring works
✂️ In short,
Risk rule takes your data,
Assigns it a Risk rule score,
Multiplies it by Weight,
Weighted scores of all Risk rules are added up to get a Customer Risk Score,
Customer Risk Score is then compared against Final Risk Level thresholds.
Detailed explanations of each step are provided below:
1. Data for Risk rules
Possible sources of data for risk rules:
Person data, including nested data,
Platform data:
Person attributes history (it is possible to use history of person’s data in a risk rule, e.g. compare past IP addresses to current IP address, calculate how many times phone number has been changed, etc.)
Monitoring alert count
Previous monitoring alerts information (scenarios, statuses, created times, etc.)
Person tag (if any Screening alert is closed as True positive, Person gets a tag indicating the type of Screening alert - SANCTION/PEP/ADVERSE MEDIA/CUSTOM LIST)
2. Risk Rule score
There are six possible numerical values for individual Risk Rules. You can choose which levels you want to use for each rule; it is not necessary to use all levels:
LOW - 0, LOW_TO_MEDIUM - 1, MEDIUM - 2, MEDIUM_TO_HIGH - 3, HIGH - 4, UNACCEPTABLE - 5;
❗ For UNACCEPTABLE (5): if any individual Risk Rule returns UNACCEPTABLE, then the final risk is automatically returned as UNACCEPTABLE, regardless of the final, summed risk score.
Other risk levels cannot work as overriders, but Risk Rule Weight can be used in order to achieve overriding effect.
For example, age is a common risk data point, with different age ranges corresponding to a different risk level for the client.
3. Risk Rule Weight
It is usual to have multiple risk data points to consider, for example, geography, age, business type/activity, PEP status, etc. And one risk rule might have a different significance to another — this is where risk rule weights come into play.
Risk Rule weights can be any positive number (≥1) — including decimals — and they are used to differentiate the importance of a risk rule against another. Generally, PEP status, for instance, is a more significant risk point than Age, and should therefore carry a higher weight.
4. How the final customer Risk Score is calculated
All risk rules are summed. The summed score is then rounded up/down (if less than 0.5, rounded down; if 0.5 or more, rounded up) before the score is matched to a corresponding final risk level.
Using this sample risk matrix above, a person of age 65 (Medium: 2 x Weight: 1 = 2) and with PEP status (High: 4 x Weight: 2 = 8), would have a final Risk Score of 2 + 8 = 10. This final risk score of 10 is then mapped onto the configured Final Risk Levels (read on below).
5. Final Risk Levels
The final risk level for a Person is determined by the summed scores of all risk rules. As with the individual risk rule scores, there are also six possible final risk levels available for Risk Assessment: Low, Low-Medium, Medium, Medium-High, High, and Unacceptable.
You can choose which levels you want to use, and the industry minimum is usually three levels: Low, Medium, and High. You can also determine the exact score ranges that corresponds with each risk level.
Example:
Low: 0-10
Medium: 11-20
High: 21 and above
These risk level ranges are setup by Salv at the backend, if you want to adjust your Final Risk Level intervals, let your Salv contact know.
❗ Note: Integers should be used for Final Risk Level ranges. Note the start and end numbers are inclusive, and there is no maximum ceiling.
❗ Note: Only one set of Final Risk Level ranges can be configured per live environment. While you might have different risk rules for different types of persons (type: INDIVIDUAL vs type: BUSINESS), your environment cannot have two different risk score range levels. However, Risk rules can be differentiated for different types of persons.
Events that trigger Risk Assessment (re-)scoring
Risk levels of a Person is (re-)calculated when:
Person is created
Person is updated, either via API or via manual data upload
When Transaction is created
When Monitoring alert is generated
When Monitoring alert’s status is updated
When Screening alert is marked as True positive
When Screening alert previously marked as True positive is marked as non-True positive
❗ Persons are not automatically re-scored when Risk Rules are added or amended. Re-scoring of persons based on an adjusted Risk Rule are only triggered by the events listed above.
If you have made amendments to your Risk rules or have added new Risk rules, let your Salv contact know - we can manually trigger full re-scoring of Persons (either all Persons, or only selected ones).
Example of a working Risk rule:
🔢 Risk rules are defined using SQL queries.
Here you can copy the content code
Here you can copy the content code
SELECT
CASE
WHEN date_part('year', AGE(dob)) <=20
OR date_part('year', AGE(dob)) BETWEEN 61 AND 80 THEN 1
WHEN date_part('year', AGE(dob)) BETWEEN 81 AND 90 THEN 2
WHEN date_part('year', AGE(dob)) BETWEEN 91 AND 100 THEN 3
WHEN date_part('year', AGE(dob)) > 100 THEN 4
ELSE 0
END,
date_part('year', AGE(dob)) as age
FROM person WHERE id = $personId
❗️ Pay attention to the following:
The first field should always be a CASE statement that returns a risk level between 0 and 4 (0=low,1=low to medium, 2=medium, 3=medium to high, 4=high risk).
All other fields are optional but these can be used as dynamic parameters in the Details field.