In the landscape of United States Anti-Money Laundering (AML) compliance, the Customer Due Diligence (CDD) rule is not just a regulatory obligation—it is the cornerstone of your institution’s defense against financial crime. While technology and software provide the infrastructure for compliance, the human element remains the most critical component.
The Customer Risk Assessment (CRA) interview is the moment where data points become a narrative. It is where a compliance officer or relationship manager moves beyond the binary “pass/fail” of a database check and truly understands the human being (or entity) behind the account.
For US financial institutions—from community banks to Money Services Businesses (MSBs) and fintechs—conducting a robust, investigative interview is essential to satisfy FinCEN (Financial Crimes Enforcement Network) requirements.
Here is a guide to the essential interview questions that drive an effective Customer Risk Assessment.
Contents
The Philosophy: Why We Ask
Before diving into the questions, it is vital to understand the objective. Under the USA PATRIOT Act and FinCEN’s CDD Final Rule, you are required to:
- Identify and verify the identity of customers.
- Identify and verify the identity of beneficial owners (for legal entities).
- Understand the nature and purpose of the customer relationship.
The interview is the mechanism for gathering this intelligence. It should not feel like an interrogation, but rather a due diligence conversation designed to establish a baseline of expected activity.
Section 1: Identity and Source of Wealth
Establishing the “Who” and the “Why”
The first phase of the interview establishes the legitimacy of the customer’s identity and the origin of their assets.
- “Can you describe your primary occupation or business operations in detail?”
- Why ask: A generic answer like “Consultant” or “Import/Export” is a red flag. You are looking for specificity. If they are an importer, what do they import? Who are their suppliers?
- “What is the primary source of the funds you will be depositing?”
- Why ask: You must distinguish between Source of Funds (the specific money being deposited now) and Source of Wealth (how they accumulated their overall net worth). If a customer deposits $50,000 in cash but earns $40,000 a year as a teacher, the math does not work.
- “How did you accumulate your overall wealth?”
- Why ask: For High-Risk customers (PEPs, High Net Worth individuals), understanding the origin of wealth—whether through inheritance, business sale, or salary—helps mitigate risk.
- “Are you acting on your own behalf, or is someone else directing this activity?”
- Why ask: This is critical for detecting potential nominees or straw-man accounts often used in money laundering.
Section 2: Business Operations and Purpose
Legitimizing the Entity
If the customer is a business (LLC, Corporation, etc.), the interview must drill down into how the business actually makes money. In the US, shell companies are a common vector for illicit finance.
- “Can you explain your business model? How does your company generate revenue?”
- Why ask: If the business generates massive cash flow but sells digital software, that creates a mismatch between the business type and the transaction volume.
- “Who are your primary customers and vendors?”
- Why ask: This helps identify geographic risk. If a domestic construction company is sending wires to a high-risk jurisdiction, you need to know why.
- “Does your business involve cash-intensive operations (e.g., restaurants, car washes, convenience stores)?”
- Why ask: Cash-intensive businesses inherently carry higher AML risk due to the potential for “structuring” or commingling illicit funds.
- “Are there any foreign operations or ownership ties?”
- Why ask: Foreign ownership can trigger specific due diligence requirements, especially if the jurisdiction is known for secrecy havens.
Section 3: Expected Activity and Transaction Profile
Setting the Baseline
You cannot monitor for suspicious activity if you do not know what normal activity looks like. This section sets the boundaries for the account.
- “What do you anticipate your monthly transaction volume to be (in dollars and frequency)?”
- Why ask: This sets the threshold for your automated monitoring systems. If a customer claims they will deposit $5,000 a month but deposits $200,000 in the first month, the system flags a deviation.
- “Will you be utilizing cash, checks, wire transfers, or a mix of payment methods?”
- Why ask: Different payment methods carry different risks. High volumes of incoming third-party wires often suggest a money transmission business, which requires specific licensing in the US.
- “Do you plan to conduct any international transactions? If so, with which countries?”
- Why ask: Transactions involving countries on the FATF (Financial Action Task Force) grey/black lists or OFAC-sanctioned nations require immediate scrutiny.
Section 4: Geographic and Jurisdictional Risk
Location Matters
In the US AML context, geography plays a significant role in risk scoring.
- “Is your business physically located in the United States? If not, where is it incorporated?”
- Why ask: This addresses the risk of offshore entities. If a foreign entity wants to open a US bank account, it is subject to specific due diligence standards.
- “Do you or your beneficial owners have residency or citizenship in high-risk jurisdictions?”
- Why ask: This ties back to OFAC (Office of Foreign Assets Control) screening and potential Politically Exposed Person (PEP) status.
Best Practices for the Interview Process
To ensure your Customer Risk Assessment holds up to regulatory scrutiny, follow these best practices:
- Document Everything: In the US, if it isn’t written down, it didn’t happen. The answers to these questions must be documented in the customer file, not just used to form a mental impression.
- Listen for Inconsistencies: If the customer’s body language or answers conflict with the documentation they provided, dig deeper. A vague answer is a yellow flag.
- Avoid Yes/No Questions: Instead of asking, “Is your business legit?” ask, “Walk me through a typical transaction for your business.” Open-ended questions yield better intelligence.
- Update Regularly: Risk is not static. A customer who was low-risk two years ago might be high-risk today. The “interview” should be an ongoing process, especially when triggering events (like a sudden change in transaction volume) occur.
Conclusion
The Customer Risk Assessment interview is the foundation of a strong AML program. By asking the right questions—focused on source of wealth, business legitimacy, and expected activity—US financial institutions can protect themselves from being unwitting participants in money laundering while providing better service to their legitimate customers.
Remember, compliance is not just about avoiding fines; it is about knowing your customer well enough to trust them.