AML Customer Due Diligence and Risk Rating Worksheet

This worksheet captures the core inputs used to classify a new customer’s AML risk: customer profile, beneficial ownership, source of funds, point of origin, expected activity, and known risk factors. It also records the resulting risk rating, monitoring level, escalation decision, and next review date. Use it as the working record behind an onboarding decision or periodic refresh.

Use it during new customer onboarding, when a customer’s ownership or activity changes, or when a periodic review is due. It is also useful after a trigger event such as a new jurisdiction, unusual transaction pattern, or adverse media hit. If the relationship is low risk and fully standardized, a lighter intake may be enough, but this worksheet is appropriate when a documented risk rating is needed.

Typically an onboarding analyst, compliance analyst, or AML reviewer completes the worksheet, and a supervisor or compliance officer reviews escalations. The reviewer should be the person who can validate the source-of-funds narrative, check supporting documentation, and assign the monitoring level. If your process separates intake from approval, this template supports both roles with an audit trail.

Set the next review date based on the assigned risk rating and any internal policy for periodic reviews. Update it whenever the customer’s risk profile changes, such as a new beneficial owner, a sanctions concern, or a shift in expected activity. The worksheet works best when the review date is explicit rather than left to a separate system note.

No. It is a reusable form for documenting due diligence and risk rating decisions, not a substitute for transaction monitoring, screening, or case management. Many teams use it as the standardized intake and decision record, then pass the result into their monitoring workflow or compliance system. It helps keep the decision consistent even if the downstream tools differ.

Common mistakes include marking every field required, using vague source-of-funds descriptions, and skipping the beneficial ownership details when they are relevant. Another frequent issue is assigning a risk rating without explaining the factors that drove it. The worksheet should also avoid collecting unnecessary PII; only ask for what you will actually use.

Yes. You can add conditional logic for individuals, companies, trusts, or nonprofits, and tailor the geography fields to your operating regions. If your policy treats certain jurisdictions, industries, or PEP relationships differently, add those as risk-factor options. Keep the form aligned with your internal policy and local regulatory expectations.

Attach only the documents needed to substantiate the source-of-funds explanation and ownership structure, such as bank statements, corporate registry extracts, or ownership charts. Use progressive disclosure so the form asks for extra evidence only when a risk factor or complex structure is present. Avoid collecting documents that are not used in the review decision.

The consent and attestation section records that the reviewer acknowledged any PII disclosure and confirmed the accuracy of the assessment. That creates a clear audit trail showing who reviewed the customer, what was considered, and why the risk rating was assigned. If your process includes customer contact, the consent-to-contact field helps document that step as well.