Applying the same KYC controls to a first-time savings account holder in a small town and a high-net-worth individual with complex international transactions is both operationally wasteful and regulatory misaligned. Risk-based KYC the application of due diligence controls proportionate to the actual money laundering and fraud risk a customer presents is the foundation of both FATF’s global standards and RBI’s domestic KYC framework. Building a tiered compliance model that implements risk-based KYC at scale requires systematic risk assessment<\/a>, defined due diligence workflows for each tier, and technology that automates tier assignment and ongoing review.<\/p>\n\n\n\n FATF Recommendation 10 requires financial institutions to apply customer due diligence (CDD) measures to verify customer identities on a risk-sensitive basis. RBI’s Master Directions on KYC (2016, updated 2023) incorporate this explicitly: Section 13 on Customer Due Diligence distinguishes between Simplified Due Diligence (SDD) for lower-risk customers, Standard CDD for the general population, and Enhanced Due Diligence<\/a> (EDD) for higher-risk customers. Risk assessment determines which CDD level each customer requires, rather than relying on arbitrary classifications. Regulators permit financial institutions to apply SDD to customers who present a demonstrably low risk of money laundering and terrorist financing. RBI permits SDD for: small-value accounts with capped balances and transaction limits; customers onboarded through formally administered government schemes; and certain categories of regulated customers (bank staff accounts, financial institutional accounts in some contexts).<\/p>\n\n\n\n Under SDD, identity verification<\/a> requirements are reduced; typically, a single OVD with basic name confirmation and ongoing monitoring is lighter. The critical compliance point: the institution must document its risk assessment that justifies SDD classification. Financial institutions cannot apply SDD by default simply to avoid verification efforts.<\/p>\n\n\n\n Standard CDD applies to the majority of customers who do not present specific elevated risk indicators. It requires: verification of identity through an OVD (Aadhaar, PAN, passport, etc.); confirmation of current address; understanding of the purpose and nature of the business relationship; and monitoring of transactions for patterns inconsistent with the stated purpose.<\/p>\n\n\n\n For digital platforms, standard CDD is the baseline that automated KYC APIs support: document verification, database cross-reference, and face match for individuals; entity verification and director checks for businesses.<\/p>\n\n\n\n EDD applies to customers presenting elevated ML\/TF risk. Mandatory EDD triggers under RBI’s framework: Politically Exposed Persons (PEPs) and their family members and close associates; customers from countries identified by FATF as high-risk; non-face-to-face customers engaged in high-value transactions; customers with unusual transaction patterns inconsistent with stated purpose; and cases where adverse media or intelligence information raises concerns.<\/p>\n\n\n\n EDD requirements include: additional identity documentation beyond standard OVDs; source of funds\/wealth documentation; understanding of ownership and control structure (critical for legal entities); enhanced ongoing monitoring; and senior management approval for account opening. Financial institutions must document EDD in the customer’s CDD record.<\/p>\n\n\n\n Risk-based KYC requires a structured risk assessment at onboarding that evaluates: customer type (individual, business, legal entity), nationality and jurisdiction, PEP status and family connections, expected transaction profile and product usage, delivery channel (face-to-face, digital, third-party), and income\/source of funds profile.<\/p>\n\n\n\n FATF’s regularly updated list of High-Risk and Other Monitored Jurisdictions, combined with India-specific geographic risk intelligence (Naxal-affected districts, certain border regions), contributes to the geographic risk dimension of customer assessment.<\/p>\n\n\n\n Manual risk assessment at the individual customer level does not scale. Production implementations use automated risk scoring: each risk factor receives a weighted score; the aggregate score determines the initial risk tier; the tier assignment triggers the appropriate CDD workflow. Risk classification at onboarding is a starting point, not a permanent assignment. Transaction monitoring, life event triggers (large deposits, unusual counterparties, address changes to high-risk locations), and periodic review must update risk classifications dynamically. If an account starts with a standard-risk classification but later shows high-value, unusual transaction patterns, the system should automatically escalate it to EDD review instead of keeping it under standard monitoring.<\/p>\n\n\n\n BeFiSc’s verification APIs support all three tiers of the risk-based KYC framework: simplified document checks for SDD-eligible accounts, full KYC and KYB verification for standard CDD, and enhanced multi-source verification, document forensics, and fraud intelligence for EDD scenarios. The API-driven architecture allows tier-based verification workflow configuration without manual routing.<\/p>\n\n\n\nThe Regulatory Foundation: FATF and RBI<\/h2>\n\n\n\n
If an account starts with a standard-risk classification but later shows high-value, unusual transaction patterns, the system should, therefore, automatically escalate it to EDD review rather than continue standard monitoring.<\/p>\n\n\n\n
<\/p>\n\n\n\nThe Three-Tier Risk-Based KYC Framework<\/h2>\n\n\n\n
Tier 1: Simplified Due Diligence (SDD)<\/h3>\n\n\n\n
Tier 2: Standard Customer Due Diligence<\/h3>\n\n\n\n
Tier 3: Enhanced Due Diligence (EDD)<\/h3>\n\n\n\n
Building Risk Assessment into the Onboarding Flow<\/h2>\n\n\n\n
Customer Risk Factors<\/h3>\n\n\n\n
Product and Transaction Risk Factors<\/h3>\n\n\n\n
The product a customer accesses also affects the risk tier. For example, high-value savings and investment products carry greater risk than basic payment accounts. Similarly, international transfer capabilities increase jurisdictional risk. Moreover,<\/strong> lending products secured by complex collateral require lenders to conduct enhanced borrower verification.<\/p>\n\n\n\nGeographic Risk Factors<\/h3>\n\n\n\n
Risk Scoring Automation<\/h2>\n\n\n\n
Moreover, compliance teams must be able to explain automated scoring. In addition, regulators must be able to understand why the system assigned a customer to a specific tier.<\/p>\n\n\n\nOngoing Risk Review: Dynamic Risk Classification<\/h2>\n\n\n\n
Where BeFiSc Fits<\/h2>\n\n\n\n
Key Takeaways<\/strong><\/h2>\n\n\n\n