Customer risk segmentation is the practice of dividing a financial institution's customer base into groups that share characteristics and expected behaviour, such as retail salaried customers, small cash-intensive businesses, corporate importers or money services businesses, so that anti-money laundering controls can be set for each group. Monitoring thresholds, due diligence depth and review cycles then reflect what is normal for that segment rather than one rule for everyone.
Segmentation is related to, but not the same as, customer risk rating. A risk rating gives each customer a score or band (low, medium, high) under a risk-based approach. Segmentation groups customers who should look alike, and a segment may contain customers with different ratings. Many firms use both: the segment sets the baseline behaviour, and the risk rating decides how closely each customer is watched.
Customer risk segmentation in plain terms
A school nurse would not use one height chart for every pupil. Five-year-olds and fifteen-year-olds are measured against charts for their own age, because what is normal for one group is unusual for the other. Only a child who is far from the normal range for their own age gets a closer look.
Banks do the same with customers. A café that pays in cash every day, a software company that receives large wires from abroad and a student who gets a monthly allowance all behave very differently. If the bank used one set of rules for all three, it would either drown in false alarms about the café or miss odd activity by the student. Putting customers in groups means each one is compared with similar customers.
How segments are built
Firms usually start from data collected at onboarding and through customer due diligence, then refine segments with actual behaviour:
- Customer type. Individual, sole trader, company, trust, charity, financial institution.
- Business or occupation. Industry codes, cash intensity, and whether the customer is itself regulated.
- Products used. Current account only, cards, wires, trade finance, crypto services.
- Size and activity. Turnover, transaction volume and value bands, often from several months of history.
- Geography. Where the customer lives, operates and sends money, informed by any geographic risk indicator.
Some firms add statistical clustering on transaction data to find natural groups that business labels miss, for example retail customers who behave like small businesses. Segments must still be explainable to auditors and examiners, so purely algorithmic groupings are usually reviewed and named by the compliance team.
Use in transaction monitoring
The main practical use is setting thresholds. A transaction monitoring scenario for large cash deposits might fire at a much lower amount for a salaried individual than for a supermarket. Thresholds are often set at a high percentile of the segment's own activity, for instance the level that only the top few per cent of customers in that segment exceed in a month, and then tested through transaction monitoring tuning.
Peer comparison is a related technique. A customer's activity is compared with the average for its segment, and a large deviation raises an alert even if no fixed threshold is crossed. This can catch a funnel account hiding among ordinary retail accounts, or a business whose cash takings are far above similar businesses, a classic sign of mixing illicit funds with legitimate revenue.
Examiners look closely at this link. In the US, the FFIEC BSA/AML Examination Manual asks whether a bank's monitoring reflects its own risk profile, and a bank that applies identical thresholds to every customer will usually be asked to justify that choice. Segment definitions, the data used and the reasons for each threshold should therefore be written down and approved.
Other uses
- Due diligence levels. Segments such as private banking clients or correspondent banking relationships may require enhanced due diligence by default.
- Periodic review cycles. High-risk segments may be reviewed yearly and low-risk segments every few years, or when a trigger event occurs.
- Risk assessment. The firm's AML risk assessment reports inherent risk and control strength by segment.
- Fraud controls. Fraud teams segment customers too, for example by age group or digital behaviour, to set limits on new payees.
Limitations
Segments are only as good as the data behind them. Wrong industry codes or out-of-date occupation fields put customers in the wrong group, which can make a risky customer look normal. Too many small segments make thresholds unstable, while too few mix very different customers together. Segmentation can also lead to unfair treatment if it relies on characteristics such as nationality without a clear risk link, and broad exits of whole segments are a form of de-risking that regulators and the FATF have warned against. Most firms review segment definitions at least once a year.