So what factors should a financial institution consider when assigning financial crime risk ratings to its clients? Financial regulators know that risk management resources are finite, so they recommend a risk-based approach, meaning more resources should be deployed when the risk is higher, fewer resources when the risk is lower. This in turn, requires a financial service provider to have a system for rating the financial crime risk of clients on a scale that can be as simple as high, medium, and low.

To determine a client's rating, consideration of four underlying risk factors is recommended. These are sector, the industry or business sector a client operates in may be attractive to criminals. A pharmaceutical manufacturer that produces the precursors for illicit drugs or casino are examples of sectors that elevate the risk rating.

Geography. Countries that are labeled non-cooperative countries and territories by FATF, that are blacklisted by FATF are examples of high risk jurisdictions entity. A company with numerous layers of ownership without a plausible explanation for the structure is an example of entity type that presents a high risk. Another example is a shell bank. A bank with no physical presence or business, a bank in name only. Product. Financial products and services that are useful for money laundering present a higher risk than those that don't. A current account and a telegraphic transfer are examples of a product and service that could be used to move dirty money at short notice across borders. A fixed deposit account on the other hand, is a much lower risk.