Concepts
Risk and due diligence
A risk rating is a number with a reason attached. The reason is what survives to the review, so the model records both.
Written from docs/adr/0024-cdd-form-definitions.md, contentpacks/ng-core — this page is written for an external reader rather than extracted verbatim
Customer risk is scored from weighted factors defined in a content pack rather than in code. The shipped Nigerian core pack scores geography, occupation, PEP status, product type, transaction behaviour and KYC tier. Each factor carries a weight and each value a score; the total places the customer in a band.
CDD formsPermalink to this section
The questions asked at onboarding are a versioned form definition, not a fixed schema. Answers are stored verbatim against the form version that was in force when they were given, so a review two years later can see the question as it was asked rather than as it is asked now.
A submitted answer set is validated against the form: a key that is not on the form is rejected, and a required question left unanswered is rejected. The form and the answers arrive in one call and one transaction, because splitting them would permit a party with no customer record, or a customer whose CDD answers were never captured.
Tiering and enhanced due diligencePermalink to this section
- 1
Capture
The relationship or front-office persona submits the CDD form with the party's names, identifiers and attributes.
- 2
Score
Factors are applied and the customer bands low, medium, high or prohibited.
- 3
Trigger
Categorical triggers — PEP status among them — fire independently of the band and set the review interval.
- 4
Approve
Approval is maker-checker. The approver is not the submitter, and the tier's evidence requirements gate the transition.