ENAnti-money laundering · Risk profile
A risk profile is not a label. It is a justification.
The risk-based approach is the backbone of D.Lgs. 231/2007: the extent of customer due diligence measures is modulated on the risk of the customer, the relationship and the transaction (article 17, paragraph 3). A profile that does not say which factors it comes from cannot be defended in a review. Below are the factors the law lists, the three levels with what each requires, the case of politically exposed persons, the rule on sanctions and the two possible errors, with their different weight.
Article 17, paragraph 3, and annexes of D.Lgs. 231/2007
The factors the law asks us to weigh.
The decree lists the factors in two families, relating to the customer and to the relationship, and details them in annex 1 (potentially low risk) and annex 2 (potentially high risk); the Bank of Italy Provisions of 30 July 2019 apply them to intermediaries. For each family, the signals that Complify actually measures, with the source.
Customer and beneficial owner
Legal nature, activity carried out, conduct at the time of the transaction.
What the rule says. Letter a of paragraph 3: the legal nature, the main activity carried out, the conduct at the time of carrying out the transaction or establishing the relationship, the geographical area of residence or registered office of the customer and the counterparty. Annex 2 adds anomalous or excessively complex ownership structures, companies with nominee or bearer shareholders, cash-intensive activities.
What Complify measures. Legal form and sector from the Register; age of the company, dissolution, liquidation, striking off; trusts and trust companies (fiduciarie) in the shareholding structure; beneficial owners and companies abroad; chains of more than three levels; shareholders and positions changed in the last two years; shell company indicators; protesti, pregiudizievoli and insolvency proceedings on the company, its shareholders and its officers.
Geographical area
High-risk third countries, non-cooperative jurisdictions, territories with a high presence of organised crime.
What the rule says. Annex 2 names the countries that the European Commission identifies as high-risk, those subject to sanctions or embargo, those that finance terrorist activities and those with significant levels of corruption. Article 24 requires enhanced verification for customers linked to a high-risk third country.
What Complify measures. The registered office and residence of the customer and of the beneficial owner, the country of every company in the chain, the province and region in Italy, compared with the lists in force as at the date of the document. The weight of each list is agreed with you.
Relationship and transaction
Type, how it is carried out, amount, frequency, reasonableness in relation to the customer's activity.
What the rule says. Letter b of paragraph 3: the type of transaction or relationship, how it is carried out, the amount, frequency and volume, the duration, the reasonableness in relation to the activity carried out, the geographical area of destination. Annex 2 names remote relationships without adequate safeguards, payments from unknown third parties, products that favour anonymity.
What Complify measures. In ComplifyADV's customer due diligence the operator gathers the purpose and nature of the relationship in the interview, and the data of the bank's systems enter the case; the financial statements and the reclassified accounts say whether the activity is consistent with the size of the company.
Three levels, three forms of verification
The level sets how deep to go. The reasoning says why.
Risk comes out in three levels, high, medium and low, and each level brings with it the form of customer due diligence. The rules set the level and remain written down; on the platform artificial intelligence reads the whole picture, writes why and can only raise the level, never lower it. If the sources are not enough, the document writes “not computable” and says what is missing: a low level for lack of data would be a false negative.
High · enhanced verification
Article 24
More information on the customer and the beneficial owner, on the origin of funds and of wealth, on the reasons for the transaction; authorisation from a higher level; more frequent ongoing monitoring. Mandatory by law with politically exposed persons, high-risk third countries and cross-border correspondent relationships. In the document, the reasoning lists the factors that determined it, starting from the heaviest.
Medium · ordinary verification
Articles 18 and 19
Identification and verification of the customer, the person acting on its behalf and the beneficial owner; purpose and nature of the relationship; ongoing monitoring. This is the form for most customers. The document proposes how to mitigate the factors that weigh, from asking for one more document to a review sooner in time.
Low · simplified verification
Article 23
Measures reduced in extent and frequency (article 23), for example with public administrations, listed companies and supervised intermediaries. Simplifying does not mean omitting: the simplification must be documented, and ongoing monitoring remains. If a factor from annex 2 appears during the relationship, the level goes up.
The form of verification follows the level, and the level follows the factors: it is the logical chain an inspector retraces, and for that reason the document writes it out in full.
Politically exposed persons
With a politically exposed person the law leaves no choice.
The definition is in article 1, paragraph 2, letter dd, of the decree: natural persons who hold, or have ceased to hold within the last year, prominent public positions, their family members and those known to have close ties with them. The list of positions is in the rule, and it is not a list of names: screening compares the customer and its beneficial owner with the databases that reconstruct it, in Italy and worldwide.
- Positions: heads of state and government, ministers and deputy ministers, members of parliament, members of supreme and constitutional courts, of the court of auditors and of central bank boards, ambassadors, senior officers, members of the governing bodies of state-owned enterprises, executives of international organisations; in Italy also regional positions and those of provincial capitals and of municipalities above fifteen thousand inhabitants, and the directors of health authorities.
- Family members: parents, spouse or person in a civil union or de facto cohabitation, children and their spouses or cohabitants.
- Close ties: those who hold, together with the exposed person, the beneficial ownership of entities or business relationships, or who hold it alone in entities set up in practice for that person's benefit.
Article 24, paragraph 5 · what it requires
- Authorisation from the director general, a delegate or whoever performs an equivalent function, before starting or continuing the relationship.
- Adequate measures to establish the origin of wealth and of the funds used in the relationship or transaction.
- More intense ongoing monitoring throughout the relationship.
- The status remains for one year after the position ceases; after that, the risk is assessed case by case.
In the Complify document the exposed person is marked with the position, the country and the source, and a distinction is made between those exposed in their own right and those exposed through family or business ties. In ComplifyADV the case passes to the authorisation level that your procedure provides for under article 24.
Screening: lists, sanctions, adverse media
Two possible errors, with different weight.
Every screening compares a name with a list, and a comparison can be wrong in two directions. They are called false positive and false negative, and a system that treats them alike is badly calibrated: the first costs time, the second costs a breach.
False positive
An unrelated customer flagged because of a namesake.
It costs the office work, a slowed-down relationship, sometimes a lost customer. It is managed by refining the comparison: primary name by whole words, year of birth derived from the codice fiscale for individuals, company name without the legal form and country of the registered office for companies. What the filter discards is not thrown away: it stays in the document, downgraded, outside the assessment and inside the view, so that whoever signs can disagree.
False negative
A person on a list who passes as clean.
It costs a breach, with the sanctions of article 56 and, if the transaction should have been reported, of article 58 of the decree; and the damage is not seen until someone else finds it. That is why the filter does not apply to sanctions lists: the freezing of funds is a legal obligation, not a measure proportionate to risk, and every subject is checked against the European Union and United Nations lists without any country or year-of-birth filter. Filters remain for politically exposed persons and for adverse media, where namesakes are the rule.
A few more false positives are accepted. The aim is to keep false negatives as close to zero as possible, and to be able to show how.
Where Complify does it
When the relationship is opened and throughout its duration.
At opening: Know Your Customer worldwide
- Information from official sources and from those you provide, on companies and individuals, in Italy and abroad.
- The indicators and the money laundering risk on three levels, with the reasoning in writing and a proposed mitigation for each outcome.
- Screening against sanctions, politically exposed persons and adverse media, across the whole world, with discarded matches kept in view.
- The calculation weights agreed with you and written in the document.
In the case: ComplifyADV
- The profile goes into the customer due diligence case and decides the form: ordinary, simplified or enhanced.
- The case rises to the authorisation level that the profile requires, and the approval remains recorded.
- Artificial intelligence reads the cases, recognises the patterns of positions at high risk and flags in advance those heading the same way; the decision stays with the bank.
Over time: the review
- The profile sets the frequency of review; Regulation (EU) 2024/1624 will set the ceilings: at least annually for high risk, at least every five years for the others (article 26).
- A change that matters does not wait for the deadline: it reopens the case. See the page on ongoing monitoring.
- The document is fixed to the date of the data and states it: the profile on which you based your decision can be read again as it was.
Sources. Legislative Decree no. 231 of 21 November 2007, articles 1, 17, 18, 19, 23, 24, 56 and 58 and annexes 1 and 2 (Normattiva); Bank of Italy, Provisions on customer due diligence, 30 July 2019 and subsequent amendments; Regulation (EU) 2024/1624, article 26 (Official Journal of the European Union). Checked on 9 October 2026. This page offers orientation; it does not replace the official texts or an opinion on your case.
Frequently asked questions
The questions we are asked on this topic.
Which factors weigh in the customer's risk profile?
Those of article 17, paragraph 3, of D.Lgs. 231/2007: the legal nature, the activity and the conduct of the customer and the beneficial owner, the geographical area, the type of relationship or transaction, the way it is carried out. Annex 1 lists the factors of low risk, annex 2 those of high risk, and the Bank of Italy Provisions apply them to intermediaries. In the profile, protesti and pregiudizievoli, insolvency proceedings, the age of the company, the presence of trusts or trust companies in the shareholding structure, changes of shareholders and directors, shell company indicators, the sector and the territory also weigh. The weights are agreed with you and remain written.
What changes for a politically exposed person?
The definition is that of article 1, paragraph 2, letter dd: those who hold, or have ceased to hold within the last year, prominent public positions, their family members and those with close ties to them. With a politically exposed person, customer due diligence is enhanced by law (article 24, paragraph 5): authorisation from the director general or whoever acts in that role before starting or continuing the relationship, adequate measures to establish the origin of wealth and funds, more intense ongoing monitoring. Screening covers the whole world and distinguishes those who are exposed in their own right from those who are exposed through a link.
Why is the risk-based approach not applied to sanctions screening?
Because the freezing of funds is a legal obligation, not a measure proportionate to risk: the Union and United Nations lists apply to everyone, and an unrecognised name is a breach, not an inaccuracy. That is why every subject, company or individual, is checked against sanctions lists without any country or year-of-birth filter, while the filters are used for politically exposed persons and adverse media, where namesakes are the rule.
False positives and false negatives: which of the two costs more?
The false negative. A false positive costs time and a slowed-down relationship; a false negative lets through a position that should have been stopped, and the responsibility lies with the obliged entity. That is why matches are filtered with written rules, primary name and year of birth for individuals, name without legal form and country for companies, and what the filter discards is not thrown away: it stays in the document, downgraded, outside the assessment and inside the view, so that whoever signs can disagree.
Complify Yourself!
Send us ten VAT numbers from your portfolio: you will find them sorted by risk, with the reasoning, and you can see for yourself whether it holds up.