Step 1
Passport and application form
Customer data comes from a KYC session or from your system: full name, date of birth, document, citizenship, country of residence, product, service channel, expected amounts.
AML risk and customer scoring
AML risk is the likelihood that a customer will be used to launder proceeds of crime or finance terrorism. 115‑FZ requires you to assess it when you take a customer on and to review it for as long as they remain your customer. NeuroVision checks the customer against the passport, the Rosfinmonitoring lists, sanctions, PEP and Russian registers and returns the results you build your assessment on under your own internal control rules: the risk group, the measures and the review date are yours to approve.
Data for risk assessment The decision rests with your internal control rules Russian software registry no. 19972
Customer AML risk assessment: what compliance sees after the checks
A customer’s AML risk is made up of a dozen facts: who they are, where they are from, which product they use and what the checks found. NeuroVision covers the last part: it runs the database checks and returns the results, so the AML/CFT officer does not have to gather details from different websites.
-
A result for every check
Checks from your set run on the passport and the application form. For each one you get a result and the details of the match found, if there is one. The database checks are asynchronous: you request the result by the run number.
-
Watchlists and sanctions
A match with the list of terrorists and extremists, a decision of the Interagency Commission or a sanctions list is the strongest risk factor: most internal control rules put such a customer straight into the high group. The procedure for watchlists is on the page list checks.
-
PEP and related persons
A politically exposed person, their relatives and associates raise the customer’s risk. How to check status and links is on the page PEP screening.
-
Customer details and document
Passport validity, wanted status, bankruptcy, account blocks and nominee management at companies — information that confirms or disproves the data in the application form.
-
The risk group is your decision
You decide the low, medium or high group, the measures and the review date under your internal control rules. NeuroVision provides data for the assessment and does not assign a risk level for you.
-
Review deadlines
Low risk — at least once every three years; medium and high — at least once a year (subpara. 3, para. 1, art. 7, 115‑FZ). Database checks can be repeated at any time — for example, before a scheduled review.
The risk-based approach: what 115‑FZ and the Bank of Russia require
Since 2022, risk assessment has been a direct obligation under article 7 of 115‑FZ, not merely a requirement of the internal control rules. AML control is built around risk: the higher the customer’s group, the deeper the check and the more often details are updated.
- On take-on and during the relationship
The risk of suspicious transactions is assessed taking into account the national risk assessment, the customer’s line of business and their products - Three groups
The bank places each customer in the low, medium or high risk group
- Measures under the internal control rules
For the risks identified, the measures set out in the internal control rules are applied - Depth of due diligence
The purpose and nature of the relationship, financial position, business reputation, sources of funds — the scope depends on the risk
- Low risk
At least once every three years - Medium and high
At least once a year; if accuracy is in doubt — within seven working days
- Risk management programme
The procedure for assigning a level, the criteria, and the review deadlines and frequency — in the bank’s programme - Organisations not supervised by the Bank of Russia
Estate agents, pawnshops, leasing companies, precious metals dealers and other persons under art. 5 draw up their internal control rules under Government Decree No. 1157
- The provisions are given as amended at 21 October 2026. For banks, the internal control rules requirements are set by Bank of Russia Regulation No. 860‑P; for organisations not supervised by the Bank of Russia — by Government Decree No. 1157. Check with your lawyer.
- A suspicious transaction must be reported to Rosfinmonitoring no later than three working days after it is identified (para. 3, art. 7). How to turn the requirements into your own methodology is covered in the section “Risk management programme”.
Who needs customer risk assessment
The obligation to assess risk applies to all organisations listed in article 5 of 115‑FZ. What differs are the requirements for the internal control rules, the volumes and the factors that matter in the sector.
-
Banks
- Three groups under 860‑P and reconciliation with the Know Your Customer group for legal entities and sole traders
- Individuals opening an account remotely
- Solutions for banks
-
Microfinance and credit cooperatives
- Online lending without a meeting — the service channel is taken into account in the risk assessment
- Nominee borrowers and money mules
- Solutions for microfinance organisations
-
Brokers, insurers and leasing
- Source of funds for large contributions
- A shell lessee — screened by INN and director
-
Payment services and fintech
- A high inflow of new customers — assessment at the moment of registration
- Review when the transaction profile changes
-
Estate agents, jewellers, pawnshops
- Real estate and precious metals deals — higher risk by line of business
- Foreign buyers — the country factor
-
Lottery operators and bookmakers
- Large winnings and frequent payouts — a product factor
- Watchlist screening before payout
How NeuroVision checks fit into customer risk assessment
Five steps from the application form to an entry in the log. Steps 1–3 are the database checks; steps 4–5 are risk assessment and the decision under your rules: an employee steps in at medium and high risk.
Step 2
Database checks
The checks from your set are run: Rosfinmonitoring lists, sanctions, PEP, passport validity, wanted status, bankruptcy, account blocks, links with companies. The checks are asynchronous: you request the result by the run number.
Step 3
Check results
For each check — a result: no matches or information found. A match with a watchlist or a sanctions list calls for immediate action under the internal control rules; the other results become assessment facts.
Step 4
Assessment under your methodology
The results and the application form factors are matched against the criteria in the internal control rules, and the customer receives a group: low, medium or high. Low risk — the customer proceeds; medium — a request for the source of funds; high — a task for the responsible officer.
Step 5
Decision and record
The officer confirms or changes the group with a comment. The assessment, its basis and the date of the next review are saved in your organisation’s log.
AML risk factors: customer, country, product and channel
A single factor is not a verdict
Being a foreign national does not mean high risk. The organisation assesses the factors together, and which of them put a customer straight into the high group, for example a watchlist match, is decided by its methodology.
- 01
Customer and beneficial owner
Status as a politically exposed person or their relative, doubts about documents, past refusals, watchlist matches, nominee management, a mass-registration address, nil reporting alongside money movements.
- 02
Country
Sanctions and special economic measures, FATF-listed countries, high corruption, support for terrorism, drug trafficking. Citizenship, registration, and the country of operations and of counterparties are taken into account.
- 03
Product and business activity
Cash, transfers without opening an account, real estate, precious metals, gambling and lotteries, pawnshops and microfinance, charity — higher-risk activities and services.
- 04
Channel and behaviour
Remote onboarding without a meeting, one device identifier shared by several customers, a mismatch between the application form and the document, a refusal to disclose the purpose of the relationship.
- 3 categories of risk under Regulation No. 860‑P
- 3 groups low, medium and high
- 3 years the maximum between updates at low risk
Low, medium or high risk: which measures to take
When to review a customer’s risk level
-
The scheduled date has come
Low risk — at least once every three years, all others — at least once a year (subpara. 3, para. 1, art. 7, 115‑FZ). Repeat the database checks and update the assessment.
-
Watchlists and lists were updated
A customer may have been added to a watchlist or a sanctions list, or become a politically exposed person, after take-on. Repeat the database checks across the customer base: the API request can be run again at any time.
-
The customer’s data changed
A new passport, citizenship, address, beneficial owner or director. If accuracy is in doubt, details are updated within seven working days.
-
The transaction profile changed
A sharp rise in turnover, new countries or signs of unusual transactions — a signal from transaction monitoring. How to set it up is on the page KYT
The law requires risk to be assessed not only at take-on but also during the relationship. The scheduled date comes from your internal control rules, but there is no need to wait for it if something has changed for the customer: the checks are then repeated on the event.
Data for assessment: checks for an individual, a foreign national and a company
A risk assessment is only as accurate as the data is complete. Database checks do not require a KYC session: a full name, date of birth and document are enough. If the data was not sufficient, that is not the same as “no matches”: such a check must be run once the data has been clarified.
- Catalogue of checks
A Russian citizen
Passport — recognition and document anti-fraud, then Russian registers.
What is checked
- Rosfinmonitoring list of terrorists and extremists
- OFAC, EU, UK and UN sanctions
- Passport validity
- Wanted lists of the Ministry of Internal Affairs and the Federal Bailiff Service
- Bankruptcy and account blocks
- Nominee management
- The basic package of checks against Russian databases — 50 ₽
- About sanctions screening
A foreign national
The passport of a foreign citizen and the checks that matter for a non-resident.
What is checked
- International screening: sanctions and PEP in one request — 36 ₽
- Register of controlled foreign persons of the Ministry of Internal Affairs
- Country of citizenship — into the country factor of the assessment
- PEP screening with relatives
- KYB by INN
A company or sole trader
A corporate customer: the risk depends on the company, its director and its beneficial owners.
What is checked
- Status, address and signs of a shell company by INN
- Director and founders against watchlists and sanctions
- Account blocks by Federal Tax Service decisions
Risk management programme in the internal control rules: what to set out in it
The methodology and the decisions are defined by the organisation. In the risk assessment programme it sets the procedure for assigning a level, the criteria and the review deadlines (para. 4.10 of Regulation No. 860‑P). Below are the sections worth setting out in it so that the database checks work for your methodology.
- List of factors
Which features of the customer, country, product and channel are taken into account and how each affects the risk group - Data sources
Which database checks are mandatory for an individual, a foreign national and a company
- Group criteria
Which combinations of factors give low, medium and high risk - Stop factors
What gives high risk under any combination: watchlists, Interagency Commission decisions, sanctions
- Scheduled review
Frequency by group, no less often than the deadlines in the law - Event-driven review
A change in data, watchlists, transaction profile
- Who may change the group
The responsible officer and the basis for a manual decision - Storing assessments
Assessment history, methodology versions and source data — for inspection by the regulator
- This is a guide for your lawyer, not a template of internal control rules. The methodology takes into account the type and scale of the business and the results of the national risk assessment published by Rosfinmonitoring.
How much the checks for AML risk assessment cost
You pay for the checks performed, with no subscription fee. Checks skipped for lack of data are not charged.
- Catalogue
Checks against Russian databases
5 ₽
per check: Rosfinmonitoring lists, sanctions, wanted status, bankruptcy and others; the basic check package — 50 ₽
- Price matrix
International screening
36 ₽
per check: sanctions and PEP in one request
- Calculate
KYC of a customer by passport
from 16 ₽
per session; with a liveness check — from 29 ₽
A set of checks for your process and volume — submit a request, and we will send you a quote.
How to build the checks into onboarding and servicing
An organisation’s AML system consists of identification, checks, risk assessment, transaction monitoring and reporting. NeuroVision covers identification and the database checks; risk assessment stays in your process and is based on their results.
- Database checks
- Result by runId
- From a KYC session
- The decision is yours
Test access on the day you ask for it.
Integration takes from one working day.
AML risk glossary
Terms of 115‑FZ, Regulation No. 860‑P and customer risk assessment.
- AML risk
- The degree (level) of risk that a customer will carry out transactions for the purpose of laundering proceeds of crime or financing terrorism; in 115‑FZ — “the risk of suspicious transactions”.
- AML risk
- Risk-based approach
- An AML/CFT principle: the depth of a check and how often details are updated depend on the customer’s risk level.
- risk-based approach
- Risk group
- The low, medium or high degree of risk to which an organisation assigns a customer.
- risk rating
- Customer scoring
- Assessment of a customer under the organisation’s methodology: factors and check results are combined into a risk group. The methodology and criteria are approved by the organisation in its internal control rules.
- customer scoring
- Stop factor
- A feature on which an organisation places a customer in the high group regardless of the other factors: for example, a match with a watchlist, an Interagency Commission decision or a sanctions list.
- National risk assessment
- An assessment of money laundering and terrorist financing risks in Russia, carried out and published by Rosfinmonitoring; organisations take it into account in their methodology.
- NRA
- Internal control rules (PVK)
- Internal control rules for AML/CFT purposes; they include the risk management programme.
- AML policy
- Know Your Customer platform (ZSK)
- The Bank of Russia’s “Know Your Customer” platform: it assigns legal entities and sole traders to the green, yellow or red group for banks.
- Ongoing customer monitoring
- Repeat checks and risk review throughout the relationship, not only at take-on.
- ongoing monitoring
Read also
369 28
KYC, AML and Digital Identification
Risk-based KYC: how to choose the verification level by risk profile
422 23
KYC, AML and Digital Identification
How Sanctions Screening, PEP Checks, and Risk Profiling Work After Customer Identification
114 29
KYC, AML and Digital Identification
115-FZ: What Businesses Are Required to Do and How to Meet the Law’s Requirements
377 25
KYC, AML and Digital Identification
AML checks and KYC: how modern financial compliance and sanctions screening systems work
437 10
KYC, AML and Digital Identification
False Positives in AML Screening: How to Reduce Escalations and Preserve Onboarding Conversion
Frequently asked questions about AML risk and customer assessment
It is the likelihood that a customer will be used to launder proceeds of crime or finance terrorism. 115‑FZ calls it the degree (level) of risk of suspicious transactions. An organisation assesses it when it takes a customer on and during the relationship, and places the customer in the low, medium or high group. The group determines the depth of the check and the deadline for updating details. For a general overview of AML, see the blog article.
Yes. Since 2022 this has been a direct obligation under subparagraph 3.1 of paragraph 1 of article 7 of 115‑FZ for all organisations that carry out transactions with funds or other property. Banks place each customer in one of three groups and describe the methodology in the risk management programme under Bank of Russia Regulation No. 860‑P.
Details of low-risk customers are updated at least once every three years, of all others — at least once a year, and where accuracy is in doubt — within seven working days. The risk is reviewed together with the details. Besides the scheduled deadlines, risk is recalculated on events: new customer data, updated watchlists, a change in the transaction profile.
No. Requirements for banks’ internal control rules are now set by Bank of Russia Regulation of 18 June 2025 No. 860‑P, and 375‑P has been repealed. For organisations not supervised by the Bank of Russia, Government Decree of 2 August 2025 No. 1157 applies in place of Decree No. 667.
The Know Your Customer platform (ZSK) is run by the Bank of Russia: it assesses legal entities and sole traders and passes the group to banks; it does not assess individuals. A bank uses it as supporting information and makes its own assessment. Customer risk assessment is your own work under your own methodology, for any customer, including individuals and foreign nationals; NeuroVision check results provide data for it, and a bank may take the ZSK group into account as an additional factor.
No. The risk group, the criteria, the measures and the decision are determined by the organisation in its internal control rules. NeuroVision runs the database checks — watchlists, sanctions, PEP, passport, Russian registers — and returns the results on which the assessment is built. If you need your methodology automated, describe it in your request — we will discuss how to build the checks into your process.
Act under your internal control rules: request documents on the source of funds and financial position, obtain approval from the responsible officer, and monitor transactions. High risk is not in itself grounds for refusal. If a transaction is deemed suspicious, the information is sent to Rosfinmonitoring no later than three working days after it is identified, and on a watchlist match the funds are frozen.
No. The database checks provide facts, and the decision on medium and high risk is made by the organisation’s responsible officer. It is worth keeping their confirmation or change of the group, with a comment, in your log: it is the basis for the inspector.
No, it is part of one. An organisation’s AML system includes customer identification, checks against watchlists and sanctions, risk assessment, transaction monitoring and reports to Rosfinmonitoring. NeuroVision covers identification and database checks, while transaction monitoring is on the page KYT.
Database checks are priced per the price matrix: 5 ₽ per check against Russian databases, 50 ₽ for the basic package, 36 ₽ for international screening; KYC by passport — from 16 ₽ per session. A set for your process and volume — submit a request, and we will send you a quote.
Connect the checks for AML risk assessment
Tell us how many customers you have and how your internal control rules are set up — we will open test access and help build the checks into your methodology.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
