Risk Assessment Tools & Client Risk Scoring

1. Risk Assessment Tools & Client Risk Scoring

2. Regulatory Requirements: Institutions should have a risk based approach to managing AML Institutions should identify higher risk clients and perform enhanced due diligence and on going monitoring Risk Based Approach

3. Product Geography Client Type Enterprise Enterprise Unit AML Inherent AML Assessment SAMPLE CONTROLS AML Program Assessment High Risk Business Units Branch Risk Ratings More frequent review and training High Risk Branches Client Risk Scoring Targeted client due diligence and transaction monitoring High Risk Clients Product Risk Assessment Automated transaction monitoring & tighter controls High Risk Products Risk Based AML Programs

4. RBC has developed tools to quantify risk associated with the primary drivers of AML Risk: Geography AML Country Risk Model Products / Services Product / Service Risk Assessment Customers / Clients Client Type / Segment Risk Model RBC Risk Assessment - Tools

5. Effective Risk Based AML Programs require an enterprise-wide approach Results should answer these questions: What is the scope of our risk universe? What are our inherent AML risks? What internal controls will be needed and where? RBC has developed and implemented a Business Unit Risk Rating System to answer these questions Enterprise Approach

6. Business Units are scored relative to one another using the key risk drivers of geography, product & client The Risk Rating System contains logic to arrive at composite risk score for unit Higher number of points is intended to reflect a higher level of inherent AML risk within a business unit relative to other units Business units are assigned a risk rating of “High”, “Medium” or “Low” upon a review and analysis of all AML Inherent Risk Rating results. The model and ratings are updated annually Unit Inherent Risk Ratings

7. RBC Unit Risk Rating System (Sample)

8. RBC Unit Risk Rating System

9. RBC Unit Risk Rating System

10. RBC Unit Risk Rating System

11. Sample AML Inherent Unit Risk Ratings Distribution

12. Client Risk Assessment Processes: Client Risk Scoring

13. RBC has implemented a Client Risk Scoring (CRS) Solution for the Canadian retail banking client base. Solution has 2 components: 1. Scoring Clients are risk scored through SAS EDD queue in the AML System 2. Enhanced Transaction Monitoring New Queue in the Transaction Monitoring System New rules tailored to the Client Risk Type RBC Approach to Client Risk Scoring in Retail Banking

15. Tiered Client Risk Management • Highest risk clients are appropriately identified, investigated and monitored • Ensures that all clients in RBC are appropriately monitored on an on-going basis

16. Key AML Risk Drivers The key criteria used in rating client risk are: • Geographic Risk • RBC Country Risk Ratings • RBC State Model Ratings • Client Type Risk • RBC Business Risk Ratings (SIC Codes) • Product Risk • Product Risk Assessments The CRS system leverages the models RBC has developed to risk rank the attributes related to the above-noted criteria.

17. Risk Drivers - Geography

18. Risk Drivers - Client

19. Risk Drivers - Products

20. CRS Model - Approach

21. CRS Segmentation and Scoring • RBC solution is a hybrid model that uses both rules and a scoring engine • Certain clients by their nature always require EDD • Other clients will be identified through scoring a combination of risk factors • Personal and Business clients are scored in different models and have different risk types

22. Personal Client Risk Types Politically Exposed Person Non-Resident High Net Worth Monitor (High Risk Score) Business Client Risk Types Money Service Business Non Government Organization Non Bank Financial Institutions Non-Resident Monitor (High Risk Score) Look to your regulatory guidance and your client base for appropriate categories Examples of Client Risk Categories to Consider

23. Personal Client Scoring Approach

24. Personal Client Scoring Approach

25. Weighted - Additive Approach is used to Determine the CRS Risk Score Data elements are scored (e.g. Country Risk Ratings) Risk Drivers are weighted for relative importance in determining client risk Clients exceeding a predetermined threshold will be subject to EDD CRS Scoring Model

26. CRS Model – Examples

27. CRS Model - Examples

28. Non-Personal Client Scoring

29. Scoring Frequency • 1. Initial Load (all Clients) • Assigns client to appropriate Client Risk Type for Enhanced Transaction Monitoring • Select high risk clients to generate EDD incidents • These incidents will be handled through batch EDD mechanism (potential sources include World Check Stand Alone Filter, Syfact, Complinet) • 2. Daily Scoring • Client will be scored / rescored when a new account is opened • 3. Periodic Scoring • Captures changes to client demographic profile • Captures changes to client transaction activity

30. Assigning Thresholds - Transactions • The initial and periodic model assesses and scores client transaction volume activity • Type of transactions include: • Domestic wires • International wires • Cash transactions (LCTRs) All are measured on frequency and value of transactions

31. Assigning Thresholds - Transactions • To better analyze clients transactions peer groups were created based on client segment • Each of the 5 peer groups can have different thresholds and scores assigned to a given level of transaction activity

32. Assigning Thresholds • Can set different scoring thresholds for: • Business clients initial / periodic model • Personal clients initial / periodic model • Business clients daily model • Personal clients daily model

33. Assigning Thresholds

34. Need a case management system Consider creating a score override function: AML risk is not a science Override enables you to elevate a client’s score based on other information Enhanced Due Diligence for Clients that are identified through CRS

35. Client Risk Type

36. EDD - Queue

37. Enhanced Transaction Monitoring

38. QUESTIONS?