> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zenoo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk Scoring

> Understand the 4-dimension risk model, scoring algorithm, tier assignment, and risk assessment lifecycle.

# Risk Scoring

Zenoo implements a FATF-aligned, 4-dimension risk assessment model. Every case receives a risk score across four dimensions, producing an overall risk tier that drives due diligence requirements and review frequency.

## The 4 dimensions

Risk is assessed independently across four dimensions. Each dimension scores 0-100 and maps to a tier:

| Dimension           | What it measures                              | Example factors                                         |
| ------------------- | --------------------------------------------- | ------------------------------------------------------- |
| **Customer**        | Inherent risk of the customer entity          | PEP status, sanctions exposure, adverse media, industry |
| **Geographic**      | Country and jurisdiction risk                 | FATF grey/black list, EU High-Risk, Basel AML Index     |
| **Product/Service** | Risk associated with the products or services | Financial services, crypto, high-value transactions     |
| **Channel**         | Risk from the delivery channel                | Online-only, face-to-face, third-party introduction     |

```mermaid theme={null}
flowchart LR
    A[Case Alerts + Entity Data] --> B[Customer Score]
    A --> C[Geographic Score]
    A --> D[Product Score]
    A --> E[Channel Score]
    B --> F[Overall Risk]
    C --> F
    D --> F
    E --> F
    F --> G{Highest Tier Wins}
    G -->|High| H[High Risk]
    G -->|Medium| I[Medium Risk]
    G -->|Low| J[Low Risk]
```

## Scoring algorithm

Each dimension score is calculated from the alerts and entity attributes associated with the case. The system maps alert categories and entity properties to dimensions using configurable rules.

### Score to tier mapping

| Score Range | Tier     |
| ----------- | -------- |
| 70-100      | `High`   |
| 40-69       | `Medium` |
| 0-39        | `Low`    |

<Info>
  These thresholds are configurable per risk model. The values above are defaults. You can adjust `high_threshold` and `medium_threshold` when creating or modifying a risk model.
</Info>

### Overall tier calculation

The overall risk tier is determined by the **highest-tier-wins** rule: if any single dimension is rated High, the overall tier is High. This conservative approach ensures that concentrated risk in any dimension triggers appropriate due diligence.

## Risk assessment lifecycle

```mermaid theme={null}
stateDiagram-v2
    [*] --> Draft : Assessment created
    Draft --> Active : Scores calculated
    Active --> Approved : Reviewer approves
    Active --> Overridden : Analyst overrides tier
    Overridden --> Approved : Override approved
    Approved --> Superseded : New assessment created
    Superseded --> [*]
    Approved --> [*]
```

| Status       | Description                                                |
| ------------ | ---------------------------------------------------------- |
| `Draft`      | Assessment created but dimension scores not yet calculated |
| `Active`     | Scores calculated, awaiting review                         |
| `Superseded` | Replaced by a newer assessment                             |
| `Overridden` | Analyst has manually overridden the calculated tier        |
| `Approved`   | Reviewed and approved -- becomes the effective assessment  |

## Analyst overrides

Analysts can override the calculated tier when additional context justifies a different risk rating. Overrides require:

1. A new tier selection (High, Medium, or Low)
2. A documented justification
3. Approval by a second reviewer (four-eyes principle)

```bash theme={null}
curl -X POST https://api.zenoo.com/v1/risk-assessments/rsk_abc123/override \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "override_tier": "Low",
    "reason": "PEP match is for a former local councillor with no current exposure. Customer has 10-year clean banking history."
  }'
```

The override is logged in the audit trail and the effective tier becomes the override value until a new assessment supersedes it.

## Risk factors

Each dimension can include specific risk factors that explain the score:

```json theme={null}
{
  "dimension": "Customer",
  "score": 65,
  "tier": "Medium",
  "factors": [
    "UBO identified as former PEP (councillor, 2010-2014)",
    "Financial Services industry classification",
    "No adverse media findings"
  ]
}
```

Factors are generated from:

* **Alert-based factors**: Each resolved alert category contributes a factor with its severity
* **Entity attribute factors**: Jurisdiction, industry, corporate structure complexity
* **Country risk factors**: FATF status, EU High-Risk listing, Basel AML Index score

## EDD triggers

When the overall risk tier is `High`, Enhanced Due Diligence (EDD) requirements are automatically added:

| Trigger             | EDD Requirement                               |
| ------------------- | --------------------------------------------- |
| Overall tier = High | Source of Wealth check for UBOs and Directors |
| Sanctions exposure  | Enhanced screening with ongoing monitoring    |
| Senior PEP          | Mandatory senior reviewer approval            |
| Complex structure   | Full corporate structure verification         |

## Configurable risk models

Zenoo supports multiple configurable risk models with:

* **Per-model thresholds**: Customize High/Medium score thresholds
* **Custom rules**: Define scoring rules by alert category, entity attribute, or country data
* **Champion/Challenger**: A/B test new models in shadow mode before promoting
* **What-If Analysis**: Backtest parameter changes against historical assessments
* **AI Tuning**: Generate data-driven optimization recommendations

## Next steps

* [Alert Management](/guides/alert-management). How alerts contribute to risk scoring.
* [Audit Trail](/guides/audit-trail). Track all risk assessment events.
* [Cases Data Model](/data-model/cases). Case-level risk fields.
* [Status Enums](/reference/status-enums). All risk tier and assessment status values.