Compliance guide
Building the risk profile of a business relationship
Updated: · Leutrim Miftaraj, FLIORE · Editorial standards · Other languages: Deutsch · Français · Español
Short answer
A risk profile records who stands behind a business relationship, what it is for, which assets and transactions are to be expected and which risk factors are present. From this follows a reasoned risk rating with the appropriate due diligence measures. Done well, it also serves as the benchmark for ongoing monitoring: anything that departs from the profile calls for clarification.
What the risk profile is for
The risk profile connects two questions: whom is the family office working with, and what is normal for this relationship? Without this basis, a risk rating cannot be justified and an unusual transaction cannot be recognised. Supervisory authorities and audit firms therefore look at the profile first, before they examine individual documents.
Building blocks of the profile
- Contracting party and beneficial owners with identification, residence, nationality and tax residence.
- Purpose and nature of the relationship: asset management, administration of structures, payments, succession planning.
- Source of wealth and of the funds brought in, with evidence.
- Expected level of assets, transaction volume, counterparties and countries.
- Structure: the companies, foundations and trusts involved, with their officers.
- Results of PEP, sanctions and adverse media screening.
Six steps to a rating
- Record and identify all persons and legal entities in full.
- Chart the structure and determine the beneficial owners at each level.
- Ask for and obtain evidence of the source of wealth and of funds.
- Screen for PEP status, sanctions and adverse media.
- Assess the risk factors against the internal criteria and set the rating.
- Document the reasoning, date and responsible person; set the next review date.
Weighting and reasoning
Many family offices work with a points system per criterion. That is helpful as long as it supports the assessment rather than replacing it. Certain factors should always lead to high risk, regardless of the score – for example a foreign PEP or a link to a state on the FATF black list. Conversely, a good score must not cover up a concrete suspicion.
The reasoning belongs in the file in words: which factors are present, how they were weighted and which measures follow. A sentence such as "low risk, long-standing family" is not enough.
Triggers for a reassessment
A profile is a snapshot. It is reassessed not only when the review interval expires but also when events occur: a new beneficial owner or beneficiary, a change of residence, election to political office, a screening hit, inflows significantly higher than expected, a change to the FATF lists or a new company in the structure.
Each trigger should have an owner and a deadline. A change of residence reported by email to one team member and never passed on is the typical gap that audits find; a single intake point for events closes it.
In FLIORE
In FLIORE the profile follows from the mandate itself: persons with roles, structure, tax residences, identity data, assets and documents. The risk assessment shows which factor determines the rating, and the audit trail records every change with time and person.
At a glance
| Core content | Persons, purpose, source of wealth, expected transactions, structure, screening |
|---|---|
| Result | Reasoned risk rating with measures and next review date |
| Second use | Benchmark for ongoing monitoring |
Terms on this page
- Beneficial owner
- The natural person who ultimately owns or controls a company, foundation or trust, or on whose behalf a transaction is carried out.
- Source of wealth
- How a person's total wealth came about, for example through entrepreneurship, inheritance or employment.
- Adverse media
- Publicly available reports about a person or company that point to money-laundering, corruption or other risks.
- Tax residence
- The country in which a person is subject to unlimited tax liability because of residence, stay or other criteria.
- Audit trail
- An unalterable log that records who created, changed, approved or deleted which data and when.
Frequently asked questions
Who prepares the risk profile?
The person who manages the relationship records the information; for high risk, a second person or the compliance function should confirm the rating. This preserves the four-eyes principle in the risk assessment as well.
Must the profile be in writing?
Yes. Anti-money laundering obligations only count as fulfilled if they are documented and comprehensible to third parties. An electronic profile is sufficient provided it is complete, dated and logged in a tamper-evident way.
What is the difference between the risk profile and the KYC file?
The KYC file collects all documents and evidence. The risk profile condenses them into an assessment and into expectations about the relationship. The profile is therefore part of the file – its most important summary.
How detailed must the expected transactions be?
Concrete enough that deviations can be recognised: usual order of magnitude, frequency, counterparties and countries. A statement such as "various payments" does not allow any monitoring.
Sources
- Swiss Anti-Money Laundering Act (AMLA/GwG, SR 955.0) – Fedlex
- German Money Laundering Act (GwG), section 10 – General due diligence obligations
- Austrian Financial Markets Anti-Money Laundering Act (FM-GwG) – Legal Information System (RIS)
- FATF Recommendations – Financial Action Task Force
This page provides orientation and does not replace legal or tax advice. The cited legal sources in their applicable version are authoritative.
Read more
More on Compliance in practice
FLIORE in your family office
See structures, compliance and consolidated wealth with your own questions – in a personal demo.