Which statement reflects FFIEC guidance regarding customer information?

Which statement reflects FFIEC guidance regarding customer information?

• A. The level and type of customer information should be commensurate with the customer's risk profile
• B. Not require any customer information for low risk
• C. Only require information for high-risk customers
• D. Requires determining risk only after onboarding

Answer: (A)

The idea being tested is using a risk-based approach to collecting and verifying customer information. FFIEC guidance emphasizes that how much information you gather and what kind of verification you perform should match the level of risk each customer presents. In other words, higher-risk customers require more detailed information and stronger due diligence, while lower-risk customers require less, but not zero, information. This approach helps ensure you have enough data to assess risk, monitor activity, and take appropriate action. The statement that the level and type of customer information should be commensurate with the customer's risk profile captures this principle directly. It reflects the need to tailor due diligence to risk: more controls and information for higher risk, still adequate but lighter verification for lower risk, and ongoing monitoring to spot new risks over time. Why the other ideas don’t fit: it’s not acceptable to say no information is needed for low risk, because even low-risk relationships require basic identity verification and understanding of the customer. Limiting information collection only to high-risk customers ignores the proportional approach, which FFIEC guidance advocates. Finally, assessing risk only after onboarding defeats the purpose of a risk-based framework, which should guide onboarding decisions and shape what information is collected and how it’s verified from the start and throughout the relationship.

The idea being tested is using a risk-based approach to collecting and verifying customer information. FFIEC guidance emphasizes that how much information you gather and what kind of verification you perform should match the level of risk each customer presents. In other words, higher-risk customers require more detailed information and stronger due diligence, while lower-risk customers require less, but not zero, information. This approach helps ensure you have enough data to assess risk, monitor activity, and take appropriate action.

The statement that the level and type of customer information should be commensurate with the customer's risk profile captures this principle directly. It reflects the need to tailor due diligence to risk: more controls and information for higher risk, still adequate but lighter verification for lower risk, and ongoing monitoring to spot new risks over time.

Why the other ideas don’t fit: it’s not acceptable to say no information is needed for low risk, because even low-risk relationships require basic identity verification and understanding of the customer. Limiting information collection only to high-risk customers ignores the proportional approach, which FFIEC guidance advocates. Finally, assessing risk only after onboarding defeats the purpose of a risk-based framework, which should guide onboarding decisions and shape what information is collected and how it’s verified from the start and throughout the relationship.