Configure risk
Our risk models use risk factors to measure a product application's risk level.
You choose which risk factors to include in your risk model. There are different risk factors for individual profiles and company profiles.
When the risk model is applied to a profile's product application, the profile’s details are checked against the condition of every risk factor rule to see if any conditions match.
The result impacts the application's total risk score as follows:
If a rule’s condition matches, the risk score for that rule is added to the application's total risk score.
If the conditions for multiple rules match, the highest risk score is used.
If the profile data required to match conditions is missing, the risk score is undetermined and no risk score is applied to the application's total risk score.
You can also group risk factors and apply the highest, lowest, mean, or sum of risk scores in the group to the total.
An application's risk score is recalculated in any of the following circumstances:
A user changes any of the profile's details manually. For example, if a user updates the profile’s address, the risk score is recalculated even if the Country of residence and Postal code risk factors are not used in the risk model.
An automated check returns new/updated results for a profile. For example, a new PEPs match is found for the profile during ongoing monitoring. The risk score is recalculated any time a potential match is found.
A significant date for one of the profile details is reached. For example, on the date of the profile’s Date of birth, the profile’s age is automatically recalculated, and the Age risk factor is impacted. The risk score is only recalculated when the significant date impacts a risk factor used in the risk model.
If a change impacts one risk factor in the risk model, the profile is re-evaluated for all risk factors in the risk model.
Configure risk factors
You choose which rules, conditions, and risk scores are used for each risk factor in your risk model.
For most conditions, you also provide a list, some text, or a number range to be matched with the profile’s data. Lists are always case-sensitive. Text is optionally case-sensitive.
For example, you might choose this for the Country of residence risk factor:
Rule | Conditions |
|---|---|
If an individual's country of residence is in Western Europe, add 0 to the application risk score. | The profile's country is included in this list: Belgium, France, Ireland, Luxembourg, Monaco, Netherlands, United Kingdom |
If an individual's country of residence is in North America, add 100 to the application risk score. | The profile's country is included in this list: Canada, United States |
If an individual's country of residence is anywhere else, add 999 to the application risk score. | The profile's country is not included in this list: Belgium, Canada, France, Ireland, Luxembourg, Monaco, Netherlands, United Kingdom, United States |
Following is the list of the risk factors available, along with the conditions you can use for each one.
When you define your risk model, you can choose to make any of these risk factors required or non-required. To learn more, see the definition of Risk models in Introduction to Passfort's terms.
Risk factors for individual profiles
The following factors are available for individual profiles:
Age
The risk associated with the individual's age.
Data matched: The profile’s date of birth is taken, and the individual’s age is determined by calculating the number of years between that date and today.
Condition:
The individual’s age falls within the number range you specify.
Every year on the day of the profile’s date of birth, the profile’s age is re-calculated and the profile is re-assessed for all risk factors in your risk model.
Calling code to country code
The risk associated with the country of the individual’s phone number.
Data matched: The country is found by looking up the international country calling code of the profile’s phone number. The associated alphabetic country code is provided. For example, the calling code +44 becomes the country code GBR.
Possible conditions:
The country code is included on the list you provide.
The country code is not included on the list you provide.
Country calling code
The risk associated with the calling code of the individual's phone number.
Data matched: The international country calling code is taken from the profile's phone number. For example, +44.
Possible conditions:
The calling code is included on the list you provide.
The calling code is not included on the list you provide.
Country of IP address
The risk associated with the country of the individual's IP address.
Data matched: The individual’s IP address captured via the API is looked up to find its approximate location. The associated country is provided.
Possible conditions:
The country is included on a list you provide.
The country is not included on a list you provide.
This risk factor can only be used if you’ve configured the API to capture the individual's IP address.
Country of residence
The risk associated with the individual’s current country of residence.
Data matched: The individual’s country of residence is taken from the profile’s current address.
Possible conditions:
The country is included on a list you provide.
The country is not included on a list you provide.
Any previous addresses that the profile has are not taken into consideration for this risk factor.
Custom field
The risk associated with a profile’s custom field, for example, Expected transaction volume per month or Product tier.
Data matched: The data taken from the custom field you specify.
Possible conditions when the data is text:
The data is included on a list you provide.
The data is excluded from a list you provide.
The data exactly matches text you provide.
The data starts with text you provide.
The data ends with text you provide.
The data contains text you provide.
Possible conditions when the data is a number:
The data falls within a number range you specify.
The data is less than a number you specify.
The data is less than or equal to a number you specify.
The data is greater than a number you specify.
The data is greater than or equal to a number you specify.
Possible conditions when the data is multi-select:
The options selected for the custom field match exactly with a list of options you provide.
All of the options selected for the custom field are included in a list of options you provide.
Any of the options selected for the custom field are included on a list of options you provide.
All of the options selected for the custom field are excluded from a list of options you provide.
Any of the options selected for the custom field are excluded from a list of options you provide.
Data result: For this risk factor, you can also specify that a prefix or suffix is added to the resulting data so it’s easier for users to read. For example, you might choose the prefix £, as in £100, or the suffix customers, as in 100 customers.
If the value of the custom field is a date, use the Custom field date to months risk factor.
Custom field date to months
The risk associated with the number of months that have passed between the date in a profile’s custom field, for example, Date of first transaction, and today.
Data matched: The date is taken from the specified custom field, and the number of months between that date and today is calculated.
Possible conditions:
The data falls within a number range you specify.
The data is less than a number you specify.
The data is less than or equal to a number you specify.
The data is greater than a number you specify.
The data is greater than or equal to a number you specify.
Every month on the date of the specified custom field, the number of months is re-calculated, and the profile is re-assessed for all risk factors in your risk model.
Email address
The risk associated with the individual’s email address.
Data matched: The email address is taken from the profile’s Email address field.
Possible conditions:
The email address is included on a list you provide.
The email address is not included on a list you provide.
The email address exactly matches an email address you provide.
The email address starts with letters/numbers/symbols you provide.
The email address ends with letters/numbers/symbols you provide.
The email address contains letters/numbers/symbols you provide.
Nationality
The risk associated with the country of the profile’s nationality.
Data matched: The country of nationality is taken from the profile’s Nationality.
Possible conditions:
The country is included on a list you provide.
The country is not included on a list you provide.
Postal code
The risk associated with the individual’s current postal code.
Data matched: The postal code is taken from the profile’s current address.
Possible conditions:
The postal code is included on a list you provide.
The postal code is not included on a list you provide.
The postal code exactly matches a postal code you provide.
The postal code starts with letters/numbers you provide.
The postal code ends with letters/numbers you provide.
The postal code contains letters/numbers you provide.
Screening matches
The risk associated with screening matches of a specified type.
Data matched: The screening matches discovered when the profile is screened for a product application or as part of ongoing monitoring.
You can choose any of the following match types:
Sanctions
Adverse media
Other
Merchant fraud
Possible conditions:
The profile has one or more confirmed matches of the selected types.
The profile has one or more potential matches of the selected types.
The profile has no confirmed matches of the selected types.
The profile has one or more ignored matches and no potential or confirmed matches of the selected types.
Risk factors for company profiles
The following factors are available for company profiles:
Company associates
The risk posed to the company by the associate with the highest risk score for a specified factor.
Data used: You choose one or more associate types to be evaluated and one risk factor to be used for the evaluation.
You can choose any of the following associate types:
Authorized person
Company secretary
Director
Other
Partner
Resigned officer
Trustee
You can choose any of the risk factors listed in this topic, for example, Age, Country of incorporation.
By default, only associates of the onboarding company are evaluated against the selected risk factor. Select to include all associates, including those from subsidiary companies.
Some associates, for example, shareholders, can be individuals or companies. If a risk factor is specific to the profile type, it's only applied to profiles of that type. For example, the Age risk factor is only applied to individual profiles, and the Country of incorporation is only applied to company profiles.
Each associate of the company, and optionally associates of subsidiary companies, of the specified associate type is evaluated for your chosen risk factor. A risk score is assigned to each associate. The highest risk score is used as the company's risk score for this factor.
Country of incorporation
The risk associated with the company’s country of incorporation.
Data matched: The country is taken from the profile’s Country of incorporation.
Possible conditions:
The country is included on a list you provide.
The country is not included on a list you provide.
Custom field
The risk associated with a profile’s custom field, for example, Expected transaction volume per month or Product tier.
Data matched: The data taken from the custom field you specify.
Possible conditions when the data is text:
The data is included on a list you provide.
The data is excluded from a list you provide.
The data exactly matches text you provide.
The data starts with text you provide.
The data ends with text you provide.
The data contains text you provide.
Possible conditions when the data is a number:
The data falls within a number range you specify.
The data is less than a number you specify.
The data is less than or equal to a number you specify.
The data is greater than a number you specify.
The data is greater than or equal to a number you specify.
Possible conditions when the data is multi-select:
The options selected for the custom field match exactly with a list of options you provide.
All of the options selected for the custom field are included in a list of options you provide.
Any of the options selected for the custom field are included on a list of options you provide.
All of the options selected for the custom field are excluded from a list of options you provide.
Any of the options selected for the custom field are excluded from a list of options you provide.
Data result: For this risk factor, you can also specify that a prefix or suffix is added to the resulting data so it’s easier for users to read. For example, you might choose the prefix £, as in £100, or the suffix customers, as in 100 customers.
If the value of the custom field is a date, use the Custom field date to months risk factor.
Custom field date to months
The risk associated with the number of months that have passed between the date in a profile’s custom field, for example, Date of first transaction, and today.
Data matched: The date is taken from the specified custom field, and the number of months between that date and today is calculated.
Possible conditions:
The data falls within a number range you specify.
The data is less than a number you specify.
The data is less than or equal to a number you specify.
The data is greater than a number you specify.
The data is greater than or equal to a number you specify.
Every month on the date of the specified custom field, the number of months is re-calculated, and the profile is re-assessed for all risk factors in your risk model.
Screening matches
The risk associated with screening matches of a specified type.
Data matched: The screening matches discovered when the profile is screened for a product application or as part of ongoing monitoring.
You can choose any of the following match types:
Sanctions
Adverse media
Other
Merchant fraud
Possible conditions:
The profile has one or more confirmed matches of the selected types.
The profile has one or more potential matches of the selected types.
The profile has no confirmed matches of the selected types.
The profile has one or more ignored matches and no potential or confirmed matches of the selected types.
Years since incorporation
The risk associated with the number of years a company has been incorporated.
Data matched: The profile's Date of incorporation is taken, and the number of years since incorporation is determined by calculating the number of years between that date and today.
Possible conditions:
The number of years since incorporation falls within a number range you specify.
Every year on the anniversary of the profile's Date of incorporation, the number of years since incorporation is recalculated and the profile is reassessed for all risk factors in your risk model.