Risk Identification and Assessment Using Globas: New Tool Client form!

How to organize customer identification, assess risks and update information in a timely manner? In this new issue of our Newsletter, we examine the key requirements of Federal Law No. 115-FZ and explain how to reduce manual workload when managing a large client base.

Our new tool, the Client form under the 115-FZ, helps streamline this process within Globas: it automatically populates the form with available company data, calculates risk levels based on specific criteria, and allows you to use either pre-built templates or your own proprietary assessment methodology.

The identification process requires obtaining information about the customer, as well as its' representative, any beneficiary, and the ultimate beneficial owner, in cases stipulated by law. Furthermore, it is essential to verify the accuracy of the data obtained.

For a company, this includes, in particular, registration numbers INN and OGRN, the address, and registration details. When identifying the beneficial owner, it is important to consider the ownership and management structure, and when dealing with a representative, to verify their authority.

The basic requirements for identification are established by Federal Law No.115 dated 07.08.2001. The specific procedures for compliance depend on the category of the organization. For credit institutions, the applicable regulation is The Bank of Russia Regulation No. 499-P; for non-credit financial organizations supervised by the Bank of Russia, it is Regulation No. 444-P. For other organizations and entities subject to the requirements of Federal Law No.115, the applicable document is the Order of the Federal Financial Monitoring Service (Rosfinmonitoring) No. 74, dated 23.04.2025.

Beyond the mandatory identification data, it is also important to consider other information when assessing customer risk:

To objectively assess risk, it is necessary to analyze information in its entirety. For example, legal cases or financial difficulties alone do not indicate the client's involvement in money laundering. It is important to consider the nature of the identified circumstances and how they relate to other data.

The level of risk is determined according to a methodology set out in the organization’s internal control policy. This methodology establishes the criteria for assessment and the procedures to be followed when significant circumstances are identified.

Three risk levels may be used for evaluation: low, medium, and high. A high risk level does not necessarily mean that a business relationship must be declined. Instead, it serves as a basis for taking further action in accordance with applicable laws and the organization’s internal policies.

It is important to understand the rationale behind an assessment—specifically, which criteria were triggered, what information influenced the outcome, and why a particular risk level was assigned to a client.
However, even a well-founded assessment may lose its relevance over time. Therefore, the identification process does not end after the initial check.

Following an initial screening, a company’s management, ownership, address, or business activities may change. Such changes can affect the level of risk; therefore, client information must be kept up to date.

In accordance with the requirements of Federal Law No. 115, information regarding low-risk clients must be updated at least once every three years, while information for all other clients must be updated at least once a year. If any doubts arise concerning the reliability or accuracy of previously obtained information, it must be updated within seven business days from the date such doubts emerge.

An organization may stipulate more frequent updates to this information within its own internal control policies.

When managing a large client base, it is essential to have a consistent assessment methodology, a record of past screenings, and a system for tracking update deadlines. Handling all of this manually is difficult. The greater the number of clients and evaluation criteria, the heavier the workload for staff when the process is managed manually.

The new tool is part of the Sanctions Compliance Module and helps facilitate client identification in accordance with a company’s internal control policies.

1. Filling the form

Company details available in Globas are populated automatically. The user can manually add any missing information.

2. Setting criteria and calculating risk level

Ready-to-use templates are available. Users can also configure their own assessment methodology by defining risk criteria and their respective weights, specifying the fields to be included in forms, and setting the frequency for re-identification, all in compliance with legal requirements.

The risk level is calculated automatically based on the identified criteria and the assigned weights. This ensures a consistent assessment methodology across all clients and provides clarity on which factors influenced the final result.

3. Forms Dossier and Re-identification

Created forms are stored in the Dossier, where you can view the results of previous checks and track the need for re-identification.

While automation helps to systematize work with clients, it does not replace professional assessment. A specialist analyzes the information obtained, considers the specific circumstances, and acts in accordance with company policy. The organization remains responsible for regulatory compliance and the decisions that are made.