JPMorgan KYC engine · risk-scoring a high-net-worth onboarding

FATF 4-dimension framework applied to a single onboarded entity: ALSAFA Holdings SARL (Luxembourg). Composite risk 78/100 — High. Triggers EDD, beneficial-owner trace, and 90-day pKYC cycle.

INSTITUTION JPMORGAN PRIVATE BANK · CUSTOMER ALSAFA HOLDINGS SARL · FRAMEWORK FATF + EU AI ACT (AUG 2026) · ENGINE MacrosLM KYC

Composite risk score

78/100

High — tier 3 of 4

Required posture

EDD

Enhanced due diligence

pKYC review cadence

90d

vs std 365d

Explainability (EU AI Act)

Pass

Score + reasons logged

01FATF 4 DIMENSIONS 02CUSTOMER SCORE 03TIER → EDD MAPPING 04PERPETUAL KYC 05EU AI ACT

§ 01The FATF four-dimension framework

FATF Recommendation 10 requires risk-based KYC. The four dimensions — customer, geography, product, and channel — combine into a single composite score. JPMorgan applies each dimension with its own factor library and weights tuned annually against actual SAR-filing outcomes.

Engine parameters

Framework: FATF Rec 10 + FFIEC BSA/AML manual
Engine: MacrosLM KYC Risk Scoring
Scoring scale: 0 – 100 composite
Tiers: 0–24 Low / 25–49 Medium / 50–79 High / 80+ Prohibited
Refresh cycle: Event-triggered + scheduled (pKYC)
Last calibration: Mar 2026 · against 38K closed cases
Reg lens: EU AI Act · high-risk system

Dimension weights · JPM Private Bank · 2026 calibration

Dimension	Sub-factor count	Weight	Top drivers
1. Customer	17 sub-factors	35%	PEP status, beneficial-owner opacity, source of wealth
2. Geography	12 sub-factors	25%	FATF grey/black list, sanctions exposure, residency vs nationality split
3. Product	14 sub-factors	25%	Cash intensity, cross-border flow, trust/SPV structures, crypto rails
4. Channel	9 sub-factors	15%	Non-face-to-face, third-party introduction, digital-only onboarding
Total	52	100%	Composite via weighted sum + adjustment rules

§ 02Customer scoring · ALSAFA Holdings SARL

Fictional onboarding case. Luxembourg holding entity, beneficial owner family office in MENA, wealth from real-estate inheritance. The case illustrates a textbook High-tier classification — no single fatal factor, but multiple moderate-elevated indicators combine into a score that crosses the EDD threshold.

Per-dimension breakdown · ALSAFA Holdings SARL

Dimension	Sub-factor	Customer attribute	Factor score	Weighted	Pill
Customer	Entity type	Luxembourg SARL holding co.	60	—	Elevated
	PEP status	UBO is family member of regional minister	90	—	High
	Beneficial ownership	3-layer structure · UBO trace possible	55	—	Elevated
	Source of wealth	Inherited real-estate · independently verified	30	—	Acceptable
	Subtotal × 35%	—	68	23.8	—
Geography	Country of incorporation	Luxembourg · FATF compliant	15	—	Low
	UBO residency	MENA jurisdiction · grey-list adjacent	75	—	Elevated
	Wealth-source jurisdiction	Same as UBO residency	70	—	Elevated
	Subtotal × 25%	—	62	15.5	—
Product	Account type	Private bank multi-currency + custody	55	—	Elevated
	Expected flow	$80M initial · $5–15M monthly	75	—	Elevated
	Cross-border	Predominantly intra-EU + UAE	65	—	Elevated
	Subtotal × 25%	—	65	16.3	—
Channel	Onboarding mode	In-person via Lux RM + Geneva visit	25	—	Acceptable
	Introduction	Existing JPM client referral	20	—	Acceptable
	Subtotal × 15%	—	22	3.3	—
Composite	Weighted sum + 5 pt PEP adj.	—	—	78	High · tier 3

§ 03Tier → due-diligence mapping

A score is only useful if it triggers an action. The mapping below is JPMorgan policy — each tier maps to a different set of evidence requirements, monitoring cadence, and approval level. ALSAFA at 78 falls in High; EDD required.

Tier-action matrix

Tier	Score band	Diligence	Approval	Refresh
Low	0 – 24	Simplified DD	RM auto	36 mo
Medium	25 – 49	Standard DD	RM + AML L1	24 mo
High	50 – 79	EDD	AML L2 + MLRO	12 mo + pKYC
Prohibited	80+	Onboarding refused	Decline / SAR	—

Within a tier, score deltas drive cadence: 78 is 1pt below "Prohibited" so ALSAFA gets the tightest High-tier cadence (90-day pKYC vs 12-month baseline).

EDD requirements triggered · ALSAFA

Full beneficial-owner identity verification at all 3 layers · passports + government-ID
Wealth-source forensic memo — signed by external counsel (verified)
Adverse-media sweep · MENA & EU press · last 5 years (clean)
Sanctions screening · OFAC, EU, UN, UK · refreshed daily
PEP enhanced screening · primary + family + close associates · 3rd-party data
Source-of-funds for initial $80M · trust deed + 2 years bank statements
Transaction-monitoring profile · custom thresholds applied
MLRO sign-off · obtained · April 14, 2026

§ 04Perpetual KYC · what changed for ALSAFA in Q2 2026

Static KYC dies the moment you sign off. pKYC continuously monitors a customer's score against external events and transactional patterns. In one quarter, ALSAFA's score moved on three of four dimensions — each change triggered automated re-scoring.

pKYC event log · Apr–Jun 2026

Date	Event	Dimension	Δ score	Action
Apr 14	Onboarding · baseline	All	+78	Approved EDD
Apr 27	Adverse-media hit (resolved false positive)	Customer	+4	Investigation closed
May 09	First wire · $42M from Geneva fiduciary	Product	−2	Consistent with profile
May 22	UBO appointed to advisory board · holding co.	Customer	+6	Re-screen PEP
Jun 03	Outbound wire · $8M · Cayman SPV (new beneficiary)	Product / Geo	+9	Hold · investigate
Jun 07	SPV verified · pre-existing family vehicle · released	Product / Geo	−5	Cleared
Jun 18	FATF grey-list update · MENA jurisdiction added	Geography	+8	Re-score all customers
Jul 01	Current composite	—	83	Re-tier review

Why pKYC matters — the regulatory shift

Static annual KYC was the standard for 25 years. The FATF 2023 update and the EU AML Authority's 2025 push made continuous monitoring the expected baseline for High-tier customers.

For ALSAFA, the FATF grey-list update on Jun 18 pushed the composite from 78 to 83 — into Prohibited territory. Without pKYC this would not have been visible until the next annual review.

Disposition Re-tier review opened Jul 01. Two paths: (i) downgrade composite via additional EDD evidence & reverse-tier to High, or (ii) exit relationship. MLRO decision pending.

§ 05EU AI Act compliance · what August 2026 changes

From August 2, 2026, KYC risk-scoring engines used in the EU are high-risk AI systems under the EU AI Act. Five requirements bite immediately. JPMorgan's engine clears all five; below is the conformity readout for ALSAFA's scoring decision.

Explainability

For each decision, the customer (or regulator) can demand the score, the factor inputs, the weights, and the contribution of each factor. Logged · per-decision

Human oversight

No High or Prohibited tier decision can be auto-final. MLRO sign-off required. Adverse decisions (decline, exit) require a second-person review. Workflow enforced

Bias monitoring

Quarterly disparate-impact analysis across nationality, gender, occupation. No protected class above 1.2× false-positive rate. Q2 2026 audit clean

Model card

Public-facing summary: training data, validation cohort, known limitations, version history. Signed by Chief AML Officer. v2026.1 published

Incident reporting

Material errors (wrong tier, missed PEP) reported to EU AML Authority within 15 days. 0 incidents in Q2 2026. Pipeline live

Conformity assessment

Third-party conformity assessment completed Mar 2026 · CE mark obtained. Next re-assessment Mar 2028 or on material model change. Valid

ENGAGEMENT · JPMORGAN PRIVATE BANK KYC ENGINE READOUT · FICTIONAL CUSTOMER FOR ILLUSTRATION · ENGINE: MacrosLM. Customer entity, beneficial-owner family, score progression, and event timeline are illustrative; not a real onboarding. Framework references FATF Recommendation 10, FFIEC BSA/AML manual, and the EU AI Act (Regulation 2024/1689) high-risk system requirements effective August 2, 2026.MacrosLM · Audit & Controls Series →