Client risk assessment software you can show the workings for
FigsFlow is client risk assessment software for accountants that computes the rating rather than asking someone to pick one. Five risk categories (client, geography, sector, service and delivery channel) scored on documented rules, with a live preview as the questionnaire is completed. Hard stops for sanctions, and mandatory EDD triggers that apply whatever the total. Every rating reconstructs to the answers, the evidence and the rule version in force on the day.
G2 reviews
Google reviews
Verified reviews
Trustpilot reviews
Trusted by the best
Watch a score build itself
Ninety seconds: open the questionnaire, work through the five risk categories, watch the preview move, hit a high-risk answer, and see the band flip and the EDD trigger fire.
The point is that nothing is decided by a person choosing from a dropdown.
- 0:00Open the questionnaire
- 0:18Work through the five risk categories
- 0:46The preview moves as each answer lands— the moving number is the argument
- 1:04A high-risk answer, and the band flips
- 1:18The EDD trigger fires on its own
Preview clock — no video source set
- ◉Computed, not chosenNo dropdown decides the rating
- ⚖Weights visibleFive categories, each on documented rules
- ⚠Trigger fires itselfThe band drives the diligence
- 🗑Rules versionedReconstructs to the day it was made
A partner asks, “Why is this client medium risk and not high?” Nobody can answer, because someone just picked it.
If you can’t explain a risk rating, you can’t rely on it
Most risk ratings are picked by whoever fills in the form. The form records the rating, but not the reason for it.
A few months later, that person may have left and the client may have changed. You’re left with a rating and no explanation.
The question isn’t whether someone made a judgement. It’s whether anyone can show how they reached it: what answers were given, how much each one counted, and which rules applied at the time.
This client is rated medium on the answers given, the evidence filed against them, and the version of the rules in force on 11 September 2026.
View reasoning →What feeds the score, and what it sets off
Client risk assessment software is only useful where it is wired into everything either side of it.
The record supplies the answers; the band decides what has to happen next.
Feeds it
Sets off
What is the score actually made of?
Five risk categories from MLR 2017 reg 18(2)(b) and the CCAB guidance. Each answer carries points, following the ACCA client risk tool approach, set to your practice’s documented methodology. The preview updates as you answer.
- Client
Ownership, beneficial owners, source of funds and identity.
- Geographic
Where they are based and trade, including higher-risk jurisdictions.
- Sector and industry
Cash-intensive trades, property, crypto-assets.
- Service and product
What you do: payroll differs from trust services or client money.
- Delivery channel and transactions
Remote onboarding, introduced business, unexpected activity.
- Sanctions match
Onboarding stops until your MLRO clears or reports it.
- PEP or close associate
EDD whatever the total, with senior management approval.
- High-risk third country
Goes straight to enhanced due diligence.
- Complex or unusual transactions
No apparent purpose: enhanced due diligence.
What happens the moment the band lands?
Three bands, and the band is not a label applied after the fact. It decides which diligence path the client goes down, and the system enforces that relationship rather than trusting someone to remember it. Mandatory triggers sit above the bands: a PEP or a high-risk third country goes to enhanced due diligence whatever the total. Band thresholds are set to your practice’s documented methodology.
- 01Low
Standard customer due diligence. Simplified due diligence cannot be selected until the permitting basis is recorded. Review cycle set by your practice.
- 02Medium
Standard customer due diligence, focused on the risk drivers the assessment identified. Review cycle set by your practice.
- 03High
Enhanced due diligence, driven by the band or a mandatory trigger rather than requested by a person. The named trigger is recorded alongside the rating, not just the outcome. Review cycle set by your practice.
What happens when something changes?
The market has moved from an annual review to perpetual monitoring, and a rating that is only correct on the day it was made is not a control. A change in the underlying data re-opens the rating by itself.
- Ownership
A new beneficial owner appears on the register and the ownership factor is rescored.
- Sanctions
A sanctions designation lands overnight. Work stops and the MLRO is alerted before anyone logs in, to clear the hit or report it.
- Geographic
A registered-address change at Companies House moves the geographic factor and the score with it.
- Identity
An expired document weakens the identity factor rather than quietly passing as verified.
What will the file show in three years?
Every rating is saved exactly as it was on the day it was made: the answers given, the weights used, the rules in place, who prepared it and the MLRO who approved it. Later ratings are added alongside it, not written over it.
So if a supervisor asks why a client was rated medium in 2026, the answer is still there, even if your settings have changed several times since. Nothing is worked out again using today’s rules.
Seen enough? Bring the client your team argued about.
A template you fill in, or a model that computes
Client risk assessment software is not a questionnaire with a rating box at the bottom. A template records what somebody decided. A model produces the decision, shows the arithmetic, and files the version of the rules that produced it.
Both are a record. Only one of them is a record of the reasoning.
WHO USES IT
What this looks like at your size
Pick the shape of your practice.
A regulator's query is the first thing that will outgrow your own memory, because it can land on any file, at any time — not just the ones you still remember clearly.
PREVIEW CLOCK — INTERACTIVE DEMO
A supervisory visit is the first thing that will outgrow whoever handled the file, because it can ask about any client, on any day — not just while that person is still around.
PREVIEW CLOCK — INTERACTIVE DEMO
A review season is the first thing that will outgrow your current process, because it touches every open file at once, not just the ones somebody happens to remember.
PREVIEW CLOCK — INTERACTIVE DEMO
A regulator's request is the first thing that will outgrow three separate packs, because it expects one answer — not three different ones from three different people.
PREVIEW CLOCK — INTERACTIVE DEMO
One rating, used across the practice
A client’s risk rating doesn’t sit on its own. Once it’s set, the rest of FigsFlow uses it. Onboarding can hold the engagement letter until the checks are done. Higher-risk clients can be routed so the checks come first. Your MLRO and AML supervisor are stored once in your practice details and appear wherever they’re needed.
Works with what you already run
Built inside a working UK practice
Built inside working practices, not in a lab — by people who had returned their own work with review points on it.
Placeholder
0:48
Placeholder
1:02
Placeholder
0:55
Placeholder
1:14
What a risk assessment costs
Risk assessment sits inside the AML and client due diligence module. It is not a second tool with a second invoice. Identity and screening checks are credit-metered per check inside the subscription.
£3.00 from your 100th check, permanently. Electronic identity and address verification, PEP and sanctions screening, the Amberhill check, 24 months of ongoing screening and the inspection-ready record are all inside that one price.
Client and firm-wide risk assessments, enhanced due diligence workflow, policies, controls and MLRO roles, monitoring alerts and the training log. Billed annually; £19 a month on monthly billing.
Checks only, no programme, with everything above still included. Credits never expire, and the programme can be added at any time — free for the first 90 days.
The firm-wide risk assessment is not metered. What is metered is the identity and screening check run against a person; the Compliance Programme is a flat monthly fee per firm, however many clients you hold.
Nothing is sold separately — no data credits, no per-search top-ups, no separate sanctions module. A 250-client re-check on the programme costs about £800 once, and there is nothing per client per month after that. The programme is included from Onboarding Team upwards, and in the Practice Suite.
Everything a rating connects to
A rating does not sit on its own. These four touch it directly; the rest of the platform sits around them on the same client record.
What the rating governs.
See the AML module Engagement lettersWhat the clearance releases.
See the engagement letters module Forms and requestsWhere the answers come from.
See the forms module Audit trailWhere the workings are kept.
See the audit trail module