Silent Misclassification at Scale

The most dangerous compliance failures are the quiet ones. This bank’s customer risk-scoring model was not throwing alerts, not generating escalations, not causing visible problems. That was precisely the issue. A model calibrated six years earlier — against a customer population and a regulatory landscape that had since moved on — was confidently and consistently scoring high-risk customers as standard risk, and its silence was being read as success.

The tell was the absence of signal

Two indicators gave it away, both counter-intuitive. First, the EDD escalation rate was far too low for the customer base. Second, only fourteen SARs had been filed across twenty-four months — a figure implausibly small for a Tier 1 retail and private bank with the jurisdictional mix this one carried. A model that never flags is not necessarily a clean book; it is often a broken control whose outputs nobody questions because they look orderly.

What we did

CCL reverse-engineered the live model to expose how jurisdiction weightings and entity-type multipliers combined to produce ratings no experienced practitioner would defend. We then ran a retrospective analysis across the existing customer base — re-scoring the back book against corrected logic to identify exactly which customers had been silently misclassified.

The fix was deliberately two-sided. Recalibrating the model corrected future ratings; the retrospective reclassification corrected the legacy exposure. 2,800 customers were reclassified and routed through a documented EDD escalation workflow, generating 340 EDD escalations that the old model had suppressed.

The outcome

Every reclassification and escalation was documented with its rationale, forming a continuous audit trail, and the recalibrated model was packaged into a Board-approvable validation pack with ongoing review governance. When the framework was subsequently examined, the result was zero regulatory findings — the exposure had been identified, quantified, remediated and evidenced before it became a supervisory matter.

This engagement is the clearest illustration of why risk-model recalibration must be retrospective as well as forward-looking: fixing the logic without re-scoring the back book leaves the original exposure exactly where it was.