We discuss best practices for customer risk rating (CRR) and ongoing review. Even with purpose built CRR tools, the process can be daunting and requires constant care. We consider the factors that should be included in a risk rating model as well as scoring and weighting. Tuning and calibration of CRR systems are imperative to make sure that you are identifying customers that pose an elevated risk and not burdening investigators with false positives. Once customers have a risk rating, what are the next steps? How often do you refresh ratings and how do you document risk changes in a meaningful way?