Risk Assessment
Risk levels, assessment status, and what the assessment includes
Assessment Status
A customer's risk assessment moves through a lifecycle, and every RISK_ASSESSMENT_UPDATED webhook carries an assessmentStatus telling you which point in that lifecycle the event represents. This lets you keep your own view of the customer in step with VerifiMe. Four statuses are lifecycle states you act on; two are intermediate and can be ignored.
The lifecycle
An assessment begins when VerifiMe finishes verifying a customer and calculates a risk level (ASSESSED). From there a VerifiMe operator may override the risk level and later have that override removed, and the assessment is eventually closed once its risk mitigations have been worked through. Each transition is delivered to you as a webhook, so ASSESSED is the first event you receive for a customer, not the only one.
An assessment cannot be closed while an override is active; the override must be removed first. That is why closure always follows either ASSESSED or OVERRIDE_REMOVED, never OVERRIDDEN directly.
Lifecycle states to process
| Status | What it means |
|---|---|
| ASSESSED | The initial assessment is complete and a risk level has been calculated. This is the first result you receive for a customer. |
| OVERRIDDEN | A VerifiMe operator has manually overridden the calculated risk level, for example when the engine result does not reflect a judgement the operator has made. The riskLevel in this event is the overridden level, which supersedes the assessed level until the override is removed. |
| OVERRIDE_REMOVED | An override has been removed. The riskLevel reverts to the level calculated from the organisation's rules. |
| CLOSED | The assessment has been closed after all of its risk mitigations were actioned (passed, failed, or ignored). The riskLevel is the level at closure. |
Treat OVERRIDDEN, OVERRIDE_REMOVED, and CLOSED as updates to a customer you already know about: apply the new riskLevel and status to your record. They are how you learn that a customer's risk position has changed after onboarding, which matters for ongoing monitoring. Do not treat ASSESSED as the only result you will receive.
Intermediate states to ignore
| Status | What it means |
|---|---|
| PENDING | The assessment is queued but has not started. No risk level yet. |
| PRELIMINARY | A partial assessment is in progress. The risk level is not yet final. |
If you receive either of these, ignore it - the risk level is not final.
Risk Levels
| Risk Level | Description |
|---|---|
| LOW | Minimal risk detected based on assessment rules |
| MEDIUM | Moderate risk factors present |
| HIGH | Significant risk factors identified |
| EXTREME | Maximum risk level - multiple serious risk factors |
| NO RISK DETECTED | No configured rules triggered for this customer - typically indicates a configuration issue |
Risk levels are determined by the client organisation's configured rules in VerifiMe. Different clients may have different thresholds and criteria.
Note on NO RISK DETECTED: This value indicates that none of the organisation's configured risk rules matched the customer. While the system defaults to a LOW underlying risk in this case, receiving NO RISK DETECTED in production usually signals a rules configuration error rather than a genuinely risk-free customer. Alert your VerifiMe account contact if you observe this value.
What Risk Assessment Includes
- Identity verification results (DVS, biometric, OCR)
- PEP (Politically Exposed Person) screening
- Sanctions list checking
- Adverse media screening
- Client organisation's custom risk rules