Risk Assessment
Risk levels, assessment status, and what the assessment includes
Assessment Status
A customer's risk assessment moves through a lifecycle, and every RISK_ASSESSMENT_UPDATED webhook carries an assessmentStatus telling you which point in that lifecycle the event represents. This lets you keep your own view of the customer in step with VerifiMe. Four statuses are lifecycle states you act on; two are intermediate and can be ignored.
The lifecycle
An assessment begins when VerifiMe finishes verifying a customer and calculates a risk level (ASSESSED). From there a VerifiMe operator may override the risk level and later have that override removed, and the assessment is eventually closed once its risk mitigations have been worked through. Each transition is delivered to you as a webhook, so ASSESSED is the first state in an assessment's lifecycle, not the only event you receive. Deliveries are not guaranteed to arrive in lifecycle order. Order them by occurredAt.
An assessment cannot be closed while an override is active; the override must be removed first. Always determine the current state from the most recent event by occurredAt, not from event sequence.
Lifecycle states to process
| Status | What it means |
|---|---|
| ASSESSED | The initial assessment is complete and a risk level has been calculated. This is the first state in the lifecycle, but you may receive it after later events due to delivery variance. |
| OVERRIDDEN | A VerifiMe operator has manually overridden the calculated risk level, for example when the engine result does not reflect a judgement the operator has made. The riskLevel in this event is the overridden level, which supersedes the assessed level until the override is removed. |
| OVERRIDE_REMOVED | An override has been removed. The riskLevel reverts to the level calculated from the organisation's rules. |
| CLOSED | The assessment is closed. Low-risk assessments close at creation; higher-risk assessments close after mitigations are completed. The riskLevel is the level at closure. |
Treat OVERRIDDEN, OVERRIDE_REMOVED, and CLOSED as updates to a customer you already know about: apply the new riskLevel and status to your record. They are how you learn that a customer's risk position has changed after onboarding, which matters for ongoing monitoring. Do not treat ASSESSED as the only result you will receive.
Assessments and the assessment lifecycle
An assessment's state moves through a sequence of events. The current state is whatever the most recent event tells you.
Low-risk assessments close at creation. When risk rules evaluate to LOW, or when no risk rules trigger at all (treated as LOW), the assessment is created already in a closed state. You receive both an ASSESSED event and a CLOSED event for the same riskAssessmentId from the same operation, delivered within milliseconds of each other. Both are genuine webhooks. An immediate CLOSED following ASSESSED is the expected outcome for straightforward customers.
Higher-risk assessments close after mitigations are completed. An assessment with risk level MEDIUM, HIGH, or EXTREME is created open. Risk mitigations must be completed before closure. The assessment closes only once every mitigation has been actioned. This can take minutes, hours, or days after the ASSESSED event. A significant delay between ASSESSED and CLOSED is the expected outcome for higher-risk customers.
Overrides and reopening. A VerifiMe operator can override the calculated risk level, which emits an OVERRIDDEN event. While an override is active, the assessment is in an overridden state and does not emit a CLOSED event. When an override is removed, an OVERRIDE_REMOVED event is emitted and the assessment becomes open again. Removing an override reopens an assessment. The most recent event always determines the current state.
Closed assessments do not reopen. A CLOSED event is the last state transition for that assessment. Once closed, an assessment remains closed. OVERRIDDEN is not an end state. An assessment can remain overridden indefinitely, and while an override is active, the assessment emits no CLOSED event. When an override is removed, the OVERRIDE_REMOVED event reopens the assessment and allows it to be overridden again or to close. Always determine the current state from the most recent event by occurredAt.
Intermediate states to ignore
| Status | What it means |
|---|---|
| PENDING | The assessment is queued but has not started. No risk level yet. |
| PRELIMINARY | A partial assessment is in progress. The risk level is not yet final. |
If you receive either of these, ignore it - the risk level is not final.
Risk Levels
| Risk Level | Description |
|---|---|
| LOW | Minimal risk detected based on assessment rules, or no configured rules triggered |
| MEDIUM | Moderate risk factors present |
| HIGH | Significant risk factors identified |
| EXTREME | Maximum risk level - multiple serious risk factors |
Risk levels are determined by the client organisation's configured rules in VerifiMe. Different clients may have different thresholds and criteria.
What Risk Assessment Includes
- Identity verification results (DVS, biometric, OCR)
- PEP (Politically Exposed Person) screening
- Sanctions list checking
- Adverse media screening
- Client organisation's custom risk rules