Three key criteria in aml risk rating