Abstract: Methods and apparatus for assessing behavior, such as fraud and risk, in financial entities and transactions involve, for example, receiving, using a processing engine computer having a processor coupled to memory, data related to a plurality of entities. The plurality of entities is segmented into a plurality of entity peer groups based at least in part on a plurality of behavior components identified for each entity in the received data. For each entity, a behavior norm is created based on the entity history and its relationship to its corresponding peer group. All of the behavior components for each of the entities are normalized, and aggregated and a behavior score generated for each entity based on a continuous comparison of behavior values of each entity to a behavior norm for the entity peer group into which the entity is segmented.