Risk scoring for non-bank financial institutions