How do firms assess country and geographical risk?

Geography is checked for the customer and for the beneficial owner, and in three ways: the jurisdictions where they are based or resident, the jurisdictions that are their main places of business, and the jurisdictions to which they have relevant personal or business links, or financial or legal interests. A company registered in one country, run from a second and owned by a person living in a third has three sets of country risks, not one.

The nature and purpose of the relationship decide which link matters most. For a trust or other legal arrangement, the key question is how well the country meets international tax transparency and information-sharing standards. For a bank or other financial institution, it is how strong that country's AML/CFT rules and supervision are. Where the money was generated abroad, the level of predicate offences there and the effectiveness of its legal system count most. Where funds come from or go to areas where terrorist groups are known to operate, the firm asks whether that could be expected, or should raise suspicion, given what it knows about the relationship.

The law's indicative list of potentially higher-risk geographical factors includes countries without effective AML/CFT systems, countries with high levels of corruption or other crime, countries subject to sanctions or embargoes, for example by the EU or the UN, and countries that fund or support terrorism or have designated terrorist organisations operating in them. Firms building a country risk score also weigh reputations for banking secrecy and political instability, and crimes such as drug trafficking, arms dealing or human trafficking.

Some signals come from formal lists. The European Commission identifies high-risk third countries with strategic deficiencies in their AML/CFT regimes, and the FATF publishes jurisdictions subject to a call for action and jurisdictions under increased monitoring. These lists are updated regularly, the FATF's after each of its three plenary meetings a year, so firms check the current versions rather than relying on memory. Under Cyprus law, a third country that the firm itself rates as high risk in its own assessment also counts as a high-risk third country.

Lower-risk geographical factors exist too: EU member states, third countries with effective AML/CFT systems or low levels of corruption or other crime, and countries whose AML/CFT requirements are consistent with the FATF standards and effectively implemented, according to credible sources such as mutual evaluations.

Country assessments rely on credible sources: FATF and MONEYVAL mutual evaluation reports, EU and UN sanctions lists, IMOLIN, the IMF and Transparency International's corruption data.

The EBA sector guidelines give examples. In wealth management, risk rises when business is done in countries with a culture of banking secrecy or weak tax transparency, or when the customer lives in, or earned its wealth in, a higher-risk jurisdiction. In investment firms and funds, it rises when the investor, its custodian or its money is linked to a higher-risk jurisdiction, or when the customer asks for an investment to be redeemed to an account at a bank in such a jurisdiction. The FATF's guidance for the securities sector adds requests to send funds to a higher-risk country without a business reason, and products that allow value to pass anonymously to unrelated third parties there.