The (Financial) Crime Scene

HIGH-RISKTHIRDCOUNTRIES - DIVERGINGAPPROACHES.

WRITTEN BY RAY BLAKE

We are all familiar with the concept of High-Risk countries. In our AML frameworks, we all rate each of the world’s nations according to their propensity to expose us to elevated money laundering risks. Typically, we will have the “modern”, “developed economies at the Low-Risk end, and the opposite economies, those associated with higher levels of financial crime, at the other, High-Risk end.

There is no single means for arriving at such a list and firms will often use a weighted model of different public data to arrive at their ratings tables. Examples of such include Transparency International’s Corruption Perception Index, and the Basel Institute’s AML Index, itself a weighted measure, drawing upon 17 different public sources. As part of a customer risk rating model, the country risk will generally be a contributing factor, but will not usually be solely determinative of the resulting overall risk rating. Consider a simplified client risk rating model that takes as inputs these broad sub-ratings to produce an overall customer risk rating:

Above, I have laid out two scenarios.

Note that in S1, where the country risk is in line with elevated risks across the model, the outcome is an overall High Risk rating, But in S2, where country risk is an outlier, the weighted combination with other, more benign aspects of the case means the customer emerges with only a Medium-Risk overall rating. This is by design. Most firms will only routinely apply Enhanced Due Diligence (EDD) where the overall risk rating for the customer is High, and in the in the second scenario above, it is perfectly acceptable (in most cases) for the firm to subject the customer just to its standard level of Customer Due Diligence (CDD).

This linkage between risk rating and applied level of due diligence is customary, but not legislatively driven. In the EU and the UK (a carryover by a postBrexit Britain), there are certain specified instances where EDD must be mandatorily applied by firms. The first two of these relate to correspondent banking situations and clients who are PEPs – or are beneficially owned or controlled by PEPs. But the second relates to customers who are based in ‘High-Risk Third Countries” (HR3Cs).

The EU defines a Third Country as: “A country that is not a member of the European Union as well as a country or territory whose citizens do not enjoy the European Union right to free movement.” So, effectively, a Third Country is one that is not a member of the EU. Notably, of course, this includes the UK.

Most firms’ own risk lists will have quite a large number of countries as High-Risk. We have seen firms where well over a hundred of the world’s nations are coloured red in this analysis. But, the list of HR3Cs is significantly shorter, and although it has varied since being first established, has never exceeded 25 countries in all. So, we are talking about a subset of countries that might be rated by any given firm as HighRisk in their own ratings tables, but firms need to ensure that for this subset they are able to identify affected customers and apply EDD to all of them routinely – even if their own customer risk rating models do not label these customers High-Risk.

So which are these countries? At the time of writing, the EU lists 21 HR3Cs and the UK lists 25. There is less commonality between the lists than one might think. Let’s look in detail at the two. Here is the present EU list, which is maintained by the European Commission: Afghanistan Bahamas Barbados Botswana Cambodia Ghana Iran Iraq Jamaica Mauritius Myanmar Nicaragua North Korea Pakistan Panama Syria Trinidad and Tobago Uganda Vanuatu Yemen Zimbabwe

The UK list is drawn up by Her Majesty’s Treasury. Here is the current version: Albania Barbados Burkina Faso Cambodia Cayman Islands Haiti Iran Jamaica Jordan Mali Malta Morocco Myanmar Nicaragua North Korea Pakistan Panama Philippines Senegal South Sudan Syria Turkey Uganda Yemen Zimbabwe

Now, you may have noticed that these two lists vary somewhat. Let’s look more closely at that variance, shall we ?

What can we glean from this comparison?

Well, the two listing bodies (technically, the European Commission and HM Treasury) agree on 13 nations. Both include the Financial Action Task Force (FATF) pariah states of Iran and North Korea, for instance.

The EU, however, lists 8 nations that the UK omits, while the UK selects 12 that are not on the EU’s version of the list. One of those – Malta – sticks out somewhat. It isn’t a Third Country. It’s a European Union member, and therefore cannot be a High-Risk Third Country by the EU definition of that phrase. Clearly, HM Treasury are defining the phrase differently, although I don’t believe they have shared a definition of their own. Turkey is another interesting inclusion, given its status as an aspirant to EU membership and its geographical proximity to the bloc, with all that implies about trade and commerce.

So why do the two vary more widely? Both use as their primary source the assessments of FATF. HM Treasury, however, aims to directly apply that assessment (“This list replicates those countries listed by […] FATF in their ‘Jurisdictions under Increased Monitoring’ and ‘High-Risk Jurisdictions subject to a Call for Action’ public documents.” ) Indeed, the current HM Treasury list is a perfect match for FATF’s two lists combined. For the European Commission, it not quite so cut-anddried: “The Commission should take into account in its assessments new information from international organisations and standard setters, such as those issued by […] FATF."

It is worth pointing out that the EU’s list was last revised in October 2020 against the UK’s list having been revised in early November 2021. In the meanwhile, of course, FATF have revised their own lists. This, however, does not account for all the variance, and it is difficult to see how the EU could regard Malta as an HR3C whatever FATF might have to say, with Malta not actually being any kind of Third Country by the EU’s definition, via EU membership at least.

And so, putting this all in context, we face a hierarchy of High-Risk, which we might represent like this: [figure]

Remember that there is no universal definition of a ‘High-Risk Country’ and this can cause all sorts of problems. As I have shown, although firms have a degree of freedom when formulating their broader approach, when it comes to this smaller subset of countries, the path is well-laid.

Edited by Kamil Rahman-Blake