An interpretative walk through money laundering, tax crime, terrorist financing and proliferation financing country risk
Country risk assessment has become a fundamental building blocks of the AML/CFT risk-based approach. It is embedded throughout the FATF Recommendations, Luxembourg legislation and, increasingly, the future European AML framework.
Yet anyone who has attempted to design a country risk methodology soon discovers that the legislation tells us remarkably little about how the exercise should be performed.
The legal framework identifies geographical risk factors, refers to credible sources and requires enhanced due diligence in certain situations. It does not prescribe a universal scoring model, a mandatory weighting methodology or an exhaustive list of indicators.
As a result, two institutions operating under the same legal framework may legitimately reach different conclusions regarding the same jurisdiction.
This is not necessarily a weakness of the framework.
It is the natural consequence of the risk-based approach, where professional judgement remains an essential component of the assessment.
This article is not intended to identify the "correct" country risk methodology. Instead, it explores the current legal framework and the principal resources available to professionals, while examining the methodological choices that inevitably arise when those sources are brought together.
There is unlikely to be a universally correct methodology. There can, however, be methodologies that are coherent, transparent and capable of explaining why a particular conclusion was reached.
1. What does the legal framework actually expect?
The starting point is not a country ranking. It is the risk-based approach.
FATF Recommendation 1 requires obliged entities to identify, assess and understand their money laundering and terrorist financing risks and to apply measures proportionate to those risks. Following the expansion of the FATF Standards to cover proliferation financing, institutions are also expected to consider proliferation financing risk within the scope defined by the Recommendations.
FATF Recommendation 19 specifically addresses higher-risk countries by requiring enhanced due diligence where appropriate and allowing jurisdictions to apply countermeasures in the most serious situations.
The FATF framework therefore distinguishes between the general assessment of geographical risk and the public identification of jurisdictions subject to Increased Monitoring or a Call for Action. While these public lists are important components of any country risk methodology, they should not be viewed as exhaustive measures of geographical risk.
The Luxembourg AML Law follows the same philosophy.
Rather than prescribing a country ranking, it requires professionals to consider geographical risk as one element of the overall ML/TF risk assessment.
A high-risk country includes jurisdictions identified by the European Union as high-risk third countries, jurisdictions designated by the FATF as presenting higher risk, but also any other country that the professional considers to present higher risk on the basis of the geographical risk factors listed in Annex IV.
Importantly, neither the FATF framework nor Luxembourg legislation prescribes a single methodology for assessing country risk.
The legislation tells us what should be considered. It does not tell us how the available evidence should be interpreted, weighted or combined.
The way in which those sources are interpreted, weighted and combined is intentionally left to professional judgement.
2. Looking ahead: what changes under the AMLR?
The new AML Regulation (AMLR) largely preserves the principles of the current framework while introducing a more harmonised approach across the European Union.
Annex III identifies a number of variables that may indicate potentially higher geographical risk, including:
- countries with strategic deficiencies in their AML/CFT systems;
- countries with significant levels of corruption or other criminal activity;
- jurisdictions subject to sanctions, embargoes or similar measures;
- countries providing funding or support for terrorist activities;
- jurisdictions characterised by limited transparency or other features that may facilitate financial secrecy.
The AMLR also empowers the European Commission to identify and designate high-risk third countries presenting significant strategic deficiencies in their national AML/CFT regimes. Dealings involving those jurisdictions may trigger specific enhanced due diligence requirements under the Regulation. Business relationships and occasional transactions involving those jurisdictions are subject to enhanced due diligence measures under the AMLR.
The Regulation is therefore clear on one point:
What should be considered?
It deliberately leaves another question open:
How should the different sources be interpreted, weighted and combined?
This distinction is important. A legal requirement to consider geographical risk should not be confused with an obligation to construct a mathematical scoring model.
3. The Basel AML Index: one source or many sources?
For many professionals, the Basel AML Index represents the natural starting point.
It offers broad geographical coverage, a single numerical score and a methodology that combines multiple internationally recognised indicators.
However, understanding the Basel AML Index means looking beyond the final score.
The Index does not measure the amount of money laundering occurring within a jurisdiction. Instead, it assesses a country's vulnerability to money laundering and related financial crime, together with its capacity to prevent and mitigate those risks.
Its overall score is constructed from seventeen indicators grouped into five domains:
- quality of the AML/CFT framework;
- corruption and fraud;
- financial transparency;
- public transparency and accountability;
- political rights and rule of law.
Each of those domains draws on numerous underlying sources, including FATF Mutual Evaluations, corruption indicators, financial transparency assessments, governance indicators and rule-of-law measures.
As a composite index, the Basel AML Index already incorporates information drawn from multiple international sources. This leads to a broader methodological consideration. When professionals supplement the Basel AML Index with FATF Mutual Evaluation results, corruption indices or financial secrecy indicators, are they introducing genuinely new information, or simply assigning additional weight to information that is already embedded in the Index? There is no universally correct answer.
Some institutions may consider the Basel AML Index sufficient as a high-level indicator of country risk. Others may choose to analyse individual components separately to gain greater granularity or to place additional emphasis on particular risk factors.
Both approaches may be entirely consistent with the risk-based approach, provided that the underlying rationale is documented, understood and applied consistently.
The key question is therefore not whether one methodology is objectively better than another, but whether professionals fully understand what each source already captures before giving it additional weight in their own assessment.
4. Tax crime: beyond non-cooperative jurisdictions
Tax crime has become an increasingly important predicate offence to money laundering.
Yet the tax dimension of country risk can be assessed from several different perspectives.
Tax transparency frameworks
Several public resources can assist professionals in assessing the tax dimension of country risk, although each was developed for a different purpose.
One such resource is the EU list of non-cooperative jurisdictions for tax purposes, which primarily measures tax governance, transparency and the implementation of internationally agreed tax standards. It was never intended to operate as an AML country-risk ranking.
The OECD Global Forum on Transparency and Exchange of Information for Tax Purposes provides another perspective. Through its peer reviews, it assesses jurisdictions' implementation of the international standards on Exchange of Information on Request (EOIR) and the Automatic Exchange of Information (AEOI) under the Common Reporting Standard (CRS). These assessments help evaluate a jurisdiction's capacity and willingness to cooperate internationally in tax matters.
Financial secrecy
Other resources, such as the Financial Secrecy Index, focus on broader structural characteristics that may facilitate opacity, including banking secrecy, beneficial ownership transparency, legal cooperation and access to ownership information.
These resources therefore serve different purposes.
- The EU list focuses on tax good governance.
- The OECD Global Forum assesses compliance with international tax transparency and information exchange standards.
- The Financial Secrecy Index evaluates structural features that may facilitate financial secrecy.
All three may provide valuable information for an AML country risk assessment.
None, however, should automatically be interpreted as a direct measure of tax crime.
A jurisdiction may receive positive assessments regarding tax transparency and international exchange of information while continuing to score relatively poorly on broader indicators of financial secrecy. Conversely, a jurisdiction may not appear on the EU list of non-cooperative jurisdictions yet still present characteristics that deserve attention from an AML perspective.
This illustrates that tax transparency, financial secrecy and tax crime are not interchangeable concepts.
What matters, therefore, is not the number of indicators considered, but an understanding of what each source actually measures and how it contributes to the overall assessment of country risk.
The more useful question is therefore:
What aspect of country risk does this source allow me to understand that is not already captured elsewhere?
This is particularly important where several resources rely, at least in part, on similar underlying information, or pursue different objectives using comparable indicators. In a risk-based approach, the objective is not to accumulate sources, but to ensure that each contributes genuinely distinct analytical value to the overall assessment.
5. Terrorist financing: several perspectives on the same risk
Assessing terrorist-financing country risk presents similar methodological challenges.
Professionals can draw on a variety of public resources. Each contributes valuable information, but none should be interpreted as a standalone measure of terrorist-financing risk.
FATF public lists
The FATF public lists identify jurisdictions presenting strategic deficiencies in their AML/CFT/CPF frameworks.
Jurisdictions under Increased Monitoring (the grey list) have committed to addressing identified strategic deficiencies within agreed timeframes. Jurisdictions subject to a Call for Action (the black list) present the most serious concerns and may require enhanced due diligence or countermeasures.
These lists are essential regulatory references.
However, they should not be interpreted as rankings of terrorist-financing risk. Their scope extends beyond terrorist financing to the broader effectiveness of the AML/CFT/CPF framework.
A country may experience significant terrorist activity without appearing on a FATF public list. Equally, a FATF-listed jurisdiction may be identified because of weaknesses extending far beyond terrorist financing alone.
UN and EU terrorism sanctions
UN and EU targeted financial sanctions identify designated individuals, entities and organisations associated with terrorism or terrorist financing.
Unlike analytical indices, these sanctions regimes create legally binding obligations relating to screening, asset freezing and prohibitions on making funds or economic resources available.
They are therefore indispensable compliance tools.
Nevertheless, sanctions are generally entity-based rather than country-based. The presence of designated organisations connected to a jurisdiction does not, by itself, provide a comprehensive assessment of that country's terrorist-financing risk.
The Global Terrorism Index
The Global Terrorism Index takes a different perspective.
Rather than evaluating regulatory frameworks, it measures the impact of terrorism, using indicators such as incidents, fatalities, injuries and hostages, with greater weight assigned to more recent events.
It can help identify:
- the geographical concentration of terrorist activity;
- trends in attacks and casualties;
- the principal terrorist organisations operating in a country;
- regional and cross-border developments.
It does not, however, measure the effectiveness of a country's CFT framework, the existence of terrorist-financing networks or the exposure faced by a particular obliged entity.
The distinction between terrorism impact and terrorist-financing risk therefore remains an important one.
Europol's EU TE-SAT
Europol's Terrorism Situation and Trend Report provides another perspective.
Rather than ranking countries, it provides a European operational assessment based on information supplied by Member States, Europol partners and Eurojust.
It covers:
- terrorist attacks;
- arrests;
- convictions;
- ideological developments;
- emerging methodologies;
- online radicalisation;
- geopolitical developments affecting the European Union.
Its value lies not in producing a country score, but in providing context for institutions whose exposure is predominantly European.
Considered together, these sources illustrate an important point. They do not all describe the same phenomenon.
Some measure institutional deficiencies. Others measure the operational impact of terrorism. Others establish binding legal obligations.
Rather than competing with one another, they provide complementary perspectives on the broader question of terrorist-financing risk.
The more useful question is therefore not which source is the most authoritative, but which aspect of terrorist-financing risk each source is actually designed to capture.
6. Proliferation financing: beyond sanctions lists
Proliferation financing presents similar methodological challenges.
Several public resources contribute to the assessment of proliferation-financing risk, each capturing a different aspect of that risk.
FATF framework and public lists
FATF Recommendation 7 requires the implementation of targeted financial sanctions relating to the proliferation of weapons of mass destruction.
The FATF public lists may provide relevant information where a jurisdiction has been identified as having strategic deficiencies in implementing the FATF Standards. However, they are not dedicated rankings of proliferation-financing risk.
Similarly, FATF Mutual Evaluation Reports and Follow-up Reports may provide valuable insights into a jurisdiction's approach to:
- implementing targeted financial sanctions;
- identifying proliferation-financing risk;
- beneficial ownership transparency;
- sanctions evasion;
- supervision and enforcement.
A jurisdiction's FATF status should therefore be interpreted alongside the reasons underlying that status and the broader evaluation findings.
UN and EU proliferation-related sanctions
UN and EU sanctions regimes relating to North Korea, Iran and other proliferation concerns establish legally binding obligations.
These measures may include:
- asset freezes;
- prohibitions on making funds or economic resources available;
- trade restrictions;
- export controls;
- restrictions relating to dual-use goods, technology, transport and financial services.
These regimes identify legally relevant risk exposure and create compliance obligations.
They do not, however, provide a comparative assessment of a country's overall proliferation-financing vulnerability.
The Peddling Peril Index
The Peddling Peril Index approaches the issue from another perspective.
Rather than focusing solely on sanctions, it evaluates the strength of national strategic trade-control systems and a jurisdiction's ability to prevent the trafficking of nuclear, missile, WMD and other strategic goods.
Its assessment covers five principal areas:
- international commitment;
- legislation;
- monitoring and detection capacity;
- proliferation-financing controls;
- enforcement.
The Index therefore goes beyond financial sanctions by considering broader elements such as export-control legislation, licensing regimes, customs and border controls, enforcement capacity, international cooperation and controls over financing channels.
At the same time, it primarily evaluates the quality of a jurisdiction's strategic trade-control framework. It should not be interpreted evidence that proliferation financing or proliferation activity is occurring within every country receiving a weaker score.
The Peddling Peril Index incorporates information that may already be reflected, directly or indirectly, in other sources, including FATF assessments. Some of its underlying themes may also contribute to broader composite indicators such as the Basel AML Index.
This does not diminish its value.
On the contrary, it reinforces the importance of understanding what each source contributes before combining multiple indicators within a country risk methodology.
Like the other resources discussed in this article, the Peddling Peril Index is designed to answer a specific question rather than to provide a comprehensive measure of country risk. As throughout this article, the objective is not simply to combine multiple indicators, but to ensure that each source contributes genuinely distinct analytical value to the overall assessment.
7. Reading the available sources together
By this stage, one conclusion becomes increasingly apparent. Country risk assessment is not simply an exercise in collecting lists. It is an exercise in interpretation.
The legal framework identifies the relevant questions. International organisations, regulators and specialised institutions provide an abundance of resources.
The responsibility for understanding what each source actually measures remains with the professional.
Different sources, different purposes
The available resources can broadly be grouped into four categories.
- Legal classifications and mandatory measures
These include FATF Calls for Action, the EU list of high-risk third countries, and UN or EU sanctions regimes. They may lead directly to enhanced due diligence, restrictive measures, asset freezes or countermeasures.
- Assessments of institutional vulnerability
These include FATF Mutual Evaluation Reports, the Basel AML Index, the Financial Secrecy Index and aspects of the Peddling Peril Index. They primarily evaluate the quality, resilience and effectiveness of a jurisdiction's legal and institutional framework.
- Assessments of threat or impact
These include the Global Terrorism Index, Europol's TE-SAT and national or supranational threat assessments. They describe the existence, nature or intensity of particular threats rather than the quality of the regulatory framework.
- Indicators of transparency and international cooperation
These include the EU list of non-cooperative jurisdictions for tax purposes, the OECD Global Forum assessments on EOIR and AEOI, and broader indicators relating to beneficial ownership transparency or financial secrecy. They help identify vulnerabilities that may facilitate financial crime without directly measuring criminal activity itself.
Viewing these resources through this lens helps avoid treating them as interchangeable. Apparent overlaps are not necessarily methodological flaws.
Some resources measure different dimensions of the same phenomenon. Others rely, at least in part, on similar underlying information. Composite indicators may already incorporate elements drawn from other sources.
The question is therefore not how many indicators can be collected, but whether each one contributes genuinely distinct analytical value. Ultimately, deciding how those sources should be interpreted, weighted and combined remains a matter of institutional judgement. That is precisely what the risk-based approach allows.
Conclusion
Perhaps the most interesting aspect of country risk assessment is that it resists standardisation.
Different institutions may legitimately adopt different methodologies, provided they remain coherent, proportionate, transparent and capable of being explained.
In that respect, the legislation does not seek to replace professional judgement. Rather, it requires institutions to exercise it responsibly and to be able to explain how their conclusions have been reached.
Country risk assessment is therefore less about identifying the perfect score than about building a methodology that remains coherent, proportionate and transparent over time.
From methodology to practice
At SableRock, we believe that country risk assessment should not be a static exercise. It should evolve as the underlying information changes. Our approach combines regulatory requirements with a structured repository of public and institutional sources to support dynamic country risk assessments.
Sources such as FATF publications, sanctions updates, Basel AML Index releases, tax transparency assessments, and terrorism- and proliferation-related resources can be consolidated within a single framework while preserving the rationale behind each assessment.
Beyond consolidating information, technology can monitor changes across multiple sources, maintain a documented audit trail, automate recurring data collection and support the consistent application of the chosen methodology over time.
Technology does not replace professional judgement.
It supports professional judgement by automating the collection, consolidation and monitoring of relevant information, allowing compliance teams to focus on interpreting the available evidence, documenting their reasoning and making informed, risk-based decisions.