Country Risk Assessment
Published On: 01/06/2026
Protect your business with reliable and effective AML strategies with AML UAE.
Last Reviewed On: 08/03/2026 | Last Updated On: 08/03/2026
What You Need to Know
- Country Risk Assessment identifies and evaluates ML/TF risk emanating from country of a client, agent, intermediaries or business associates with whom Regulated Entity is associated.
- Country Risk Assessment helps classify clients into low, medium or high risk based on geographical risk faced by Regulated Entities.
- Country Risk is one of the common factors which impacts both CRA and EWRA of a Regulated Entity.
- An effective Country Risk Assessment must be aligned with recent updates in relevant sanctions publishing and key recommendation of Regulating Authorities.
What is Country Risk Assessment?
Country Risk Assessment is a process which helps to evaluate vulnerability of a country to financial crime. This assessment helps Regulated Entities in identifying and evaluating level of country risk faced while establishing a business relationship with an individual or organisation belonging to a specific country.
It is not necessary that all countries represent same financial crime risks, as they differ in terms of legal and regulatory frameworks, enforcement of international standards, transparency within financial systems, and ongoing geopolitics.
These differences increase or reduce a country’s exposure to financial crime. Therefore, Regulated Entities engaging with higher-risk jurisdictions may face increased risks related to Money Laundering and Terrorist Financing.
Why Country Risk Assessment is Important in AML
Regulated Entities are required to conduct two types of risk assessments, i.e. Customer Risk Assessment (CRA) and Enterprise-Wide Risk Assessment (EWRA). The risk-based approach and the enterprise-wide risk assessment are outlined under Article 19(1)(a) of Federal Decree-Law No. 10 of 2025 and Article 5 of Cabinet Resolution No. 134 of 2025.
CRA is process of assessing risk category of its customers and EWRA is for identifying and evaluating risk factors impacting business itself. One of the common factors which influence both CRA and EWRA is Country Risk.
All countries do not represent uniform levels of risks, some countries have weaker regulatory framework, adjacent informal economy or more criminal activities, subjecting them to international sanctions which increases ML/ TF/PF risks. Countries with these kinds of factors are considered high-risk countries.
Further, Regulated Entities are required to adopt a Risk Based Approach while conducting CRA. For example, a customer from a low-risk country requires standard checks such as Simplified Due Diligence whereas customers from high-risk countries require more verifications and monitoring.
Negligence or failure to apply risk-appropriate or stricter measures to high-risk countries results in regulatory penalties.
What Makes a Country High Risk or Low Risk?
Countries with high risk often have common risk factors like high corruption level, weak implementation of AML/CFT laws or lack of international cooperation that results in difficulties in detecting ML/TF or PF based activities.
Countries affected by ongoing conflicts or political instability, such as war or internal unrest provide an easy way for wrongdoers to conduct ML/TF/PF activities, as the Government oversight and controls in such countries are weaker, making them high risk.
Moreover, sanctions or trade restrictions imposed by international organisations like UNSC, EU, or FATF suggest high risks.
Additionally, countries that rely extensively on high cash usage outside formal banking systems facilitate smooth flow of illicit funds as tracing original destination of money in such countries is harder. These loopholes in financial system make such countries riskier in terms of financial crime activities.
Therefore, Regulated Entities are required to conduct Enhanced Due Diligence and stricter monitoring, while dealing with customers and payments routed through or associated with high-risk countries.
Contrastingly, low risk countries generally have strong, effective legal and regulatory frameworks, transparent financial systems, and adherence to international standards to address financial crime risks such as Money Laundering and Terrorism Financing.
How Country Risk Affects Businesses and Customers
Country risk is a component of the Customer Risk Assessment, which helps figure out risk levels associated with country to which its customers, including suppliers, business associates, or intermediaries belong.
While onboarding a new customer, Regulated Entities must identify and verify the nationality, country of origin or residence of the customer.
If the customer is from a high-risk country, it will trigger the requirement of additional documents like documents supporting sources of wealth or sources of funds to conclude Enhanced Due Diligence effectively.
Basic Steps to Perform a Country Risk Assessment
Customer Risk Assessment provides comprehensive understanding of risks factors associated with a client and helps in crafting overall risk profiles relevant to Regulated Entities.
Country Risk Assessment, being a curial part of CRA, simplifies evaluation of geographic factors and provides uniform management of risk unique to each country.
- The very first step is to identify countries by initiating Know Your Customer (KYC). Regulated Entity must verify country related information of client like nationality, country of residence, country of origin for natural persons or place of incorporation of business for legal entities as customers.
- The second step involves determining risk levels into categories such as low, medium or high risk while referring to reliable sources to assess country-specific risks like UNSC Resolutions, FATF grey list and blacklists.
- The next step involves assigning risk rating to customers based on aggregated factors influencing risk levels posed by country they belong to, assigning risk rating to a client’s country on scale of low (minimal threats), medium (moderate threats) or high risk (significant vulnerabilities).
Depending on the scale of risks associated with a client’s country, due diligence measures and controls are decided. A customer from low-risk country requires Simplified Due Diligence, periodic screening and monitoring whereas a customer posing high risk requires Enhanced Due Diligence, regular sanctions, adverse media and PEPs screening and frequent ongoing monitoring.
Common Mistakes in Country Risk Assessment
Regulated Entities often undermine the effectiveness and accuracy of Country Risk Assessment, which leads to an increase in incorrect risk categorization and over or under compliance.
- The most common mistake is treating all countries uniformly ally; this shows negligence towards inherent risk variances.
- Failing oversight and updating risk ratings in concurrence with new Sanctions List updates in FATF listings.
- Further, ignoring destination countries during cross border payments.
- At last, having a generalized or unverified assumptions for certain countries without checking current data.
- The Country Risk Assessment must be based on verified, evidence based and updated data to meet requirements of AML compliance standards.
A Ready Checklist for Evaluating Geographic Risk During Client Onboarding
Customer Risk Assessment (CRA), an important component of the Customer Due Diligence (CDD) process, requires Regulated Entities in UAE to consider various risk factors while assessing the financial crime risks a customer may pose to the business. One of these factors is Geographic Risk.
Geographic risk includes Money Laundering (ML), Terrorism Financing (TF), and Proliferation Financing (PF) risks emanating from the country which the client of a Regulated Entity is associated with.
In this infographic, we have outlined a systematic step-by-step approach for effectively managing country-related financial crime risks posed by a client of a Regulated Entity for effective Anti-Money Laundering (AML) compliance.
Step 1: Incorporate Geographic Risk Parameters in the Customer Risk Assessment Methodology
Regulated Entities need to define ML/TF and PF risk factors and assign relevant risk score, risk level, and weightage to them as a part of their CRA methodology. It must be aligned with the Enterprise-Wide Risk Assessment (EWRA) of the Regulated Entity. Geographic risk is one of the risk factors to be considered and included during the CRA process.
Assessing ML/TF and PF risks related to the country of the client is part of the geographic risks to be considered during the CRA process. Incorporating country related ML/TF and PF risk parameters helps Regulated Entity build accurate and relevant customer risk profiles.
We have detailed country-related ML/TF and PF risk parameters in our infographic on “Factoring Geographic Risk During Client Onboarding: A Checklist”
Step 2: Identify and Verify Client's Country-Related Information
Before onboarding, Regulated Entity should identify and verify a client’s country related information as a part of its Know Your Customer (KYC) process. This includes information about the following:
- Nationality or citizenship of the client
- Place of birth of the client (for clients that are individuals, or client’s Ultimate Beneficial Owners, and linked parties)
- Place of residency of the client
- Primary business location, headquarters, location of incorporation, or registration of the client (for legal persons)
- Jurisdictions from which the client conducts transactions with the Regulated Entity
Step 3: Perform Customer Risk Assessment
The Regulated Entity should use the information collected during the KYC process, Sanctions Screening, Politically Exposed Person (PEP) Screening, Adverse Media Screening results, and CRA methodology to conduct CRA for the client. This helps the Regulated Entity assess the financial crime risks emanating from the customer, while giving adequate weightage to country-related ML/TF and PF risk factors.
The CRA must be conducted by keeping in mind the specific country related information of the customer.
For example, a client was born in an FATF blacklisted country, but is a resident of country known to have effective AML/CFT/CPF regulations, would pose lower ML/TF and PF risks than a client that has the place of birth, nationality, and residence of an FATF Blacklisted country.
After conducting CRA, the Regulated Entity would understand the client’s ML/TF and PF risk profile.
Step 4: Adopt Risk-Based Customer Due Diligence Measures
The Regulated Entity should adopt ML/TF and PF risk control measures in accordance with the client’s risk profile. If the client has been assessed to pose high ML/TF and PF risks, Enhanced CDD measures should be adopted. If the clients have been assessed to pose low ML/TF and PF risk, Simplified CDD can be adopted. If the client’s level of ML/TF and PF risk is beyond the risk appetite of the Regulated Entity, the Regulated Entity may choose not to board the client.
Further, if the client, their activities, or the transactions they undertake are related to high-risk countries, High-Risk Country Transaction Report (HRC) or High-Risk Country Activity Report (HRCA) must be filed at the goAML portal.
High-risk Countries, as defined by the National Committee for Combating Money Laundering, the Financing of Terrorism, and Proliferation Financing, are countries that have been Blacklisted by the FATF. Regulated Entity should also report any suspicions of ML/TF and PF that have been detected through the Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR).
For example, consider a situation in which a Regulated Entity is approached by a client from a country Z to conduct a transaction on behalf of the client. During the CRA process, the Regulated Entity can use the country-specific ML/TF and PF risks parameters to assess the financial crime risks associated with country Z. If the Regulated Entity finds out that country Z is an FATF blacklisted country, it needs to file the HRC report. The Regulated Entity must also adopt EDD measures for the client. However, if the ML/TF and PF risks posed by the client are beyond what the Regulated Entity can manage, it can decide to offboard the client to derisk itself.
Step 5: Ensure Ongoing Monitoring
After onboarding the client, the Regulated Entity should ensure that it conducts ongoing monitoring of the business relationship with the client. This helps the Regulated Entity make sure that all client CDD information and their CRA are kept . For example, whenever the FATF Blacklists or Greylists a country, and the client is related to this country, the CRA of the client would change. Further, when a country the client is associated with gets Blacklisted by FATF, the Regulated Entity must file HRC or HRCA Report before continuing business relationship with the client. We have explained this in detail in this blog.
A Ready Checklist for Evaluating Geographic Risk During Client Onboarding
During the Customer Risk Assessment (CRA) process, many factors need to be considered to ensure that financial crime risks that a customer may pose to the Regulated Entity are comprehensively assessed and addressed. This contributes towards building an accurate customer risk profile, allowing Regulated Entities in UAE to take a risk-based approach towards managing Money Laundering (ML), Terrorism Financing (TF), and Proliferation Financing (PF) risks.
Country-related ML/TF and PF risk is one such factor. In this infographic, we have discussed the various parameters that can be adopted by Regulated Entities to assess the country-specific ML/TF and PF risks emanating from a customer.
This checklist can be readily utilised by the Regulated Entity to enhance its CRA methodology, while giving adequate weightage to country-related ML/TF and PF risks. A Regulated Entity can rely on this checklist, once the Know Your Customer (KYC) details are collected to identify the country or countries in which the customer holds nationality and usually conducts business transactions.
The parameters to be factored while assessing country risk posed by a customer are detailed in the checklist below:
- Whether the country in question has been included by the Financial Action Task Force (FATF) in its Blacklist or Grey List?
- Whether the country has been sanctioned by the UN, or are there UN embargoes against the country?
- Whether the country has significant levels of corruption, bribery or criminal activity?
- Whether the country has political or economic instability, or an ineffective rule of law?
- Whether the country is a Conflict Affected and High Risk Area (CAHRA) country?
- Whether the country has been assessed by credible sources to present risks of ML/TF and PF? These credible sources include sources such as FATF Mutual Evaluation Reports (MER), Basel AML Index, KnowYourCountry Ratings, etc.
- Whether the country has known associations with TF conflict zones and their bordering countries?
- Whether the country has been identified as a tax haven?
- Whether the country is known to have ineffective AML/CFT/CPF regulatory framework?
- Whether the country is known to be a haven for production or transnational shipment of illegal drugs?
Responses to these questions will indicate the level of ML/TF and PF risks the client poses to the Regulated Entity due to their country of nationality or residence or business operations or country in which the entity is headquartered or incorporated in case of a client being a legal entity or legal arrangement.
Some parameters should be given more weightage than others. For instance, client from an FATF Blacklisted country would pose a higher ML/TF and PF risk than a client from FATF Grey listed country. In fact, when dealing with clients from high-risk countries, i.e., FATF Blacklisted country, filing High-Risk Country Report (HRC) or High-Risk Country Activity Report (HRCA) is compulsory.
Based on responses to these questions, Regulated Entity can formulate a probable scenario that gives clarity as to what kind of further due diligence measures must be adopted.
Let’s discuss a practical example to understand how these parameters can be incorporated into the CRA process of the Regulated Entity.
Consider a Regulated Entity ABC. During the course of its operations, it is approached by a client PQR for engaging in business. When conducting Know Your Customer (KYC) for the client, it was found that that the client PQR was born in Country Z, while his nationality is in Country Y. While conducting CRA for the client PQR, Regulated Entity ABC can use the parameters given above to assess the ML/TF and PF risks associated with Country Z and Country Y. Regulated Entity then needs to assign adequate weightage to these assessed risks. For example, if the client has no connections with the country of his birth and is solely connected with the country of his residence, i.e., the country of nationality in this case, then ML/TF and PF risks emanating from Country Y should be given more weightage.
Assessing the ML/TF and PF risks emanating from the countries the client is associated with, along with other risk factors such as customer risk factors, product/service related risk factors, delivery channel related risk factors, etc., ensures for a comprehensive CRA. We have given a detailed list of factors to consider here.
Using the CRA results, Regulated Entity ABC should build a customer risk profile, categorising PQR in accordance with the level of ML/TF and PF risks he poses to the Regulated Entity. On the basis of this, Regulated Entity ABC can apply a risk-based approach to choosing the most appropriate AML/CFT/CPF controls for the customer.
Country Risk Assessment as Part of an AML Program
Country Risk Assessment is an integral part of the AML compliance program, which connects customer risks, product risk and transaction risks to curate a comprehensive understanding of overall risk impacting business itself.
AML UAE provides thorough Country Risk Assessment through structured EWRA and CRA. This integration provides a cohesive ability to Regulated Entities to make well-informed decisions regarding implementation of controls and escalating procedures and henceforth mitigating the financial crime risk such as Money Laundering, Terrorism Financing and Proliferation Financing.
Questions about Country Risk Assessment
The Country Risk Assessment in AML is a process by which countries are evaluated based on vulnerability to ML/TF or PF-related activities
The risk level of a country is determined by conducting periodic Risk-Based Assessment i.e. CRA and EWRA aligned with key findings of National Risk Assessment and oversight on sanctions lists, FATF grey list and blacklist.
The factors influencing AML country risk scoring are FATF grey list/blacklist, regulatory controls, geopolitics, sanctions list and transparency and accountability in financial ecosystem.
FATF status is one of the factors which decides risk level of country. A country enlisted on FATF’s grey list or blacklist is considered as high-risk country that requires Enhanced Due Diligence or Risk-Based Approach before establishing business relationship.
The Country Risk Assessment is critical for CDD and EDD as it helps in classifying customer as low, medium or high risk and facilitates to decide level of control to be applied. Therefore, CDD and EDD helps to protect Regulated Entities from being used as means for financial crimes.
UAE Regulators expects Regulated Entities to undertake thorough Country Risk Assessment at both customer and business level and apply Risk-Based Approach that aligns with the risk appetite of RE and results of NRA.
Our Timely and Accurate AML consulting Services
For your smooth journey towards your goals
Share via :
About the Author
Pathik Shah
FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)
Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.
Reach Out to Pathik
