The Global Financial Integrity (GFI) report titled Illicit Financial Flows from Developing Countries: 2003-2011 states that, in 2012 alone, almost $1trn of illicit funds left developing countries. Stemming from a variety of illicit origins, such as trade misinvoicing, tax evasion, trading in illegal goods and corruption, illicit funds represent a huge loss to developing countries and their populations. They also represent a major risk for financial centres and their banks and non-banking financial institutions, and for companies involved in international investment and trade.

The dual nature of this phenomenon neatly illustrates the complexity associated with doing business internationally and managing associated risks. Risks emanate on the one hand from the country in which illicit flows originate, where risks would be associated with high levels of financial and economic crimes and limitations in relation to the rule of law. On the other hand, risks relate to the international flow of funds and the management of these funds, whereby the rapidly changing landscape of financial centres, no longer situated only in developed countries but increasingly also in the ‘global south’, adds to the complexity. Defining a ‘high risk’ country is thus becoming increasingly complex, and this represents a major challenge for companies and financial institutions.

Risks are usually specific to each country, its political and economic structure, and to each industry

Illicit cash flow
Countries from which a majority of the illicit flows originate often have only limited capacity to prosecute criminals, whether they are locals or international companies or their representatives. In particular, they have little to no experience in handling complex international crimes or in ‘following the money’. That may quickly lead us to believe that doing business in these countries is only a risk on paper. However, the contrary is true.

The global reach of national laws against corruption and related crimes, such as the US Foreign Corrupt Practices Act or the UK Bribery Act, put the operations of almost any internationally operating company under close and growing scrutiny. In addition, the implementation of international money laundering standards, such as those of the Financial Action Task Force (FATF), mean financial institutions are being seen as front line defenders in the fight against money laundering and gatekeepers of the financial system’s integrity. Ignoring country risks is thus not an option.

Risks are usually specific to each country, its political and economic structure, and to each industry. By way of an example, industries that are susceptible to high levels of corruption are oil and gas, defence, logistics, telecommunications and pharmaceuticals. Gaining access to or staying in these industries often involves large public procurement and licences issued by state authorities; the size of contracts involved is such that winning or losing a contract may in some cases decide on the fate of a company, while gains potentially to be made by concerned public officials through a kick-back scheme are too considerable to be easily ignored. This is a fairly broad statement however, and generalising it across all countries in the world likely means that we are simplifying reality and not paying adequate attention to geographic risks, relating to the particular social and economic situation, power arrangements and legal and institutional structures in a country.

Even if it can be too risky to do business in countries with weak rule of law or increased levels of corruption and poor standards for controlling money flows, not going into these markets is equally not an option for most corporations from a business perspective. Many of these countries have high growth potential and are thus attractive places for investment, not only for large multinationals but also for small- and medium-sized financial institutions and companies. Therefore, the only option when doing business in those environments shall be understanding the risks involved and putting in place systems that keep them at bay.

The big question is how much do companies and financial institutions actually know about the level of financial and economic crime risk in a given country? The biggest challenge is what to focus on, and where, in order to identify and manage those risks. Identifying the risks can be useful from a preventive as well as business perspective, for instance: in allocating compliance resources appropriately to where risks are the greatest (due to the limited resources – even for larger companies); in identifying countries and businesses that could cause harm before it is too late; and identifying poor business prospects, such as customers who pose sanctions and export-control risks, especially after taking into account the regulatory risks they introduce.

Assessing risk
In order to ensure meeting the increasing ethical and legal requirements to operate in foreign countries, most of the financial institutions and companies have established sophisticated internal compliance systems. Within the compliance community it is well known that the foundation of any compliance system is an initial and on-going risk assessment in order to identify, assess, monitor and manage risks, including financial crime and money laundering risks associated within a business sector.

The starting point of the risk assessment process is usually identifying the environment(s) in which the business operates. A key factor affecting this is related to country specific characteristics. Beyond the country risk, further risk analyses are necessary and may include third party, sector and transaction risks in order to identify more specifically the business areas that are more exposed to financial crime risks than others.

Identifying countries with respect to their exposure to financial crime and money laundering is, however, challenging, giving the lack of a pre-defined formula on how to assess those risks at a country level. To date there has been no universally agreed definition or methodological approach that clearly defines whether a particular country represents a high risk. Companies and financial institutions suddenly face the task of assessing countries’ risk by investing in their own research, experts and methodology to develop a risk-rating tool.

While larger companies may cope with such resource-heavy measures, small- and medium-sized companies that operate globally are less capable of conducting such a task. A cost-efficient solution for the companies and financial institutions can be the use of external sources or support. A valid country risk assessment should, however, rely on credible sources and needs to be developed independently without the influence of profitability aspects.

Through the Basel AML Index, the Basel Institute on Governance has managed to develop a solid and independent methodology to identify the relative risk level of countries in money laundering as well as terrorism financing.

The Basel AML Index provides a composite index aggregating 14 external indicators into different sections (see Fig. 1) and addressing a range of topics that affect money laundering as well as terrorism financing risks. It must be noted that our institute does not generate its own data but relies on data from various publicly available sources such as the FATF, the World Bank, Transparency International and the World Economic Forum.

The results show that the countries on top of the high risk ranking of the Basel AML Index (see Fig. 2) all share an inadequate anti-money laundering/counter terrorism financing (AML/CTF) framework. Other factors are, however, also common, including high rates of perceived corruption, a weak judicial system, a lack of resources to control the financial system, and a lack of public and financial transparency.

The Basel AML Index illustrates that a combination of weak AML/CFT frameworks and a generally low performance in the majority of indicators that have been used in the ranking, results in a high overall risk score. This may explain why particularly developing or low-income countries have been at the top of the Basel AML Index for the past three years. Among OECD countries, Austria, Germany, Luxembourg, Japan and Switzerland still rank above-average high risk despite legislative progress and low rates of perceived corruption (see Fig. 3). The reasons being their roles as a major financial centres, or the sophistication of their economies.

Mitigating risk
Using a solid country risk ranking (such as the Basel AML Index Expert Edition) is important for financial institutions and companies to understand the weaknesses and blind spots of the AML/CFT framework and to implement effective measures that complement the national systems and address the gaps.

Risk mitigation does not mean or require the elimination of all risks – that’s simply not feasible. But it can mean making an informed choice between leaving a market or taking measures that allow the company to remain in that market at a minimised risk level. Establishing an effective compliance system, implemented throughout a company’s global operations, including subsidiaries and the supply chain, can be challenging. But the failure to do so can result in damage to reputation and significant financial penalties, as reported on a daily basis in the media.

Defining a risk appetite based on a comprehensive risk assessment is essential for all companies and country risk rating should invariably be the building block upon which an internal risk assessment is based, which in turn informs the company’s behaviour in relation to doing business in a foreign country. Regulators and law enforcement require companies to evidence the way they approach and apply their risk assessments and justify business decisions that are made on such assessments.

While there’s no such thing as the perfect compliance programme, a rational risk-based process that includes a sound country risk assessment is a good defence if a violation of the compliance programme has been detected.