Cross-border remittances: how far does your geographic risk assessment need to go?

The standard across all three jurisdictions is risk-based and proportionate. A direct foreign correspondent's jurisdiction must be assessed as part of correspondent relationship due diligence. Known and material intermediary bank jurisdictions belong in payment corridor and transaction risk analysis. Unknown or incidental routing banks, however, do not create an automatic duty for bespoke assessment on every payment. The institution should instead account for foreseeable routing exposure through corridor and correspondent network risk assessment, screening, monitoring, and escalation controls.

What the regulatory frameworks require

The US, EU, and UK approaches are closely aligned, though they operate through different legal frameworks.

In the US, FFIEC materials support an assessment that considers relevant jurisdictions throughout the part of the payment process in which a bank has an operational role, relationship, or meaningful visibility. Where a US bank maintains a correspondent account for a foreign financial institution, 31 CFR §1010.610 requires a due diligence programme that is appropriate, specific, and risk-based. The foreign correspondent's jurisdiction is a central feature of that assessment, covering the foreign institution's business and markets, expected account activity, AML/CFT controls, and the supervisory regime in the jurisdiction where it is licensed. Enhanced due diligence applies where the respondent is an offshore bank, licensed in a jurisdiction designated as non-cooperative by an intergovernmental body of which the US is a member, or subject to US special measures.

In the EU, the AML framework requires a risk-based consideration of country and geographic risk, with relevant indicators including jurisdictions with significant AML/CFT deficiencies, high corruption or predicate crime risk, weak transparency, or relevant international sanctions. For a cross-border correspondent relationship with a third-country respondent institution, EU requirements include obtaining sufficient information to understand the respondent's business, establishing its reputation and supervisory quality from credible public information, assessing its AML/CFT controls, obtaining senior management approval before establishing a new relationship, and documenting each institution's respective AML/CFT responsibilities. The EBA's AML/CTF risk factor guidance reinforces the geographic element: a business relationship or transaction may involve high country risk where funds are generated, received from, or sent to a third country with material AML/CFT deficiencies. Regulation (EU) 2024/1624, the AMLR, retains specific enhanced due diligence requirements for cross-border correspondent relationships involving third-country respondents. Its main application date is 10 July 2027; until then, firms apply national measures implementing the AML Directives alongside applicable supervisory expectations.

In the UK, the Money Laundering Regulations 2017 require firms to take account of customer, product, and geographical risk factors when assessing high ML/TF risk. Regulation 34 sets out specific correspondent banking requirements covering the respondent's business, its reputation and supervisory quality, its AML/CTF controls, senior management approval for new relationships, documentation of respective responsibilities, and prohibitions on relationships with shell banks. JMLSG guidance is explicit that jurisdiction risk must be considered where a party is overseas, funds are received from overseas, or a payment is requested to be made overseas. In correspondent banking, the respondent's jurisdiction and, where relevant, the jurisdiction of its ultimate parent, can be a meaningful driver of the relationship's inherent and residual risk.

A proportionate approach in practice

An effective methodology separates three distinct layers of assessment.

These layers are distinct and should not be conflated. A UK bank processing a customer payment to a beneficiary in Country A through a known correspondent in Country B should reflect Country B in its corridor risk assessment. It does not need to repeat the full institutional assessment of that correspondent for each payment, provided the relationship has been approved, monitored, and periodically reviewed. A payment-specific alert may still be appropriate where Country B presents higher risk, the route is unusual, payment information is incomplete, or sanctions indicators arise.

The data challenge

Corridor risk assessment is only as good as the data behind it. Understanding the AML/CFT quality, enforcement record, beneficial ownership transparency, and sanctions exposure of every jurisdiction in a payment corridor requires current, granular, jurisdiction-level data across a broad range of risk dimensions. KnowYourCountry's enhanced due diligence country reports will soon include remittance corridor data alongside country risk scores across 245+ jurisdictions, giving compliance teams the jurisdiction-level detail they need to build and maintain corridor risk assessments that are documented, evidenced, and proportionate to regulatory expectations. Our methodology has been trusted by regulated businesses and government agencies for over 20 years.