Why a country risk score alone is not enough

A country risk score is a useful starting point. Regulators, however, expect something more specific: that a firm can demonstrate it has identified, assessed, understood, and mitigated its own geographical AML/CFT exposure. A score is an input into that process. It is not the process itself.

That distinction matters more now than it did two years ago. The EU AMLA’s 2026 draft guidelines on business-wide risk assessments state explicitly that obliged entities have an obligation to identify ML/TF risk across their operations, and that a business-wide risk assessment is key for determining an entity’s risk exposure and ensuring it has adequate AML/CFT controls. The UK JMLSG and FCA require firms to maintain a documented business-wide risk assessment covering customer, product, delivery channel, and geographic risks, and to apply enhanced due diligence where higher-risk jurisdictions are involved. The standard across all three frameworks is the same: the firm must demonstrate how a jurisdiction’s risks affect it specifically, not simply that it has assigned a risk label to a country.

The limitation of a generic score

Most geographical AML risk tools provide a general country risk score, aggregating multiple data sources into a single number. For orientation, benchmarking, and initial screening, that is genuinely useful. For building a defensible, firm-specific geographic risk methodology, it is insufficient on its own.

The reason is straightforward. A general score reflects average risk across all firms operating in or with a jurisdiction. Your firm is not an average firm. Its exposure to a given country’s risks depends on its customer base, the products and services it offers, the transaction flows it processes, and the corridors through which it moves money. Two firms with identical country risk scores on their books can have materially different actual risk profiles depending on how those countries feature in their specific business.

FATF Recommendation 10 identifies “countries or geographic areas” as a risk factor within customer due diligence. The expectation is that firms understand how a jurisdiction’s risk materialises for their specific customers and transactions, not that they apply a uniform country score to every customer from a given jurisdiction.

Building a methodology that fits your business

A construction business with a significant customer base faces different geographic risk exposure than a foreign exchange provider serving diaspora remittance customers, even if both operate across the same set of jurisdictions. A compliance team assessing human trafficking risk, for instance, might reasonably apply a higher weighting to that risk dimension across jurisdictions where construction sector exposure is concentrated. A firm with significant exposure to cross-border payments through specific corridors needs a risk methodology that reflects the specific AML/CTF characteristics of those corridors, not a single country score at each end.

This is the difference between a risk label and a risk methodology. The label tells you a country is high, medium, or low risk. The methodology tells you what that means for your firm, your customers, and your controls.

KnowYourCountry’s customisable Scoring Profiles tool is built around this principle. Users can build and adjust the risk methodology that fits their own business, weighting risk dimensions according to their specific customer base, product mix, and risk appetite. A firm that needs to give greater weight to human trafficking risk, corruption exposure, or sanctions complexity in specific markets can configure its methodology accordingly, rather than applying a generic score that was not built with its business in mind.

The dynamic dimension

A second limitation of static scoring tools is that they capture a jurisdiction’s risk profile at a point in time. The regulatory environment expects something more current.

AMLA’s emerging framework, alongside FinCEN’s eight AML/CFT priorities, points toward a model in which firms combine formal country risk scoring with ongoing typology analysis. A score does not inform a compliance team of specific risks flagged by regulatory notices, identified vulnerabilities in remittance corridors, or the implications of internal or international political conflict for a given jurisdiction. Those signals change, sometimes quickly, and a firm whose geographic risk assessment was last updated at the previous annual review cycle may be working from a materially outdated picture.

The practical implication is that geographic risk assessment needs two things a static score cannot provide: firm-specific configuration and dynamic updating. KnowYourCountry’s enhanced country reports include remittance corridor data, political conflict indicators, and regulatory risk category data updated as material changes occur. The scoring methodology, built around the same risk dimensions that FATF mutual evaluators scrutinise, gives compliance teams a documented, evidenced foundation for their geographic risk decisions.

When a regulator asks how a firm assessed the geographic risk of a specific jurisdiction, the answer needs to reflect the firm’s own exposure. A score is where that conversation starts. A documented, firm-specific, dynamically maintained methodology is what holds up when the questions get more specific.

At KnowYourCountry, our methodology has been trusted by regulated businesses and government agencies for over 20 years. The tools we provide are built to help compliance teams move from a score to a methodology, and from a methodology to a documented, defensible position.