Jurisdiction and Geographic Risk

1. Why Jurisdiction and Geographic Risk Matters

Geographic risk is one of the four classic pillars of the risk-based approach (RBA) to anti-money laundering, alongside customer risk, product/service risk, and delivery channel risk. Every AML/CFT framework recognised by the CAMS syllabus, including the FATF Recommendations, the Wolfsberg Principles, the Basel Committee guidance, and the USA PATRIOT Act, requires institutions to identify where their customers are located, where their money comes from, where it goes, and which countries it passes through along the way.

Why does this matter so much? Because criminals deliberately exploit differences between countries. A launderer wants to move funds from a place where the crime occurred to a place where the law is weak, enforcement is slow, secrecy is strong, or cooperation with foreign authorities is poor. Weak jurisdictions act as the layering engine of global money laundering. If an institution fails to understand the geographic dimension of its exposure, it cannot properly calibrate due diligence, monitoring, or sanctions controls, and it risks regulatory penalties, reputational damage, loss of correspondent relationships, and even criminal liability.

From an exam perspective, geographic risk appears constantly, often woven into scenario questions about correspondent banking, shell companies, trade finance, private banking, PEPs, and sanctions. You must be able to spot geographic red flags, know the key sources of country risk information, and apply a proportionate, risk-based response rather than a blanket refusal.

2. What Is Jurisdiction and Geographic Risk?

Jurisdiction risk (also called country risk or geographic risk) is the heightened likelihood that a customer, transaction, counterparty, or business relationship is connected to money laundering, terrorist financing, sanctions evasion, corruption, or other financial crime because of the countries or regions involved.

Geographic risk is not limited to where the customer lives. It includes:

- The country of the customer's residence, citizenship, or incorporation.
- The country where the customer conducts its principal business.
- The location of beneficial owners, directors, and controlling persons.
- The origin and destination of funds.
- Intermediary and correspondent jurisdictions through which payments are routed.
- The location of counterparties, suppliers, and customers of the customer.
- The location of the institution's own branches, subsidiaries, and agents.

Categories of higher-risk jurisdictions commonly cited in the CAMS body of knowledge:

1. Countries subject to sanctions, embargoes, or similar measures issued by the United Nations, the United States (OFAC), the European Union, the United Kingdom (OFSI), or other national authorities.

2. Countries identified by FATF as having strategic AML/CFT deficiencies. FATF publishes two lists: the High-Risk Jurisdictions subject to a Call for Action (commonly called the black list), for which countries are asked to apply countermeasures or enhanced due diligence, and the Jurisdictions under Increased Monitoring (commonly called the grey list), which are actively working with FATF on action plans. Many national regulators, such as the European Commission's list of high-risk third countries, derive their own lists from FATF outputs.

3. Countries identified as providing funding or support for terrorist activities, or with designated terrorist organisations operating within them.

4. Countries with significant levels of corruption or criminal activity, often measured with Transparency International's Corruption Perceptions Index, the Basel AML Index, the US State Department's International Narcotics Control Strategy Report (INCSR), and World Bank governance indicators.

5. Tax havens and secrecy jurisdictions that offer strict bank secrecy, bearer shares, nominee directors, anonymous shell companies, or minimal beneficial ownership transparency.

6. Offshore financial centres (OFCs) where the volume of financial activity is disproportionate to the size of the domestic economy, and which specialise in international business companies, trusts, and private banking.

7. Drug-producing or drug-transit countries and regions associated with human trafficking, wildlife trafficking, or arms smuggling.

8. Conflict zones and politically unstable states where governance has collapsed or where there is a high risk of proceeds from kleptocracy or war profiteering.

9. Jurisdictions designated under special national measures, such as a jurisdiction named a primary money laundering concern under Section 311 of the USA PATRIOT Act.

10. Free trade zones (FTZs) and border regions with heavy cash economies, relaxed customs oversight, and vulnerability to trade-based money laundering.

Note that lower-risk jurisdictions exist too: FATF member countries with strong, effectively implemented AML/CFT regimes, low corruption scores, and robust supervision. A good risk model distinguishes between high, medium, and low geographic risk rather than treating everything foreign as suspicious.

3. How Geographic Risk Is Exploited by Criminals

Understanding the mechanics helps you decode scenario questions:

Placement abroad: Cash generated by crime is physically smuggled (bulk cash smuggling) into a country with weak cash reporting controls and deposited there.

Layering through secrecy jurisdictions: Funds are wired through shell companies incorporated in jurisdictions that do not collect or disclose beneficial ownership, often with nominee directors, making the trail opaque.

Regulatory arbitrage: Criminals route funds through countries that have not criminalised certain predicate offences, do not share information with foreign FIUs, or have no mutual legal assistance treaty with the victim country.

Correspondent banking abuse: A respondent bank in a weak jurisdiction gains access to the global payment system through a correspondent bank in a strong jurisdiction. Nested accounts and payable-through accounts allow unknown third parties from high-risk countries to transact through the correspondent.

Shell banks: Banks with no physical presence in any country and no affiliation with a regulated financial group. Most regimes prohibit relationships with shell banks entirely.

Trade-based money laundering through FTZs: Goods are over- or under-invoiced, shipped through free zones with minimal inspection, and the paperwork disguises value transfers between high-risk and low-risk countries.

Sanctions evasion: Funds or goods destined for a sanctioned country are routed through third countries, with stripped wire details, re-flagged vessels, or front companies in neighbouring states.

Terrorist financing corridors: Small-value transfers, hawala, or charitable donations flow toward conflict zones or regions where terrorist groups operate.

4. How Geographic Risk Works Inside an AML Programme

Step 1: Enterprise-wide risk assessment. The institution maps its footprint: where it operates, which countries its customers come from, and where its transaction flows go. This feeds the overall risk appetite approved by senior management and the board.

Step 2: Country risk rating methodology. Institutions build a documented, defensible country risk model that aggregates multiple sources, typically FATF lists, sanctions lists, CPI, Basel AML Index, INCSR, EU and national high-risk lists, and the institution's own experience. Each country is assigned a tier (for example high, medium, low). The methodology must be reviewed regularly because lists change several times a year.

Step 3: Customer risk scoring. Geographic factors feed into the customer risk score at onboarding and during periodic reviews. A customer incorporated in a high-risk country, or with beneficial owners resident there, or sending most of its payments there, will score higher and trigger enhanced due diligence (EDD).

Step 4: Enhanced due diligence. For high geographic risk, EDD typically includes verifying beneficial owners more rigorously, understanding the purpose and intended nature of the relationship, establishing source of funds and source of wealth, obtaining senior management approval, and setting tighter transaction expectations. For correspondent banking, EDD includes assessing the respondent bank's own AML controls, ownership, regulatory status, and whether it allows nested or payable-through relationships.

Step 5: Sanctions screening. Distinct from but related to AML, sanctions screening checks customers, counterparties, vessels, and payment messages against prohibited parties and countries. Geographic risk informs screening sensitivity and country-specific blocking rules.

Step 6: Transaction monitoring. Monitoring scenarios are tuned to geography: lower thresholds for transfers involving high-risk countries, rules for round-tripping, rules for payments routed through unusual intermediary countries, and rules for activity inconsistent with the customer's known geographic profile.

Step 7: Ongoing review and exit decisions. Relationships are reviewed more frequently when geographic risk is high. If risk exceeds appetite and cannot be mitigated, the institution may restrict, suspend, or terminate the relationship. However, regulators and FATF discourage wholesale de-risking, meaning indiscriminately exiting entire countries or categories of customers without individual assessment, because it pushes legitimate activity into unregulated channels and harms financial inclusion.

Step 8: Reporting. Unusual geographic patterns that cannot be explained should be escalated and, where suspicion is formed, reported to the FIU through a suspicious activity report or suspicious transaction report.

5. Key Geographic Red Flags to Memorise

- Transactions involving countries with no apparent connection to the customer's business or personal circumstances.
- Funds routed through multiple jurisdictions for no obvious commercial reason.
- Use of shell companies incorporated in secrecy jurisdictions, especially with nominee directors or bearer shares.
- Large wire transfers to or from countries known for narcotics production, corruption, or terrorism.
- A customer unwilling to explain why funds are sent to a high-risk country.
- A respondent bank that permits nested relationships with institutions in weak jurisdictions.
- Trade transactions where the shipping route, origin of goods, or payment path involves a free trade zone or sanctioned region inconsistent with the documentation.
- Frequent small payments to conflict regions, particularly through money service businesses or charities.
- Customers who move operations or accounts to a new jurisdiction shortly after a regulatory crackdown elsewhere.
- Payments with altered or stripped originator or beneficiary information, suggesting an attempt to hide a sanctioned country.

6. Important Distinctions the Exam Likes to Test

FATF lists versus sanctions lists. FATF identifies countries with AML/CFT deficiencies; it does not impose legal sanctions. OFAC, the UN, the EU, and national authorities impose sanctions that are legally binding. A country can appear on one and not the other.

Black list versus grey list. The Call for Action list may require countermeasures; the Increased Monitoring list generally requires risk-sensitive consideration, not automatic countermeasures.

Risk-based approach versus de-risking. The correct exam answer almost always favours assessing and mitigating risk at the individual customer level over blanket refusal, except where the law prohibits the relationship outright (for example shell banks or comprehensively sanctioned countries).

Shell bank versus shell company. A shell bank has no physical presence and is prohibited as a correspondent. A shell company is a legal entity without active operations; it is high risk but not automatically prohibited.

Offshore financial centre versus tax haven versus secrecy jurisdiction. These overlap but are not identical. Many OFCs are well regulated. The exam focuses on the secrecy and beneficial ownership opacity features as the true risk drivers.

7. Exam Tips: Answering Questions on Jurisdiction and Geographic Risk

Tip 1: Look for the phrase with no apparent business reason. When a scenario describes funds moving to or from a country unconnected to the customer's profile, that is the central red flag. The best answer usually involves investigating the connection, requesting an explanation, and escalating, not immediately closing the account.

Tip 2: Identify the correct source for the type of information being asked about. If the question asks about AML/CFT deficiencies, the answer is FATF (or an FSRB). If it asks about corruption, think Transparency International CPI. If it asks about narcotics, think INCSR. If it asks about legally prohibited transactions, think sanctions authorities such as OFAC or the UN Security Council. Matching the list to the risk type is a frequent test point.

Tip 3: Choose risk-based over absolute. CAMS consistently rewards the proportionate response: apply EDD, obtain senior management approval, increase monitoring, document the rationale. Answers that say refuse all customers from country X or terminate every account linked to a grey-listed country are usually distractors unless the scenario involves a legally prohibited party or a shell bank.

Tip 4: Remember that geography is one factor, not the whole story. Questions often combine a high-risk country with other factors such as a PEP, a cash-intensive business, or a complex ownership structure. The correct answer recognises that risk is cumulative and that the combination, not the country alone, drives the required level of due diligence.

Tip 5: For correspondent banking questions, focus on the respondent's jurisdiction and controls. Expect questions about assessing the respondent bank's home regulator, its AML programme, whether it is a shell bank, and whether it allows nested or payable-through accounts. The strongest answers involve understanding the respondent's customer base and the quality of supervision in its home country.

Tip 6: Do not confuse FATF membership with low risk, or non-membership with high risk. FATF members can have deficiencies and non-members can be well regulated through FSRBs. Risk ratings should be based on documented assessment, not membership alone.

Tip 7: Watch for questions about the dynamic nature of lists. FATF updates its lists at each plenary (generally three times a year). A correct answer about programme design will mention periodic review and updating of the country risk methodology.

Tip 8: When asked what to do first, think assess and document. The first step in geographic risk is usually to identify and assess the exposure (enterprise-wide risk assessment or customer risk assessment), before implementing controls. If the scenario is about a specific transaction, the first step is typically to gather information and review the customer file, then escalate.

Tip 9: Read for routing, not just endpoints. Examiners sometimes bury the high-risk jurisdiction in the intermediary leg of a wire, in the flag of a vessel, or in the location of a beneficial owner rather than the customer's own address. Train yourself to scan every geographic reference in the scenario.

Tip 10: Distinguish between suspicion and risk. A customer from a high-risk country is higher risk but is not automatically suspicious. Filing a suspicious activity report requires unusual or unexplained activity, not just a passport from a particular country. Answers that jump straight to filing a report based solely on nationality are generally wrong.

Tip 11: Know the vocabulary. Be fluent with terms such as countermeasures, increased monitoring, call for action, primary money laundering concern, Section 311, de-risking, nested accounts, payable-through accounts, shell bank, free trade zone, offshore financial centre, and secrecy jurisdiction. Recognising these words quickly saves time and prevents misreading.

Tip 12: Eliminate extremes. In multiple-choice format, the two most extreme options (do nothing versus terminate everything) are usually distractors. The answer is typically the one that applies a documented, proportionate control and involves the right people, such as compliance and senior management.

8. Quick Revision Summary

- Geographic risk is a core pillar of the risk-based approach.
- It covers customer location, beneficial owner location, counterparty location, origin and destination of funds, and intermediary routing.
- Key risk categories: sanctioned countries, FATF-listed countries, terrorism-linked countries, high-corruption countries, secrecy jurisdictions and tax havens, narcotics and transit countries, conflict zones, Section 311 designations, and free trade zones.
- Key sources: FATF black and grey lists, UN/OFAC/EU/UK sanctions, Transparency International CPI, Basel AML Index, INCSR, EU high-risk third country list, national FIU guidance.
- Controls: enterprise-wide risk assessment, documented country risk model, customer risk scoring, EDD, sanctions screening, geography-tuned transaction monitoring, periodic review, and escalation.
- Exam mindset: identify the red flag, match the right source, apply proportionate EDD rather than blanket refusal, treat geography as one cumulative factor, and separate higher risk from actual suspicion.

Master these principles and you will be able to handle any CAMS question that places a country, a border, or a routing path at the centre of the scenario.