GAFI - National ML TF Risk Assessment 2013

fatf Guidance National Money Laundering and Terrorist Financing Risk Assessment

February 2013FINANCIAL ACTION TASK FORCE

The Financial Action Task Force (FATF) is an independent inter -governmental body that develops and promotes policies to protect the global financial system against money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction . The FATF Recommendations are recognised as the global anti-money laundering (AML) and counter-terrorist financing (CFT) standard. For more information about the FATF, please visit the website: www.fatf-gafi.org

© 2013 FATF/OECD. All rights reserved. No reproduction or translation of this publication may be made without prior written permission. Applications for such permission, for all or part of this publication, should be made to the FATF Secretariat, 2 rue André Pascal 75775 Paris Cedex 16, France (fax: +33 1 44 30 61 37 or e-mail: contact@fatf-gafi.org).

Photocredits coverphoto: ©ThinkstockNational Money Laundering and Terrorist Financing Risk Assessment FATF Guidance 2  2013

Table of Contents ACRONYMS .................................................................................................................................................................................... 3

1. INTRODUCTION & TERMINOLOGY ............................................................................................................................ 4 1.1 Purpose, scope and status of this guidance .................................................................................................... 4 1.2 Core FATF obligations and decisions regarding ML/TF risk assessments........................................ 5 1.3 Key concepts and terms relevant to ML/TF risk assessment ................................................................. 6 1.4 Users of ML/TF risk assessments ....................................................................................................................... 8

2. GENERAL PRINCIPLES FOR NATIONAL ML/TF RISK ASSESSMENTS ......................................................... 9 2.1 Clear agreement on purpose ................................................................................................................................ 9 2.2 Determining scope ................................................................................................................................................. 10 2.3 Need for high-level commitment to the ML/TF risk assessment process ...................................... 12

3. ORGANISATION AND INFORMATION .................................................................................................................... 13

2.1 Clear agreement on purpose ................................................................................................................................ 9 2.2 Determining scope ................................................................................................................................................. 10 2.3 Need for high-level commitment to the ML/TF risk assessment process ...................................... 12

3. ORGANISATION AND INFORMATION .................................................................................................................... 13 3.1 Planning and organisation of the ML/TF risk assessment .................................................................... 13 3.2 Sources of information ......................................................................................................................................... 13 3.3 Other planning considerations ......................................................................................................................... 18

4. STAGES OF ML/TF RISK ASSESSMENT .................................................................................................................. 21 4.1 First stage: identification .................................................................................................................................... 22 4.2 Second stage: analysis .......................................................................................................................................... 24 4.3 Third stage: evaluation ........................................................................................................................................ 27

5. OUTCOME OF RISK ASSESSMENTS ......................................................................................................................... 29

ANNEX I. ML/TF RISK FACTORS RELATING TO THREAT ...................................................................................... 31

ANNEX II. ML/TFRISK FACTORS RELATED TO VULNERABILITIES .................................................................. 39

ANNEX III. EXAMPLES OF NATIONAL-LEVEL ASSESSMENTS .............................................................................. 50

Australia .................................................................................................................................................................................. 50 The Netherlands................................................................................................................................................................... 54

Switzerland: Example of a risk assessment used as the basis for applying low-risk exemptions .... 55

United States.......................................................................................................................................................................... 56

A NNEX IV. SPECIFIC RISK ASSESSMENT METHODOLOGIES ............................................................................... 57

BIBLIOGRAPHY ......................................................................................................................................................................... 58National Money Laundering and Terrorist Financing Risk Assessment FATF Guidance  2013 3

ACRONYMS AML/CFT Anti-Money Laundering / Countering the Financing of Terrorism DNFBPs Designated Non-Financial Businesses and Professions FATF Financial Action Task Force FIU Financial Intelligence Units INR. X Interpretive Note to Recommendation X ML Money Laundering NPO Non-Profit Organisation RBA Risk-Based Approach SRB Self-Regulating Body STR Suspicious Transaction Report

FATF Financial Action Task Force FIU Financial Intelligence Units INR. X Interpretive Note to Recommendation X ML Money Laundering NPO Non-Profit Organisation RBA Risk-Based Approach SRB Self-Regulating Body STR Suspicious Transaction Report TF Terrorist FinancingNational Money Laundering and Terrorist Financing Risk Assessment FATF Guidance 4  2013

1. INTRODUCTION & TERMINOLOGY 1.1 Purpose, scope and status of this guidance

1. I dentifying, assessing, and understanding ML/TF risks is an essential part of the implementation and development of a national anti-money laundering / countering the financing of terrorism (AML/CFT) regime, which includes laws, regulations, enforcement and other measures to mitigate ML/TF risks. It assists in the prioritisation and efficient allocation of resources by authorities. The results of a national risk assessment, whatever its scope, can also provide useful information to financial institutions and designated non -financial businesses and professions

(DNFBPs) to support the conduct of their own risk assessments. Once ML/ TF risks are properly understood, country authorities may apply AML/CFT measures in a way that ensures they are commensurate with those risks – i.e,. the risk-based approach (RBA) – which is central to the FATF standards as is set out in Recommendation 1, its interpretive note (INR 1), as well as in other Recommendations (e.g., Recommendations 10, 26 and 28).

2. This document is intended to provide guidance on the conduct of risk assessment at the country or national level, and it relates especially to key requirements set out in Recommendation 1 and paragraphs 3-6 of INR 1. In particular, it outlines general principles that may serve as a useful framework in assessing ML/TF risks at the national level. The guidance contained in this document takes into consideration previous FATF work 1, which is still valid reference material . The general principles contained in this paper are also relevant when conducting risk assessments of a more

framework in assessing ML/TF risks at the national level. The guidance contained in this document takes into consideration previous FATF work 1, which is still valid reference material . The general principles contained in this paper are also relevant when conducting risk assessments of a more focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the securities sector) or of thematic issue s (for example, the proceeds of corruption related ML ). All of these types of assessments (comprehensive, sectoral or thematic) carried out at the national level may also form the basis for determining whether to apply enhanced or specific measures, simplified measures, or exemptions from AML/CFT requirements. Furthermore , while FATF Recommendation 1 does not create specific risk assessment obligations regarding the financing of proliferation of weapons of mass destruction, the general principles laid out in this guidance could also be used in conducting a risk assessment for this area.

3. The guidance in this document is not intended to explain how supervisors should assess risks in the context of risk-based supervision, although risk-based supervision will likely be informed by a national-level risk assessment. Also, this guidance does not provide further e xplanation of RBA obligations and decisions for financial institutions and DNFBPs. The FATF has issued separate

1 See bibliography for a list of relevant FATF work, national -level assessments available online and other relevant material. Annex III contains summaries of selected country-level assessment processes.National Money Laundering and Terrorist Financing Risk Assessment FATF Guidance  2013 5 guidance on implementing the RBA for specific sectors and professions 2, and that material will be reviewed and, as necessary, modified in light of the revised FATF Recommendations. This guidance document is not a standard and is therefore not intended to designate specific actions necessary to meet obligations under Recommendation 1 and INR 1 or any other Recommendations dealing with the RBA. Criteria for technical compliance and for assessing effectiveness relevant to this and all other FATF Recommendations may be found in the FATF assessment methodology. The

necessary to meet obligations under Recommendation 1 and INR 1 or any other Recommendations dealing with the RBA. Criteria for technical compliance and for assessing effectiveness relevant to this and all other FATF Recommendations may be found in the FATF assessment methodology. The practices described in this guidance are intended to serve as examples that may faci litate implementation of these obligations in a manner compatible with the FATF standards.

4. This guidance is structured as follows:  This section (1) lays out the purpose, scope and status of this guidance, along with an outline of the core FATF obligations relevant to ML/TF risk assessments at any level.  Section 2 lays out general principles that should be taken into account when conducting ML/TF risk assessments at the country or national level.  Section 3 discusses how to organise a national-level ML/TF risk assessment, its frequency, and the data and information that could be used while undertaking such an assessment.  Section 4 presents a high-level view of the three main stages involved in the ML/TF risk assessment process (identification, analysis and evaluation).  Section 5 considers the outcome and dissemination of the risk assessment product.  Annexes to this document contain additional information relating to ML/TF risk assessment including summaries of selected national-level assessments.

1.2 Core FATF obligations and decisions regarding ML/TF risk assessments

5. It is important that the users of this guidance have an understanding of the obligations contained in Recommendation 1 and its interpretive note. This section provides a general outline of these obligations. For more detail s, reference should b e made to the texts of Recommendation 1 and its interpretive note, as well as the FATF assessment methodology.3

6. Recommendation 1: The text of Recommendation 1 lays out a number of basic principles with regard to risk assessment. First, it calls on countries to “ identify, assess and understand ” the ML/TF risks they face, and states that countries should also designate “ an authority or mechanism

6. Recommendation 1: The text of Recommendation 1 lays out a number of basic principles with regard to risk assessment. First, it calls on countries to “ identify, assess and understand ” the ML/TF risks they face, and states that countries should also designate “ an authority or mechanism to co -ordinate actions to assess risks” . The goal of the s tandard is to ensure that countries can

2 Nine sectoral RBA guidance papers are available from the FATF websit e: www.fatf-gafi.org/. This guidance will be revised following adoption of the revised FATF Recommendations in February 2012. 3 See FATF website (www.fatf-gafi.org) for these texts.National Money Laundering and Terrorist Financing Risk Assessment FATF Guidance 6  2013 mitigate their ML/TF risks effectively, and the risk assessment is clearly intended to serve as the basis for application of the risk -based approach, i.e., “to ensure that measures … are commensurate with the risks i dentified.” The text of the Recommendation adds that the “[risk -based] approach” (and therefore the risk assessment process on which it is based) should also be “an essential foundation” in allocating AML/CFT resources efficiently. Furthermore , the Recom mendation indicates that risk assessments carried out by countries should be used for determining higher and lower risks that may then be addressed by applying enhanced measures or allowing simplified measures respectively. The Recommendation concludes by requiring that financial institutions and DNFBPs should also be able to identify, assess and take effective action to mitigate ML/TF risks.

7. Interpretive Note to Recommendation 1: INR 1 provides more details on the requirement for countries to assess their ML/TF risks and on the purposes for which such assessments may be used4. In particular, it emphasises that the objective of the risk -based approach is to ensure AML/CFT measures are commensurate with the “risks i dentified”, as well as to enable decision making on effective resource allocation. In elaborating on the specific obligations and decisions for

used4. In particular, it emphasises that the objective of the risk -based approach is to ensure AML/CFT measures are commensurate with the “risks i dentified”, as well as to enable decision making on effective resource allocation. In elaborating on the specific obligations and decisions for countries, INR 1 states that countries should take steps to identify and assess their ML/TF risks on an “ongoing basis.” The objectives of the process at the country level are: (1) to provide input for potential improvements to the AML/CFT regime, including through the formulation or calibration of national AML/CFT policies, (2) to help in prioritising and allocating AML/CFT resources by competent authorities, including through feeding into any risk assessments conducted by such competent authorities (e.g., supervisors) and (3) to feed into the AML/CFT risk assessments carried out by financial institutions and DNFBPs. The text of the interpretive note indicates that supervisors, in accordance with Recommendations 26 and 28, should review the risk assessments prepared by financial institutions and DNFBPs and take the result of that review into consideration in their supervision. The text of INR. 1 also adds that country-level risk assessments should be kept up-to-date, and appropriate information should be shared with all relevant competent authorities, self-regulatory bodies, financial institutions and DNFBPs.

8. In the cases of higher and lower risk determination, country-level risk assessments have very specific roles: Where countries identify higher risks, they should ensure that their AML/CFT regime addresses these risks. Where countries identify lower risks they may decide to allow simplified measures to be applied in relation to some of the FATF Recommendations. 1.3 Key concepts and terms relevant to ML/TF risk assessment

9. In discussing ML/TF risk assessment, it is useful to have a common understanding of certain key concepts and terms that will be used in this guidance . Many of these come from the area of risk management, a process commonly used in the public as well as the private sectors to help in

9. In discussing ML/TF risk assessment, it is useful to have a common understanding of certain key concepts and terms that will be used in this guidance . Many of these come from the area of risk management, a process commonly used in the public as well as the private sectors to help in decision-making. While many risk management concepts are usefully described elsewhere 5, their

4 Footnote 1 of INR. 1 specifically acknowledges that supranational risk assessments should be taken into account, where appropriate. It should be noted therefore that the general principles set out in this document that apply to risk assessments carried out by countries at a national level may also be appropriate to risk assessments carried out at a supra-national level. See Section 2 for further discussion of this issue. 5 See for example (2009a), ISO (2009b) and ISO (2009c) [see bibliography].National Money Laundering and Terrorist Financing Risk Assessment FATF Guidance  2013 7 use in this guidance has been adapted to the particular case of assessing ML/TF risk at the national level. Broadly speaking , however, risk management involves developing the appropriate measures to mitigate or reduce an assessed level of risk to a lower or acceptable level.

10. For the purposes of assessing ML/TF risk at the national level, this guidance uses the following key concepts:  Risk can be seen as a function of three factors: threat, vulnerability and consequence. An ML/TF risk assessment is a product or process based on a methodology, agreed by those parties involved, that attempts to identify, analyse and understand ML/TF risks and serves as a first step in addressing them. Ideally, a risk assessment, involves making judgments about threats, vulnerabilities and consequences, which are discussed below.  A threat is a person or group of people, object or activity with the potential to cause harm to, for example, the state, society, the economy, etc. In the ML/TF context this includes criminals, terrorist groups and their

vulnerabilities and consequences, which are discussed below.  A threat is a person or group of people, object or activity with the potential to cause harm to, for example, the state, society, the economy, etc. In the ML/TF context this includes criminals, terrorist groups and their facilitators, their funds, as well as past, present and future ML or TF activities. Threat is described above as one of the factors related to risk, and typically it serves as an essential starting point in developing an understanding of ML/TF risk. For this reason, having an understanding of the environment in which predicate offences are committed and the proceeds of crime are generated to identify their nature (and if possible the size or volume) is important in order to carry out an ML/TF risk assessment. In some instances, certain types of threat assessments might serve as a precursor for a ML/TF risk assessment.6  The concept of vulnerabilities as used in risk assessment comprises those things that can be exploited by the threat or that may support or facilitate its activities. In the ML/TF risk assessment context, looking at vulnerabilities as distinct from threat means focussing on, for example, the factors that represent weaknesses in AML/CFT systems or controls or certain features of a country. They may also include the features of a particular sector, a financial product or type of service that make them attractive for ML or TF purposes.  Consequence refers to the impact or harm that ML or TF may cause and includes the effect of the underlying criminal and terrorist activity on financial systems and institutions, as well as the economy and society more generally. The consequences of ML or TF may be short or long term in nature and also relate to populations, specific communities, the business environment, or national or international interests, as well as the reputation and attractiveness of a country’s financial sector. As stated above, ideally a risk assessment involves making judgments about threats, vulnerabilities

6 The United Nations Office on Drugs and Crime (UNODC) has published Guidance on the preparation and

environment, or national or international interests, as well as the reputation and attractiveness of a country’s financial sector. As stated above, ideally a risk assessment involves making judgments about threats, vulnerabilities

6 The United Nations Office on Drugs and Crime (UNODC) has published Guidance on the preparation and use of s erious and organised crime threat assessments (“The SOCTA Handbook”), which provides useful information on the conduct of national threat assessments related to serious and organised crime.National Money Laundering and Terrorist Financing Risk Assessment FATF Guidance 8  2013 and consequences. Given the challenges in determining or estimating the consequences of ML and TF it is accepted that incorporating consequence into risk assessments may not involve particularly sophisticated approaches, and that countries may instead opt to focus primarily on achieving a comprehensive understanding of their threats and vulnerabilities. The key is that the risk assessment adopts an approach that attempts to distinguish the extent of different risks to assist with prioritising mitigation efforts. 1.4 Users of ML/TF risk assessments

11. The form, scope and nature of ML/TF risk assessments should ultimately meet the needs of its users – whether these are policy makers, supervisors, operational agencies, financial institutions, DNFBPs, etc. The number and diversity of users of an assessment varies according to the purpose for which it is carried out; however, typical users of risk assessments might include:  Policy makers and other authorities, for example, in order to formulate the national AML/CFT policies, make reasonable decisions on the legal and regulatory framework and the allocation of resources to competent authorities on the basis of FATF Recommendation 2.  Operational agencies, including law enforcement, other investigative authorities, financial intelligence units (FIUs), relevant border agencies, etc.  Regulators, supervisors and self-regulatory bodies (SRBs).  Financial institutions, and designated non-financial businesses and professions (DNFBPs), for which the national-level ML/TF risk assessment is a critical source7 contributing to their own ML/TF risk assessments and

 Regulators, supervisors and self-regulatory bodies (SRBs).  Financial institutions, and designated non-financial businesses and professions (DNFBPs), for which the national-level ML/TF risk assessment is a critical source7 contributing to their own ML/TF risk assessments and risk-based obligations.  Non-profit organisations (NPOs).  AML/CFT assessors and assessment bodies more broadly, along with other international stakeholders.  The general public, as well as academia, specified individuals, etc.

7 According to the FATF standard, countries are expected to make appropriate information on the results of their national risk assessment available to financial institutions and DNFBPs for this purpose.National Money Laundering and Terrorist Financing Risk Assessment FATF Guidance  2013 9

2. GENERAL PRINCIPLES FOR NATIONAL ML/TF RISK ASSESSMENTS

12. The general principles set out below c ould be considered when a country intends to conduct any kind of ML/TF risk assessment. These include considerations on the purpose and scope of the assessment as well as the process through which an assessment will be conducted; t he stages of a risk assessment, the participants, users and other parties involved; the information which may be used, and the final outcome of the assessment process.

13. The nature, methodology, participants, and information required for an assessment depend on the purpose and scope of the assessment. There is no single or universal methodology for conducting an ML/TF risk assessment. Therefore, this guidance does not adv ocate the use of any particular methodology or process. This guidance is aimed to provide a generic description of the risk assessment process as it might be applied to looking at risk associated with ML/TF and considerations and practical tools for count ries to take into account when undertaking their own ML/TF risk assessment.8 2.1 Clear agreement on purpose

14. Before starting any kind of ML/TF risk assessment, all parties involved, including those who will conduct the assessment and, as appropriate, the eventual end users should be in agreement on

ML/TF risk assessment.8 2.1 Clear agreement on purpose

14. Before starting any kind of ML/TF risk assessment, all parties involved, including those who will conduct the assessment and, as appropriate, the eventual end users should be in agreement on the purpose and scope of the assessment . E xpectations should also be set as to how the results relate to the understanding of national-level risks. Generally, a ML/TF risk assessments is intended to help a country to identify, assess and ultimately understand the ML/TF risks it faces. A country may set out more concrete goals for a particular risk assessment however, such as informing the development of policy or the deployment of resources by supervisors, law enforcement and other competent authorities. Understanding the scale and impact of identified risks can also assist in determining the appropriate level and nature of AML/CFT controls applied to a particular pro duct or sector. Given the diversity of potential users and possible diverging expectations, it is essential at the outset that there be clarity about why an assessment is to be conducted, the questions it should answer, the criteria that will be used to answer those questions and the possible decisions that the assessment will feed into.

15. ML/TF risk assessments may be tied to strategic planning and linked to specific actions or decisions. For example, a national ML/TF risk assessment serves as input to a national AML/CFT strategy or policy as part of the country’s domestic AML/CFT co -ordination process. The purposes of the assessment will also vary according to the needs of the users. The purpose and scope of the assessment may also determine the methodology that is to be used.

8 Nonetheless, those involved carrying out a national ML/TF risk assessment may gain further insight into risk concepts, methodologies, processes, and tools from consulting any requirements of their own government relating to risk assessment or other material on risk management standards and associated publication s (see the bibliography at the end of this document for a list of some of these sources).National Money Laundering and Terrorist Financing Risk Assessment FATF Guidance 10  2013

relating to risk assessment or other material on risk management standards and associated publication s (see the bibliography at the end of this document for a list of some of these sources).National Money Laundering and Terrorist Financing Risk Assessment FATF Guidance 10  2013 2.2 Determining scope Money laundering and terrorist financing

16. A key consideration when deciding on the scope of an ML/TF risk assessment is to determine whether ML and TF risks should be assessed separately or together. Factors associated with TF that might need to be considered may be very different from those associated with ML. For example, funds used for financing of terrorist activities may be derived from criminal activity or legal sources.

In addition , a key focus in combating TF is on preventing future terrorist acts from occurring whereas with combating ML, the criminal activity (the predicate offence) has already taken pla ce. Another difference is that, transactions associated with TF may be conducted in very small amounts, which when not viewed in the TF context could be the very transactions that are frequently considered to involve minimal ML risk. Countries may therefo re choose to assess their ML and TF risks separately.9 National, supranational and sub-national risk assessments

17. As stated throughout this guidance, ML/TF r isk assessments may be undertaken at different levels and with differ ing purposes and scope, including supranational assessments (of a group of countries), national (or country level) assessments and sub -national assessments (of a particular sector, region, or operational function within a country) even though the basic obligation of assessing and understanding ML/TF risk rests on the country itself . In order to be of use in assessing and understanding national-level risks, it is helpful that assessments carried out at other levels relate to each other in a consistent way, although it is recognised that this may not be possible in all instances due to specific risks and the specific assessment approach undertaken. For example, the interplay between a national ML/TF assessment and specific