Geographic AML risk in a firm-wide risk assessment
A firm-wide risk assessment (FWRA) must show where the practice’s geographic exposure comes from across its client base. This includes the countries connected to the client’s business activities, ownership, and financial arrangements, as well as the locations that the practice operates.
In most cases, the geographic section of the FWRA can be organised around information already held in client records and known by engagement staff. This approach should, however, reflect the scale of the practice while still identifying overseas connections that could materially affect its overall risk profile.
Key takeaways
- Geographic exposure should not be assessed by reference to registered addresses alone.
- Material international links within the client relationship are the relevant AML focus.
- Current official information should inform the FWRA of higher-risk jurisdictions.
- The nature and concentration of AML exposure are more relevant than client numbers alone.
- The FWRA should record the evidence used and explain how the practice reached its overall conclusion.
- It should also be updated when country information, client activity, or the practice’s services change.
What does geographic AML risk mean at the firm-wide level?
An individual client risk assessment considers one relationship. The FWRA, however, considers the client population as a whole and the way the practice operates. As such, geography is one required factor in that assessment.
Relevant patterns can include geographic concentration or repeated cross-border activity within higher-risk work. Exposure outside the practice’s usual market can also carry greater uncertainty because staff have less knowledge of the commercial setting.
A mainly local client base, for instance, can still create international exposure where UK companies have overseas commercial or financial connections.
Equally, an overseas connection alone does not make the practice high risk. CCAB guidance expects the AML analysis to cover the practice’s overall client and market exposure, including factors that may reduce risk.
Geographic exposure across the client base and practice
The firm-wide risk assessment should start with the practice’s own geographic footprint, including where each client is formally based and where it conducts substantial business.
Significant concentrations within particular UK regions deserve consideration, since domestic areas vary in the forms of criminal exposure they present.
Practice-management data provides a starting point, not least because engagement partners might know that a nominally UK client depends heavily on another country.
Ownership, intermediary, and transaction links
The geographic scope should extend to material ownership, intermediary, and other business connections behind each relationship.
Regular cross-border payments are one indicator of material geographic exposure, where ICAEW’s methodology directs practices to consider wider commercial and operational connections. Moreover, HMRC highlights overseas supply-chain exposure and the location of key participants.
Information already available through the practice’s records and staff can support a usable overview of significant geographic links.
Higher-risk jurisdictions in geographic AML risk assessments
The UK treatment of high-risk jurisdictions has changed under the Money Laundering and Terrorist Financing (Amendment) Regulations 2026.
From 30 June 2026, automatic enhanced due diligence under Regulation 33 applies to business relationships or relevant transactions involving a person established in a FATF High-Risk Jurisdiction subject to a Call for Action.
FATF jurisdictions under increased monitoring should not be ignored, but they no longer create the same automatic Regulation 33 trigger. They remain relevant to the firm’s wider geographic risk assessment because they may still point to country risk, even where Regulation 33 is not automatically engaged.
Accountancy firms therefore need a reliable way to identify connections with FATF call-for-action jurisdictions, while also recording how wider country-risk indicators have been considered.
FATF lists are updated three times a year following plenary meetings, so an internal schedule can quickly become unreliable unless it is checked against current official publications.
At the practice level, the affected jurisdictions and services should be identified. Nationality or place of birth is an unsafe proxy, as the current rules use residence for individuals, while legal persons are assessed by their place of incorporation or principal place of business.
Additional geographic risk indicators beyond FATF lists
A country can increase risk without appearing on either FATF list. Relevant indicators include weak financial crime controls and severe instability or criminality. Financial secrecy and signs of opacity or illicit finance inform the geographic risk rating.
Sanctions-related restrictions or designations warrant checking for connected exposure, although sanctions compliance remains a separate legal workstream.
Proximity is relevant when a jurisdiction assessed as high risk has a credible business or financial link to the relationship.
Effective controls and reliable corporate transparency can support a lower assessment. Familiarity with a jurisdiction can help the practice manage the work, yet it cannot displace objective warning indicators.
Geographic exposure in the firm-wide AML risk profile
The country map should support a reasoned conclusion about the exposure’s overall pattern and significance.
The number or proportion of affected clients is useful, but volume alone can mislead. A few engagements with central connections to a materially higher-risk jurisdiction can carry more weight than numerous clients making routine, low-value purchases from well-understood markets.
Concentrated exposure is more likely to create dependence on particular controls than similar work distributed across experienced teams.
The AML assessment should also address how geography combines with structural complexity and other higher-risk features of the relationship.
The practice’s control framework should be tailored to the jurisdictions concerned and the services it provides.
It is also good practice when records set out the material exposure and its approximate prevalence, with a clear explanation of the rating and response. Do note that a numerical score can supplement the AML narrative but not replace it.
Evidence and review of the geographic AML assessment
Responsibility for ongoing monitoring of official country-risk information will usually sit with the money laundering reporting officer or compliance lead.
The record should note the sources used and the date of the check, and the geographic section should be reviewed during the scheduled FWRA.
Triggers can include changes in the practice’s work, such as a new cross-border service. Sufficient evidence should be retained for supervisory review, and informed senior management approval of the resulting position should be obtained.
In summary
Accountancy firms need a clear and current view of the countries that materially affect their AML risk. The FWRA should connect those exposures to the services provided and the controls used by the practice.
A concise written explanation, supported by reliable records and informed approval, gives staff a practical basis for applying the geographic risk assessment and demonstrates how the practice reached its conclusion.
FAQs
The analysis should consider each client’s base and the countries involved in its main commercial links. In that context, a UK client can still create overseas exposure through its ownership, trading activity, or regular movement of funds. Links substantial enough to affect the firm’s overall risk deserve priority over minor or occasional overseas contacts.
Yes. An accountancy firm with mostly local clients can still act for UK businesses with important links to other countries. For example, a client might rely heavily on an overseas market or have regular financial activity involving another jurisdiction. The firm-wide risk assessment should capture these wider connections when they form a meaningful part of the work, even when the clients themselves are registered in the UK.
Such a link should be considered in context. Its significance depends on the country involved, the strength of the connection, and the type of service the firm provides. A limited link to a familiar market can have little effect, whereas exposure centred on a country with serious financial crime concerns can be far more influential in the firm’s overall assessment.
Firms should check the current FATF public lists when assessing relevant country exposure. These lists change during the year, so an old internal copy might no longer be accurate. That check should establish whether any clients have a meaningful connection to a listed jurisdiction and how much of the firm’s work is affected. Nationality alone is not a reliable test of geographic exposure.
Client numbers provide useful context, although they do not tell the whole story. A small number of engagements can matter more if an international link is central to the client’s activities or appears alongside complex ownership or other factors that raise AML risk. Before an overall conclusion is reached, both the type of exposure and its concentration should be assessed.
It should be reviewed as part of the firm’s normal firm-wide AML assessment cycle and sooner when relevant circumstances change. Examples include updated official country information, a noticeable shift in the firm’s client base, or the introduction of new cross-border work. The firm’s record should cover the main exposure considered and the reasons for its conclusion.
References and Source Material
- Money Laundering Regulations 2017 (Regulations 18 and 33)
- Money Laundering Regulations (Amendment) Regulations 2026
- HMRC, Risks common to accountancy service providers
- CCAB, Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector
- ICAEW, Firm-wide risk assessment methodology
- HM Treasury, Money Laundering Advisory Notice: High Risk Third Countries
- HM Treasury, National Risk Assessment of Money Laundering and Terrorist Financing 2025
- Accountancy AML Supervisors Group, AASG Risk Outlook, September 2025
