FINANCE FINANCE EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Lessons Learned from the First Generation of Money Laundering and Terrorist Financing Risk Assessments Financial Stability and Integrity © 2023 International Bank for Reconstruction and Development / The World Bank 1818 H Street NW Washington DC 20433 Telephone: 202-473-1000 Internet: www.worldbank.org This work is a product of the staff of The World Bank with external contributions. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of The World Bank, its Board of Executive Directors, or the governments they represent. The World Bank does not guarantee the accuracy, completeness, or currency of the data included in this work and does not assume responsibility for any errors, omissions, or discrepancies in the information, or liability with respect to the use of or failure to use the information, methods, processes, or conclusions set forth. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. Nothing herein shall constitute or be construed or considered to be a limitation upon or waiver of the privileges and immunities of The World Bank, all of which are specifically reserved. Rights and Permissions The material in this work is subject to copyright. Because The World Bank encourages dissemination of its knowledge, this work may be reproduced, in whole or in part, for noncommercial purposes as long as full attribution to this work is given. Any queries on rights and licenses, including subsidiary rights, should be addressed to World Bank Publications, The World Bank Group, 1818 H Street NW, Washington, DC 20433, USA; fax: 202-522-2625; e-mail: pubrights@worldbank.org. Please cite the work as follows: Kuntay Celik. 2023. Lessons Learned from the First Generation of Money Laundering and Terrorist Financing Risk Assessments. Washington, DC: World Bank.]] Edited by: Publications Professionals LLC Cover and layout design: Diego Catto / www.diegocatto.com Acronyms AML anti-money laundering APG Asia/Pacific Group on Money Laundering BO beneficial ownership CFATF Caribbean Financial Action Task Force CFT countering the financing of terrorism CPF countering the financing of the proliferation [of weapons of mass destruction] DNFBPs designated nonfinancial businesses and professions EAG Eurasian Group ESAAMLG Eastern and Southern Africa Anti-Money Laundering Group FATF Financial Action Task Force FIs financial institutions FIU financial intelligence unit FSRBs FATF-style regional bodies GABAC Action Group against Money Laundering in Central Africa GAFILAT Financial Action Task Force of Latin America GDP gross domestic product GIABA Inter-Governmental Action Group against Money Laundering in West Africa IARM Identifying and Assessing the Risk of Money Laundering in Europe IMF International Monetary Fund IO Immediate Outcome [as in IO1] LEAs law enforcement agencies LP legal person MENAFATF Middle East and North Africa Financial Action Task Force MER mutual evaluation report ML money laundering MONEYVAL Committee of Experts on the Evaluation of AML/CFT NPOs nonprofit organizations NRA National Money Laundering and Terrorist Financing Risk Assessment NRA Tool National Money Laundering and Terrorist Financing Risk Assessment Tool PF proliferation financing RBA risk-based approach R Recommendation [e.g., R1] SAR special administrative region SRA sectoral or strategic risk assessments TF terrorist financing UNSCRs United Nations Security Council Resolutions VA virtual asset VASP virtual asset service provider Acknowledgments This research was led and the report was authored by Kuntay Celik, the coordinator of the World Bank Financial Market Stability and Integrity team’s technical assistance activities in national money laundering and terrorist financing risk assessments (NRAs). The core project team included Hasan Genc, who did the heavy lifting in reviewing mutual evaluation reports, collecting the study data, and organizing the study database. Salar Khan from George Mason University also joined the team briefly and supported the study in the application of statistical tools. The research benefited from experiences and inputs from the World Bank financial sector specialists who have led country-specific NRA projects since 2013, including Nigel Bartlett, Lisa Bostwick, Jean Pierre Brun, Matei Dohotaru, Yara Esquivel, Marilyne Goncalves, Tanjit Sandhu Kaur, Laura Pop, Klaudijo Stroligo, Emiko Todoroki, Emile Van Der Does De Willebois, Cari Votava, and Stuart Yikona. We also would like to recognize Selva Bazzana, Guillaume Herve Mathey, Samir Merghoub, Jacinta Oduor, Yee Man Yu, and the many other World Bank staff members and consultants who have contributed to the overall NRA experience of the World Bank. In addition, the author thanks Jean Pesme for his advice, which triggered this study, and Loic Chiquier and Emile Van Der Does De Willebois for their supervisory guidance during the project. Colleagues Keesook Viehweg and Victoria Taaka provided excellent and much-appreciated administrative support throughout the project. The author is also thankful to peer reviewers Joras Ferwerda (University of Utrecht); Nedko Krumov (Egmont Group); Michael Morantz, John Carlson, Katy Simpson, and Martin Lerossignol (Financial Action Task Force Secretariat); Steve Dawe and his colleagues (International Monetary Fund); Melissa Tullis (UN Office on Drugs and Crime); and Erik Feyen, Isaku Endo, and Nigel Bartlett (World Bank) for their thorough reviews. Their valuable comments helped us better organize the paper, sharpen key messages, and identify topics for further research. Although the findings in this report are an accumulation of inputs from a wide range of World Bank experts over several years, the report reflects the views of the author only. Any findings, interpretations, and recommendations in the report do not necessarily represent the views of the World Bank’s management, its Board of Directors, or the experts and reviewers who directly or indirectly contributed to this report. Contents Executive Summary 1 1. Introduction 5 Objective and Target Audience 5 Background 6 Risk-Based Approach in FATF Recommendations 6 What a National ML/TF Risk Assessment Is 7 Differences between National Risk Assessment and Mutual Evaluation 7 Literature Review 7 Methodology and Data Collection 8 2. Global State of Risk-Based Approach to AML/CFT after its first decade 11 In Progress, Uneven, and Yet to Be Effective 11 Risk Assessments Are Not Deep and Do Not Lead to Risk-Based Approaches 13 Progress in Risk-Based Approach at Sectors Is Limited 15 3. Lessons Learned from the National Risk Assessments That the World Bank Assisted 17 Some Overarching Recommendations for a High-Quality NRA 17 Do It for Your Own Good 17 Identify the Objective and the Target Audience Clearly 18 Identify the Right Person to Lead the NRA, and Invest in Leadership 19 Empower the Assessors 20 Recommendations for a Deeper Understanding of ML/TF Risks 21 See the Big Picture: Forest versus Trees 21 Invest in Data Collection and Academic Work 22 Make the Best Use of Feedback During and After the NRA 24 Recommendations for a Real Transition to Risk-Based Approach 25 Find Innovative and Country-Specific Solutions to Turn NRA Results into Risk-Based 25 Policies, Strategies, and Actions Establish a Culture of Risk-Based Approach 27 Be Flexible and Efficient in Reporting and Dissemination 29 4. Other Key Considerations Related to the Risk-Based Approach 30 The Impact of Capacity Constraints 30 Last-Minute National Risk Assessments 33 How Much Does the Risk Assessment Methodology Matter? 34 5. A Way Forward for the World Bank and Other International Stakeholders 36 A Way Forward for the World Bank’s Capacity-Building Program Related to NRAs 36 Recommendations for International Organizations, Technical Assistance Providers, and 37 Donors Other Research Topics That Emerged during the Study and Its Review 37 Appendixes 39 Appendix A. Financial Action Task Force Recommendation 1 39 Appendix B. Financial Action Task Force Immediate Outcome 1 Effectiveness 40 Assessment Criteria Appendix C. Key Differences between NRAs and Mutual Evaluations 42 Appendix D. NRA Survey Questions 43 Appendix E. Supplementary Tables and Figures 44 Appendix F. Perceptions Survey for National Risk Assessment Working Group Members 49 Appendix G. Responses to the Survey Question, “What Would You Do Differently in a 50 Future NRA?” (Unedited) Appendix H. Recommendation 33 Ratings and Data-and Statistics-Related Criticism in 53 Immediate Outcome 1 Appendix I. Excerpts from Mutual Evaluation Reports of Jurisdictions Commended for 54 Their Risk Assessments References 63 Figures Figure 1. Distribution of R1 (Technical Compliance) Ratings 12 Figure 2. Distribution of IO1 (Effectiveness) Ratings 12 Figure 3. Criticisms under Immediate Outcome 1, by Percentage of 146 Assessed 13 Jurisdictions Figure 4. Criticism on Risk-Based Approach at Various Sectors, as a Percentage of 15 Study Jurisdictions Figure 5. Impact of Deficiencies in ML/TF Risk Assessment of Legal Persons in IO1 16 and IO5, as a Percentage of Study Jurisdictions Figure 6. Distribution of IO1 Ratings, by Income Group 31 Figure 7. Most Significant Impediments to the Quality of ML/TF National Risk 32 Assessments, as a Percentage of All Responses Figure 8. Time between NRA Completion and Mutual Evaluation Team’s Onsite Visit 33 (Months) Figure 9. Frequency of Criticisms of FATF and FSRB Jurisdictions 35 Figure B.1. FATF High-Level Objective, Intermediate Outcomes, and Immediate 40 Outcomes for Effectiveness Figure E.1. Degree of Criticism Related to Immediate Outcome 1, by Number of 45 Countries Figure E.2. Criticism on the Risk-Based Approach in IO1, IO4, and IO5, as a 46 Percentage of the Assessed Jurisdictions Figure E.3. Spearman’s Correlations between Criticism Categories and IO1 47 Effectiveness Ratings Figure E.4. Number of NRAs Completed by Jurisdiction as of Mutual Evaluation 47 Onsite Visit Date Figure E.5. Frequency of NRA (in Jurisdictions with More than One NRA) 48 Figure E.6. Number of Jurisdictions That Received NRA Support from the World 48 Bank Figure E.7. Number of the World Bank’s NRA Engagements, by Region 48 Box Box 1. Isle of Man National Risk Assessment 20 Box 2. Elevator Pitch Exercise and Anonymous Perception Surveys 22 Box 3. FATF R33 on Statistics 23 Box 4. FATF R19 Higher-Risk Countries 26 Box 5. Suggested Steps to Determine Jurisdictions to Be Included in 26 Cross-Border Threat Analysis Box 6. Divisions Focusing on ML/TF Risks 28 Box 7. Jurisdictions Commended for the Strengths in Their Risk-Based Approach to 29 AML/CFT Tables Table 1. Issues Related to Risk-Based Approach (in IO1) in FSRBs 14 Table 2. Spearman’s Correlation Coefficients between World Bank Governance 31 Indicators and Indicators of Country Performance in the Risk-Based Approach Table E.1. Immediate Outcome 1 Ratings in FATF and FSRBs 44 Table E.2. Recommendation 1 Ratings in FATF and FSRBs 44 Table H.1. Discrepancies between Data-Related Issues in IO1 and R33 Ratings 53 Executive Summary Understanding and assessing risks related to the proceeds of crime, money laundering (ML), and terrorist financing (TF) and developing risk-based and effective measures to mitigate those risks are important for creating a stable and safe environment that enables economic development and shared prosperity. Development efforts can be effective only on a stable foundation that is safe from erosion by corruption, organized crime, and other security risks. This foundation is also essential to prevent the siphoning of valuable national resources in the form of illicit financial flows. Considering the importance of financial integrity as an enabler of development and shared prosperity, the World Bank, over the past decade, has developed a National ML/TF Risk Assessment (NRA) Toolkit and has supported 114 client jurisdictions in their ML/TF risk assessments using this toolkit. Those technical assistance activities have taught many lessons, most of which were integrated into the World Bank’s existing guidance and technical assistance material. This report brings together some lessons learned from the World Bank’s field experiences in supporting NRAs in a wide range of jurisdictions, with a perspective to guide World Bank client jurisdictions in undertaking more robust and in-depth risk assessments in the future. A more extensive understanding of risks is expected to lead to risk-based and more effective prevention and suppression measures against the proceeds of crime, money laundering, terrorist financing, and, subsequently, criminal and terrorist organizations reliant on these. 1 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Background depth and comprehensiveness of their understanding of ML/TF risks. In 44 percent of jurisdictions, issues related to the understanding of ML risks were serious and had explicit The Financial Action Task Force (FATF) is the international impacts on the ratings the jurisdiction received. The same organization that leads the global fight against money figure for the understanding of TF risks is 36 percent. laundering, terrorist financing, and proliferation financing. The FATF sets international policy standards on anti-money Most jurisdictions face challenges in the implementation of laundering (AML) and countering the financing of terrorism the risk-based approach. For example, almost 90 percent (CFT)—namely, its 40 Recommendations. The organization of jurisdictions were criticized, and ratings of 47 percent of also promotes and monitors global compliance with these them were explicitly affected owing to issues related to risk- standards. The World Bank is an observer member and close based national policies and strategies. Approximately 90 partner of the FATF. percent of the jurisdictions, regardless of their development levels, face problems related to the implementation of a risk- Since 2012, FATF Recommendations have adopted a risk- based approach, particularly by designated nonfinancial based approach to AML/CFT and require all jurisdictions businesses and professions (DNFBPs, such as company to assess and understand their ML and TF risks as a foundation and trust service providers, lawyers, real estate agents, and of this risk-based approach. In practice, a countrywide so on) and nonbank financial institutions. The global state assessment of the ML/TF risks is referred to as a National ML/ of implementation of the risk-based approach to legal TF Risk Assessment. NRAs are elaborate self-assessments persons—the Achilles’ heel of the global financial system involving various stakeholders from state authorities and the for financial crimes—is also concerning; 94 percent of all private sector and demonstrate a country’s understanding of jurisdictions have problems. In 56 percent, these problems risks associated with money laundering and terrorist financing were more serious and had explicit impacts on jurisdictions’ at the national level and in various sectors of the economy. ratings. Again, most of the jurisdictions that face serious issues are developing economies. The risk-based approach is also important from the financial inclusion perspective as an enabler of simplifications in low- Findings in this report also confirm a paradoxical situation risk financial transactions. If applied properly, a risk-based found by an earlier World Bank report on “The Impact of approach to AML/CFT is a well-balanced regime that supports the FATF Recommendations and Their Implementation the access of low-risk vulnerable populations to finance while on Financial Inclusion” (World Bank 2021): low-capacity preventing the abuse of the financial sector by criminals. jurisdictions that need simplifications and exemptions in their risk-based approach most to tackle their financial inclusion problems use these flexibilities much less often than developed jurisdictions do. Despite significant progress over the past decade, most developing econo- Considering this report’s findings and based on the World Bank Financial Market Integrity unit’s experiences during NRA mies are still in the infancy of their technical assistance activities, the study presents the following risk-based approaches to AML/CFT recommendations for the World Bank client jurisdictions. For a stocktaking of progress in the implementation of the Policy recommendations risk-based approach since its introduction in 2012, this study analyzed 146 Mutual Evaluation reports.1 The analysis shows that approximately 80 percent of developing economies have Overarching recommendations serious deficiencies in understanding their ML/TF risks and • Do it for your own good. Avoid seeing the process as a implementing risk-based approaches to AML/CFT. “checking the box” type of exercise to satisfy an external audience, particularly the FATF and the FATF-style regional In their mutual evaluation reports, more than 90 percent of bodies; rather, take advantage of this resource-intensive all jurisdictions received some sort of criticism about the effort to develop a real diagnosis and prognosis. 1 Mutual evaluations are external compliance evaluations of jurisdictions against the 40 Recommendations carried out by the FATF and its partner organizations. A mutual evaluation examines and rates the effectiveness of a risk-based approach in a jurisdiction among a broader set of AML/CFT measures. Mutual evaluations should not be confused with NRAs. Please refer to appendix C for a comparison of the two concepts. 2 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT • Identify the objective and the target audience clearly. • Establish a culture of risk-based approach. Consider Clearly identify the objective and the target audience and establishing a culture and permanent mechanisms and guide the NRA technical experts accordingly. units for assessing, understanding, and monitoring risks. • Find the right person to lead the NRA and invest in This will help build relevant expertise and human capacity leadership. Invest in good leadership to ensure success. as well as institutional memory to cope with evolving risks. Making an extra effort and a greater investment in leadership • Be flexible and efficient in reporting and dissemination. and coordination will save more costly resources along the Although it can have benefits, the publication of a risk way. Ensure high-level buy-in for the NRA process. assessment report is not the only and most effective way of • Empower the assessors. Authorize, support, and protect disseminating and communicating risk assessment results. the assessors. Treat them as doctors who are making Benefit from other dissemination tools such as sector- a diagnosis. The right diagnosis will lead to the right specific forums, training materials, focused briefs, and treatment. updates in red-flag indicators. Recommendations for more robust assess- ments and understanding of ML/TF risks A way forward for the • Do not miss the big picture. Adopt a holistic perspective World Bank’s NRA Program and be aware of biases and groupthink. Do not be distracted by the details of an assessment methodology. Balance the use of available quantitative and qualitative information and A survey done under the scope of this study questioned the employ review mechanisms to prevent myopia during the root causes of problems in NRAs. The biggest challenge risk assessment. appears to be the allocation of adequate resources, including • Invest in data collection and academic research. Rather human resources, for the assessment of the risks. Lack than relying on ad hoc efforts to collect data on ML/TF of knowledge and experience was also noted as a key risks, invest in data and information collection for the long challenge, confirming the need for continuing support for term, develop and use tools to this end, and educate the country NRAs. Additionally, interagency and public-private stakeholders about the value of the data. Engage academia coordination problems were among the main issues for many and invest in academic research on ML/TF risks. survey participants. The responses to another survey done by • Make the best use of feedback during and after the the project team show that challenges related to the gathering NRA. During the risk assessments, benefit from reviews of relevant and up-to-date data and information also limit the and feedback from external experts and academics. Test quality and depth of the risk assessments. the quality of your risk assessment before it is tested in a mutual evaluation. Get candid feedback from the audience A proper understanding of criminal proceeds and financial and consumers of the ML/TF risk assessments, including flows is a must for assessing money laundering risks. How- the private sector. ever, despite the rapid progress in information technologies and data science, many jurisdictions still have only limited Recommendations for turning the NRA results data and information as to the scale of the detected portion of into real risk-based approaches criminal proceeds and financial flows—the tip of the iceberg— • Find innovative and country-specific solutions to turn let alone the undetected bulk of the proceeds. NRA results into risk-based policies, strategies, and actions. An NRA is an expensive diagnosis exercise— The World Bank’s NRA technical assistance program has don’t waste it. Be ready to challenge and change the current reached 114 jurisdictions and more than 5,000 experts in these AML/CFT regulatory and institutional framework if it is not jurisdictions since 2013. Field experiences of World Bank risk based and effective. The risk-based approach comes project leaders and the feedback from jurisdictions that had with flexibility; take advantage of it. Rather than looking for received technical assistance show that this program has best practices, be the best practice yourself. played an important role in the FATF’s ongoing transition to a risk-based approach to AML/CFT, especially in developing jurisdictions. 3 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Regarding capacity building, many developing jurisdictions still Recommendations to international require at least partial assistance in future risk assessments, and only one-fifth of the participants feel confident conducting organizations, technical assistance future assessments without external support. This suggests providers, and donors that the demand for technical assistance on NRAs by the World Bank and other providers may continue in the coming years. However, going forward, World Bank management International organizations, technical assistance providers, may consider shifting the focus of NRA-related technical and donors may wish to consider assistance projects to more-specific areas highlighted in this analysis rather than supporting national risk assessments in • Further supporting the academic work on the proceeds their second rounds. The new focus can be on selective but of crimes and criminal financial flows and investing more in-depth global and country engagements, such as in independent research and data collection at the international and national levels, and • Supporting the development and implantation of risk- • Improving the guidance and facilitating the sharing of based national AML/CFT policies, strategies, actions, and best practices in the areas in which the jurisdictions are implementation of these; struggling most—notably, in deepening the understanding • Better data collection and analysis on the proceeds of of ML and TF risks, developing risk-based policies and crimes, and academic research that can support strategies, and effectively communicating risks to public understanding of the proceeds of crimes and their and private stakeholders. movement at the global level and in client jurisdictions; • Implementation of risk-based approaches to new technolo- Some more-specific suggestions for improvement and gies—including virtual assets—legal persons, company clarification of international standards and a list for possible and trust service providers, and other DNFBPs; and future research topics that emerged during this study are • Implementation of the risk-based approach in support of provided in the final chapter of the report. financial inclusion, including remittances, digital financial products, and merchant payments. 4 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT 1. Introduction Objective and Target Audience Understanding and assessing risks related to the proceeds of crime, money laundering (ML), and terrorist financing (TF) and developing risk-based and effective measures to mitigate those risks are important for creating a stable and safe environment that enables economic development and shared prosperity. Development efforts can be effective only on a stable foundation that is safe from erosion by corruption, organized crime, and other security risks. This foundation is also important for preventing the siphoning of valuable national resources through illicit financial flows. This report aims to guide the policy makers in World Bank client jurisdictions in continuously improving their assessments and understandings of money laundering and terrorist financing risks in their jurisdictions. To this end, the report attempts to draw lessons mainly from • • Observations and experiences from more than 100 World Bank technical assistance projects that supported client jurisdictions’ National ML/TF Risk Assessments (NRAs) and An analysis of feedback on NRAs in 146 mutual evaluations conducted by the Financial Action Task Force (FATF) and FATF-style regional bodies (FSRBs), the International Monetary Fund (IMF), and the World Bank. In addition to country authorities, the target audience includes the FATF and FSRBs, other relevant international organizations and technical assistance providers, and academia. One of the objectives of the study was to establish a public database that can be leveraged for other studies and research in the field. This study does not aim to review the NRAs themselves or do quality control of NRAs in study jurisdictions. Rather it assumes that the feedback in mutual evaluation reports on NRAs, which are also the basis for the country ratings, are valid. Also, the study does not aim to examine the accuracy and efficiency of methodologies and conceptual frameworks used for NRAs. Although all these topics are important, they are not in the scope of this study and require further research supported by additional resources. 5 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Background Risk-Based Approach in addition to this general requirement, Recommendations 8, 15, FATF Recommendations and 24 contain more-specific requirements to assess ML/TF The FATF, an intergovernmental organization founded in risks. Recommendation 8 and its interpretative note require 1989, leads the global fight against money laundering, countries to assess TF risks that nonprofit organizations terrorist financing, and proliferation financing. The FATF (NPOs) are subject to and apply risk-based mitigation sets international policy standards on anti-money laundering measures. Recommendation 15 requires assessment of (AML), countering the financing of terrorism (CFT), and money laundering and terrorist financing risks posed by new countering proliferation financing (CPF),2 namely, the FATF technologies and their providers, including virtual asset service 40 Recommendations. The FATF guides countries worldwide providers (VASPs). Recommendation 24 (on transparency in complying with these recommendations and monitors their and beneficial ownership of legal persons) contains a specific compliance with these standards (including their effectiveness), provision that requires countries to assess the risks of misuse which are formulated as 11 Immediate Outcomes (IOs).3 of legal persons for money laundering or terrorist financing. FATF Recommendation 1 (R1) requires countries to under- In the FATF’s assessment methodology, Immediate Outcome stand their money laundering, terrorist financing, and prolif- 1 (IO1) defines characteristics of an effective risk-based eration financing risks and to apply a risk-based approach approach and contains the criteria to assess this effectiveness (RBA) to AML/CFT/CPF. This approach is defined in R1 and (appendix B). As of the date of this study, mutual evaluation woven into other recommendations, including Recommenda- reports (MERs) of 146 jurisdictions were officially completed tion 2 (on national coordination and cooperation), Recommen- and adopted. Relevant sections of all these reports were dation 10 (on customer due diligence), Recommendation 26 included in the analysis. The analysis of MERs focuses mainly (on regulation and supervision of financial institutions), and on issues in the quality of ML/TF risk assessments that are many others. Because of its cascading impact on many other covered under the assessments of IO1. The study includes recommendations, R1 is of key importance. some limited analyses of the RBA-related components of IO4 (on the effectiveness of preventive measures by reporting R1 provides an overarching requirement to assess and entities) and IO5 (on the effectiveness of measures to prevent understand the risks at the national level as well as the risks the misuse of legal persons and arrangements). IO3 on for financial institutions (FIs) and designated nonfinancial supervision also has risk-based components but has not been businesses and professions (DNFBPs) (appendix A). In included in this analysis mainly because of resource and time constraints. 2 Proliferation financing (PF) refers to implementation of financial provisions of the United Nations Security Council resolutions to counter the proliferation of weapons of mass destruction. Because PF risk assessment was added to FATF Recommendation 1 very recently (in 2022), it was not included in the NRAs and mutual evaluations analyzed in this study. Therefore, this report does not contain any references to PF and CPF except in this introductory chapter. 3 Quoted with adjustments from Celik et al. (2020). 6 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT What a National ML/TF Risk Assessment Is effectiveness assessment conducted by the FATF, FSRBs, IMF, A National ML/TF Risk Assessment is an organized process and World Bank. A mutual evaluation assesses a jurisdiction’s for assessing the ML/TF risks at a national level and in various compliance and effectiveness on all 40 Recommendations sectors that are gatekeepers of the economy and financial and 11 Immediate Outcomes, and it contains, but is not limited system of a jurisdiction. Usually, these assessments are to, R1 on understanding risks and applying an RBA. conducted with the involvement and input of a wide range of stakeholders in the jurisdiction, including financial intelligence The National ML/TF Risk Assessment in a jurisdiction and units (FIUs), law enforcement agencies (LEAs), prosecution updates—as necessary—should be done before the mutual and judicial authorities, national intelligence agencies, evaluation of a country. Please refer to appendix C for a financial and DNFBPs supervision authorities, customs and comparison of an NRA and a mutual evaluation. tax authorities, and statistics agencies. Generally, the private sector also is included in the NRA process. During a mutual evaluation, external assessors evaluate the technical compliance of a jurisdiction with all 40 In February 2013, the FATF published its guidance on Recommendations as well as the effectiveness of a National ML/TF Risk Assessments (FATF 2013). In line with jurisdiction’s AML/CFT regime, which is formulated as 11 its objective, the guidance was principle based and did not Immediate Outcomes. The range of technical compliance prescribe or define any methodology for the assessment of ratings include noncompliant (NC), partially compliant (PC), ML/TF risks.4 largely compliant (LC), and compliant (C). Effectiveness can be rated as low effectiveness (LE), moderate effectiveness To support its clients in their compliance with international (ME), substantial effectiveness (SE), and high effectiveness standards, the World Bank developed a National Money (HE). NC and PC in technical compliance, and LE and ME Laundering and Terrorist Financing Risk Assessment Tool (NRA in effectiveness assessment have negative implications, Tool). Since 2012, the World Bank has provided training and because certain numbers in those categories may lead to guidance to support 114 client jurisdictions on how to use this enhanced follow-up and gray listing of jurisdictions. LC and C tool to conduct their NRAs. These technical assistance activities in technical compliance and SE and HE in effectiveness are provided many lessons, most of which were integrated into later good ratings that are favorable for jurisdictions. NRA projects by the World Bank technical teams. FATF standards are not prescriptive about the need for Literature Review an NRA; the assessment can be completed through other comprehensive approaches. Most jurisdictions preferred to The FATF began requiring the risk-based approach to AML/ conduct a single NRA, but some produced separate NRAs CFT in 2012. The assessment criteria to be used during mutual of ML and TF. Others assessed risks using a sector-by- evaluations to examine the quality of a jurisdiction’s risk-based sector approach over time rather than implementing a single approach are defined in Methodology for Assessing Compliance workstream at the national level by conducting an NRA. with the FATF Recommendations and the Effectiveness of These alternative approaches also comply with R1, which AML/CFT Systems (FATF 2021). The FATF also published requires assessing and understanding risks, not necessarily two other documents to guide jurisdictions in assessing ML/ conducting an NRA. TF risks: FATF Guidance: National Money Laundering and Terrorist Financing Risk Assessment (FATF 2013) and Terrorist Differences between National Risk Financing Risk Assessment Guidance (FATF 2019). In the Assessment and Mutual Evaluation current round of mutual evaluations, as of the study date, For readers of this report who may be unfamiliar with the AML/ assessor organizations had published 147 mutual evaluation CFT literature, it is important to distinguish between two key reports, 146 of which were included in this study. concepts that are related but different: (a) National ML/TF Risk Assessments, and (b) mutual evaluations. Both concepts In April 2022, the FATF published a study titled Report on frequently are referred to as “assessments,” which can be the State of Effectiveness and Compliance with the FATF confusing. To clarify, a national risk assessment is a self- Standards (FATF 2022). That report relies on fourth-round assessment conducted by a jurisdiction to comply mainly with MERs, as does this study, and draws various conclusions FATF R1; a mutual evaluation is an external compliance and about the strengths and weaknesses of jurisdictions’ AML/ 4 Celik et al. (2020). 7 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT CFT regimes using a holistic approach based mainly on the Methodology and Data Collection technical compliance and effectiveness ratings of jurisdictions. The first chapter of the report, “Assessment of Risk, Coordination and Policy Setting,” focuses on analysis For this analysis, the project team reviewed 146 MERs of compliance with R1 and IO1 and uses the related data in that were completed and published under the 2012 FATF MERs. Recommendations and assessment methodology. The analysis focuses on the assessments of the risk-based The World Bank also conducted a holistic review of MERs, approach to AML/CFT, particularly R1 and IO1, which are with specific focus on implementation of a risk-based approach directly related to the understanding and assessment of in the context of financial inclusion: “The Impact of the FATF risks and implementation of an RBA at the national level. Recommendations and Their Implementation on Financial The analysis also covers the risk-based components of IO4 Inclusion” Celik (2021). This report finds that, paradoxically, and IO5, to a more limited extent. The analysis is based on low-capacity countries that are most in need of RBA to tackle the MERs but does not include the follow-up reports; thus, the financial inclusion problems use RBA the least. analysis does not consider developments that occurred after the MERs’ dates. The current study follows a methodology similar to FATF (2022) and (Celik 2021) and attempts to draw some lessons The main research questions are these: based on a holistic review of MERs as well as field experiences from the World Bank’s NRA projects. Unlike FATF 2022, this • Why are countries being criticized for their risk-based report attempts a more in-depth analysis of IO1 and risk- approach to AML/CFT, and what are the impacts of these related components of IO4 and IO5 in MERs by reviewing and criticisms on their relevant ratings? quantifying the information in the discussions of core issues • What lessons can be drawn from the World Bank Financial and in justifications of effectiveness ratings. Market Integrity team’s field experiences to guide client countries to a deeper and more accurate understanding of In addition to those publications, which are based on holistic their risks and more-robust risk-based approaches to AML/ reviews of MERs, academic studies have aimed at contributing CFT? to national or supranational risk novel approaches to assessing ML/TF risks or examining the quality and accuracy of selected In addition to utilizing the jurisdiction ratings, which are countries’ national risk assessments. For example, in publicly available at the FATF’s website,5 this study attempts “National Assessments of Money Laundering Risks: Learning to further break down these ratings into their component parts. from Eight Advanced Countries’ NRAs,” Joras Ferwerda and These components—formulated as criticism categories—are Peter Reuter (2022) criticize the NRA methodologies of study linked to the assessment criteria described in the FATF’s countries because the NRAs generally relied on not-well- assessment methodology but are not necessarily mapped to established “expert opinions” instead of quantitative data; the the criteria on an item-by-item basis. Criticism related mainly suspicious transaction reports were misinterpreted; and the to Immediate Outcome 1 and risk-related components of risk assessments could not produce a viable output for the Immediate Outcomes 4 and 5 in MERs was examined. governments. In another study, Ferwerda and Reuter examine the NRAs of Italy and Switzerland (Ferwerda and Reuter 2019) “Criticism” refers to negative remarks and feedback in the from a similar point of view. report; comments and findings on gaps, inefficiencies, and problems are included. Mutual evaluation reports have Michael Levi, Peter Reuter, and Terence Halliday also standard outlines structured around immediate outcomes. analyzed some countries’ MERs and NRA reports: “Can the The assessment of each immediate outcome contains a AML System Be Evaluated without Better Data?” (2018) discussion of assessment criteria, recommended actions to emphasizes the importance of data in the development of address the identified issues, the immediate outcome rating, national policies for AML regimes. and a brief section explaining the reasoning of the assigned rating. The degree of criticism is based mainly on how an This study differs from these academic reports in that it does issue was covered in these sections. not attempt to examine possible conceptual or methodological issues related to NRAs. 5 https://www.fatf-gafi.org/en/publications/Mutualevaluations/Assessment-ratings.html 8 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT For quantification, the intensity of criticism in each category for countries with FSRB-only countries, since there may be each jurisdiction is scored as follows: visible differences between these two main groups. The latter is dominated by developing jurisdictions. Therefore, although • 1: Lighter Criticism (compared to other two categories): not precise, the figures for the FSRB group constitute a proxy Criticisms in the MER for these factors are limited and are of for developing countries. In such analyses, countries that are a more commentary nature. The assessors criticized these members of both the FATF and one or more FSRBs were factors but did not cite them directly in their justification of counted as FATF only and were not included in the statistics the rating or in recommended actions. of FSRBs. • 2: Moderate Criticism: Assessors criticized these factors repeatedly in the MER and/or covered them in recommended The observations on the World Bank experiences belong actions but did not cite them explicitly and directly among the mainly to the author. Also, under the scope of this project a reasons for the ratings assigned to the jurisdiction. workshop was organized with the participation of the World • 3: Strong Criticism: Deficiencies and problems affected Bank staff who led the country-specific NRA projects, to the assessors’ rating of a jurisdiction in an explicit and direct incorporate their inputs in the study. Some of these experiences way, meaning the assessors cited them among the reasons have already been incorporated in the World Bank’s NRA that prevented a higher rating for a specific jurisdiction. guidance material by the Financial Market Integrity team throughout the technical assistance activities. In the following sections, references to an impact on rating mean a direct and explicit impact as defined in 3: Strong Under the scope of this study, the study team conducted Criticism. This impact may have happened during either the two surveys through electronic polling on the margins of assessment or the review stage, before the official release of two separate NRA-related training/dissemination events, the mutual evaluation report. considering the participants at these events were technical experts who took part or expected to take part in NRAs in a Despite this framework and corresponding criteria for diverse range of countries. The inputs from these surveys have categorization, in some cases the decision as to which of the been incorporated in the report to complement the analysis. three categories a specific criticism in a MER would fall into One survey (NRA Survey 1) drew the participation of more was not straightforward. In such cases, interpretation by the than 250 officials from more than 60 countries. Another survey project team was necessary, a requirement which added a (NRA Survey 2) drew about 170 experts from 48 countries. degree of subjectivity to the analysis. Most participants in these surveys were from World Bank client countries that are FSRB members. Survey questions In addition, although the criticisms were scored and organized are in appendix D. in three categories in the study database, most of the charts in the report use a more simplified representation that compares The risk assessment and a risk-based approach related to “Strong Criticism” figures with “Total Criticism.” The latter proliferation financing were not included in this study, since contains all criticisms in categories 1, 2, and 3. they were added to R1 and relevant to IOs only very recently.  In various analyses, the study compared the figures of FATF 9 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT 2. Global State of Risk-Based Approach to AML/CFT after Its First Decade In Progress, Uneven, and Yet to Be Effective Figures 1 and 2 present the most up-to-date status of technical compliance (with R1) and effectiveness (IO1) based on MERs of 146 jurisdictions. FATF countries perform better on both effectiveness and technical compliance ratings. While a majority of FATF countries are rated as substantially effective in IO1, FSRBs show flatter distributions that center around moderate effectiveness. In FSRBs, more than 30 percent of the countries still exhibit low-level effectiveness. A more granular analysis of FSRBs shows that the average rating is heavily affected by widespread effectiveness issues among sub-Saharan FSRB members (appendix E). 11 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > FIGURE 1. Distribution of R1 (Technical Compliance) Ratings 100% 90% Percentage of jurisdictions 80% 70% 60% 50% 40% 30% 20% 10% 0% Compliant Largely Partially Noncompliant compliant compliant FATF FSRBs Source: Data compiled from Financial Action Task Force website (June 2023). Note: FATF = Financial Action Task Force; FSRBs = FATF-style regional bodies. > > > F I G U R E 2 . Distribution of IO1 (Effectiveness) Ratings 100% 90% Percentage of jurisdictions 80% 70% 60% 50% 40% 30% 20% 10% 0% High Substantial Moderate Low effectiveness effectiveness effectiveness effectiveness FATF FSRBs Source: Data compiled from Financial Action Task Force website (June 2023). Note: FATF = Financial Action Task Force; FSRBs = FATF-style regional bodies. 12 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Risk Assessments Are Not Deep and Do Not Lead to Risk-Based Approaches In MERs, the project team investigated the criticisms related did affect ratings are labeled as strong criticism pursuant to to assessing and understanding ML/TF risks. Some of these the methodology explained in the introduction of this report. criticisms had direct and explicit effects on the ratings of Figure 3 summarizes the results of this analysis. A more detailed some jurisdictions while others did not. The criticisms that version of this analysis appears in appendix E, figure E.1. > > > F I G U R E 3 . Criticisms under Immediate Outcome 1, by Percentage of 146 Assessed Jurisdictions Percentage of study jurisdictions 0% 20% 40% 60% 80% 100% NRA has not been completed. NRA is not up-to-date. Understanding of ML risks is not deep enough. Understanding of the TF risks is not deep enough. Overall ML risk level is not justified. Overall TF risk level is not justified. National policies and/or strategies are not risk based. Exemptions or simplifications are not risk based. Problems in dissemination/communication of the NRA results. Deficiencies in data and statistics to support the NRA. Absence of or deficiencies in NPO risk assessment. Absence of or deficiencies in legal persons risk assessment. Criticism on methodological issues. Strong criticism (which explicitly affected the rating) Total (strong, moderate, or light) criticism Source: Study data based on mutual evaluation reports. Note: ML = money laundering; NPO = nonprofit organization; NRA = national risk assessment; TF = terrorist financing. 13 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT This analysis required quantification of the information in Of the 146 jurisdictions that have had mutual evaluations, 95 the MERs, since the assessment criteria are individually percent have received some sort of criticism related to the depth discussed in the reports but not rated. Rather, the rating is and comprehensiveness of their assessments, and the ratings of assigned by the assessors based on the overall weight of the 44 percent were affected for the same reason. In another striking substantive issues. As explained in the methodology section, figure, 89 percent of all countries were criticized to some degree, the team identified possible reasons that may affect IO1 on the and ratings of 47 percent were directly affected owing to the lack effectiveness of the RBA and examined whether the countries of risk-based national policies and strategies. Indeed, this is the were criticized for any of those reasons. If they were, the most common factor that affected IO1 ratings directly.6 degree of criticism was rated from one to three according to its impact on the mutual evaluation results. The objective was Table 1 shows the average degree of criticism in FATF and to understand the most common challenges countries face. FSRBs on a 0–3 scale. The problems seem more intense in The analysis shows that the most substantial and widespread sub-Saharan FSRBs. The Financial Action Task Force of Latin deficiencies concern the depth of understanding and analysis America (GAFILAT) and the Eurasian Group on combating of ML and TF risks and countries’ ability to convert these risk money laundering and financing of terrorism (EAG), among assessments into risk-based national policies and strategies. FSRBs, have a relatively good outlook. > > > TA B L E 1 . Issues Related to Risk-Based Approach (in IO1) in FSRBs MONEYVAL MENAFATF ESAAMLG OVERALL GAFILAT GABAC Degree of criticism in the FATF and FSRBs CFATF GIABA FATF APG EAG Understanding of ML risks is not deep enough. 2.5 2.1 2.0 2.4 1.7 2.7 1.9 2.4 2.5 2.4 2.2 National policies and/or strategies are not risk based. 2.2 2.4 1.3 2.7 1.7 2.7 2.0 2.6 2.4 1.9 2.1 Understanding of TF risks is not deep enough. 1.8 2.4 1.5 2.6 1.0 2.7 1.8 2.3 1.9 2.1 1.9 Problems in dissemination/communication of the NRA results. 1.8 1.9 0.8 1.9 1.0 3.0 0.5 2.2 1.9 1.1 1.4 Problems in data and statistics to support understanding of risks. 1.1 1.3 1.5 0.8 1.0 2.7 1.4 2.5 1.5 1.2 1.3 Exemptions or simplifications not risk based. 0.6 0.7 0.5 0.4 0.8 0.3 0.4 0.6 0.4 0.8 0.6 Absence of or deficiencies in legal persons risk assessment. 0.7 0.6 0.5 0.6 0.4 0.3 0.1 0.7 0.3 0.7 0.5 NRA is not up-to-date. 0.4 0.9 0.5 1.0 0.2 0.3 0.3 0.5 0.9 0.2 0.4 Absence of or deficiencies in NPO risk assessment. 0.5 0.5 1.0 0.5 0.3 0.3 0.2 0.8 0.5 0.5 0.4 Overall TF risk in the NRA is not justified. 0.5 0.6 0.8 0.5 0.1 0.7 0.5 0.8 0.1 0.4 0.4 Criticism on methodological issues. 0.2 0.2 0.5 0.1 0.7 0.3 0.2 0.8 0.0 0.4 0.4 An NRA has not been completed yet. 0.3 0.7 0.0 1.4 0.0 0.7 0.0 0.3 1.0 0.0 0.3 Overall ML risk in NRA not justified. 0.1 0.0 0.0 0.0 0.1 0.0 0.2 0.3 0.1 0.1 0.1 Source: Study data based on mutual evaluation reports. Note: The scores in the table are based on the mean of all countries in the FATF or an FSRB. The scale for the degree of criticism is 0.0 (lowest) to 3.0 (highest). ML = money laundering; TF = terrorist financing; NRA = National ML/TF Risk Assessment; NPO = nonprofit organization; APG = Asia/Pacific Group on Money Laundering; CFATF = Caribbean Financial Action Task Force; EAG = Eurasian Group; ESAAMLG = Eastern and Southern Africa Anti-Money Laundering Group; FATF = Financial Action Task Force; FSRBs = FATF-style regional bodies; GABAC = Action Group against Money Laundering in Central Africa; GAFILAT = Fi- nancial Action Task Force of Latin America; GIABA = Inter-Governmental Action Group against Money Laundering in West Africa; MENAFATF =Middle East and North Africa Financial Action Task Force; MONEYVAL = Committee of Experts on the Evaluation of AML/CFT. The study team also ran a Spearman’s correlation analysis between the IO1 ratings and criticisms in different categories. The results for individual categories are summarized in appendix E, figure E.3. There is a −0.68 (Spearman’s) correlation between IO1 scores and the problems related to risk-based national policies and strategies. In addition to deficiencies related to that issue and the depth of ML/TF risk assessments, IO1 results are also highly correlated with problems in the dissemination and communication of NRA results (correlation value = −0.54 and is statistically significant at 95 percent significance level). 6 A strong negative Spearman’s correlation (rho value = −0.68 at p-value = 0.0001) suggests that IO1 effectiveness is strongly and negatively associated with the lack of risk-based national policies and strategies.. 14 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Progress in Risk-Based Approach at Sectors Is Limited As discussed in the introductory section of this report, the scope based approach to ML/TF by financial institutions and of the risk-based approach in the FATF Recommendations designated nonfinancial businesses and professionals, and and assessment criteria is broader than R1 and IO1. The the application of the risk-based approach to legal persons study team attempted to expand the analysis to risk-based (LPs).7 Figure 4 shows the results of this analysis. components of IO4 and IO5 to capture the status of a risk- > > > F I G U R E 4 . Criticism on Risk-Based Approach at Various Sectors, as a Percentage of Study Jurisdictions Percentage of study jurisdictions 0% 20% 40% 60% 80% 100% 56% Absence of or deficiencies in LP risk assessments. 94% 84% DNFBPs do not apply risk-based approaches. 99% 61% DNFBPs do not assess/understand their risks. 99% Nonbank FIs do not apply risk-based approaches. 40% 99% 24% Nonbank FIs do not assess/understand their risks. 97% 13% Banks do not apply risk-based approaches. 73% 5% Banks do not assess/understand their risks. 58% Strong criticism (which explicitly affected the rating) Total (strong, moderate, or light) criticism Source: Study data based on mutual evaluation reports. Note: Nonbank FIs = nonbank financial institutions; DNFBPs = designated nonfinancial businesses and professions; LP = legal person. 7 In the FATF Recommendations, “legal persons” refers to any entities other than natural persons that can establish a permanent customer relationship with a financial institution or otherwise own property. This can include companies, corporate bodies, foundations, anstalt, partnerships, or associations and other relevantly similar entities. 15 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Problems related to the ML/TF risk assessment of LPs seem to IO5, thus causing discrepancies in the assessments of widespread. During the assessment process, 94 percent of different jurisdictions. More guidance by the FATF for assessors jurisdictions were criticized, and ratings of 56 percent were could help reduce possible confusions and inconsistencies in directly affected by deficiencies in this area. Figure 5 shows this regard. a more granular analysis related to assessors’ handling of LP risk assessments. Interestingly, the ratings of 23 percent The FATF and technical assistance providers may consider of jurisdictions were impacted directly in both IO1 and IO5 improving guidance and facilitating the sharing of best owing to the lack of or deficiencies in the risk assessment of practices in the areas where jurisdictions are struggling most, LPs, whereas ratings of 33 percent were affected only in IO5. notably in developing risk-based policies and strategies, These results may indicate an issue regarding handling of LP deepening the understanding of risks, and effectively risk assessments by evaluators during the mutual evaluations. communicating risks to relevant stakeholders. Academic work Evaluators may not be fully clear about whether deficiencies should be better leveraged for a deeper understanding of in LP risk assessment should be considered in IO1 in addition risks, at both international and national levels. > > > F I G U R E 5 . Impact of Deficiencies in ML/TF Risk Assessment of Legal Persons in IO1 and IO5, as a Percentage of Study Jurisdictions 6% Criticism with no direct impact on the rating No criticism 38% 23% Direct impact on both IO1 and IO5 Direct impact on rating only in IO5 33% Source: Study data based on mutual evaluation reports. Note: ML = money laundering; TF = terrorist financing; IO1 = Immediate Outcome 1; IO5 = Immediate Outcome 5. 16 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT 3. Lessons Learned from the National Risk Assessments That the World Bank Assisted Some Overarching Recommendations for a High-Quality NRA Do It for Your Own Good While assessing the ML/TF risks, any country should make its first priority the safety and security of the country and its citizens against money laundering and terrorist financing, and eventually against the criminal organizations and the terrorist entities relying on these criminal funds. The experts who lead and undertake the risk assessment should understand and believe that this assessment will improve the efficiency of the mechanisms that fight criminal money and financial flows and ultimately help suppress corruption, fraud, drug trafficking, terrorism, and other serious crimes and contribute to a safer, more just, and more prosperous country. This understanding and motivation will lead to a real assessment and real solutions that go beyond just checking a box. Thus, satisfying the FATF or FSRB assessors and the international community should not be the main concern of an NRA. This point does not contradict the fact that the assessment is required by the FATF standards and that the FATF/FSRB mutual evaluation assessors are a de facto audience. Accommodating them is a complementary goal. The sincerity and motivation of the government is a significant factor that will support the quality of the NRA and the effectiveness of recommended actions. Conversely, the FATF and FSRBs should train their assessors to appreciate and consider the motivation and sincere effort of the country as an important factor in reaching their ratings. In other words, transparency of a jurisdiction about their risks should be considered as a positive factor in deciding the ratings. Assessing ML/TF risks is a complicated task that demands considerable time, effort, and human and other resources. For any country to waste these valuable resources without meaningful benefit in the day-to-day life of its citizens would be unfortunate. For real change to occur, the value given to the NRA by policy makers, the right training and motivation of the experts who take part in the assessment, and their empowerment by governments are fundamental. 17 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Identify the Objective and Identifying the target outputs under the NRA and how they the Target Audience Clearly will feed into the objective can also provide guidance to the The objective and target audience should function as a NRA leadership and working group. These outputs can be guideline for the right alignment of the entire NRA process. defined for each subcomponent of the risk assessment, such The objective, expected outputs, and target audience should as threats, vulnerabilities, or specific sectors. be identified clearly at the planning stage and communicated to the experts who will carry out the exercise. Leaders must remember that the objective may not be fully Indeed, the main objective of the NRA is defined by the clear to some experts participating in NRAs. Even if some FATF standards themselves and can be summarized as experts are more familiar with AML/CFT and risk assessment understanding the ML/TF risks to inform a risk-based approach or were involved in past risk assessments, in most cases there to AML/CFT at all levels, including the national, sectoral, will be newcomers to the NRA exercise. In particular, experts and institutional levels. This scope is the minimum that is from agencies other than the financial intelligence units and mandated by international standards. However, a country similar authorities directly responsible for AML/CFT may not may find synergies between the ML/TF risk assessment be aware of basic AML/CFT concepts, let alone the objective and other policy objectives and may decide to expand the of an NRA. Therefore, it is important for the leadership of an objective to other relevant fields, such as illicit financial flows, NRA to understand the background and knowledge level of the anticorruption, bilateral sanctions, financial inclusion, and so experts who are involved in NRAs and to guide and support on. However, these activities should not dilute the focus on them accordingly. In this regard, a refresher training on the the main objective. risk-based approach to AML/CFT at the beginning of the NRA process is a good practice. 18 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Another important consideration is the target audience. Identify the Right Person to Lead Although not explicitly listed by the FATF, the minimum the NRA, and Invest in Leadership target audience can be inferred from the recommendations Assigning a project or task team leader who possesses themselves as follows: appropriate seniority, leadership, and project management • Policy makers at the national level, including the national skills and empowering this individual with the appropriate body for AML/CFT coordination; authority, support team, and resources is essential and has • Legislative branch, in case the NRA is expected to lead to a direct impact on the quality of the NRA. In the World Bank’s revisions in legislation; experience, jurisdictions with strong leadership of their NRAs • AML/CFT regulators and supervisors for the financial ran the assessment more effectively and were much more sector, DNFBPs, and VASPs; punctual in following their NRA roadmaps and timelines. In • Regulators/supervisors for legal persons and NPOs; contrast, jurisdictions with weaker leadership had lower-quality • Financial intelligence units; and more-diluted NRAs that took much longer or were never • Law enforcement and prosecutorial authorities; and completed. In some cases, when the authorities were not able • Financial institutions, DNFBPs, VASPs, NPOs. to bring the NRA to a clear end, the World Bank team had to cancel the country’s technical assistance program because of This list can also serve as a test for the quality and the lack of response to follow-up efforts. comprehensiveness of an NRA. A high-quality NRA should provide meaningful inputs to this list of stakeholders and By its nature, an NRA is a wide-scale exercise that help improve the effectiveness of the stakeholders in fulfilling encompasses a large number of agencies with different their AML/CFT-related roles and tasks. In addition to these priorities and characteristics, as well as the private sector, basic stakeholders, a country may decide to expand the where the business rationale often differs drastically from target audience to the public, the academic and international the state agencies’. A good leader should have the skills and communities, and so on. However, this expansion should not authority to bring all the stakeholders together around the NRA influence the focus on the main stakeholders listed or reduce exercise to make the best use of their experiences, technical the quality of the information they receive. As an example, knowledge, and resources in contributing to the NRA. these main audiences would hardly benefit from technical details or methodological discussions. Rather, practical In many jurisdictions domestic cooperation in AML/CFT information on typologies, sources of risks, weaknesses in is not at a desirable level, and the AML/CFT coordination the AML/CFT system, recommended actions, and red-flag committee or body is not fully effective. Although significant indicators will be much more useful for key stakeholders. progress has been made in recent years, the financial intelligence units, which have key roles in NRAs, are still Other categories can be considered audience members as not always understood and recognized by the other state well. These include the evaluators who conduct the mutual agencies. These cooperation challenges become much evaluation of the jurisdiction on behalf of the FATF or FSRBs. more visible when it comes to information and data sharing As per the FATF Assessment Methodology, these evaluators among agencies during an NRA. must examine the quality of the jurisdiction’s assessment and understanding of ML/TF risks. The future generation For example, in several jurisdictions, obtaining statistics from of experts in the jurisdiction can also be considered among the office of the prosecution and law enforcement agencies the audience of a risk assessment. For any jurisdiction, it is and ensuring their ongoing participation in the NRA have been important to document the ML/TF risk assessment properly an all-too-common challenge. Although the contribution of and retain the records. Such records will help the jurisdiction prosecutors is key to the NRA, in many jurisdictions getting maintain the legacy of each NRA experience and build them on board has been very difficult. Their excessive capacity for future risk assessments. And finally, countries and workload was frequently cited as the underlying reason. But NRA experts should be aware that the criminals who put the when the prosecutors joined the NRA, sometimes with extra nation and its sectors at risk are interested in this information follow-up efforts, their contributions to the NRA were received and may themselves be among the audience. While a public as very valuable by the rest of the working group. NRA document should convey the message of determination in AML/CFT efforts and can be useful for raising awareness Indeed, the lack of cooperation in NRAs can and should be and achieving some policy purposes, it must not publicize any read as a sign of a lack of cooperation in the broader AML/ confidential details and unaddressed deficiencies that were CFT agenda in the country. The NRA process offers an revealed during the assessment. opportunity to identify these coordination problems and 19 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT improve stakeholder collaboration. World Bank teams have experience and skills to make informed judgments during the done feedback surveys in almost all NRA workshops, and assessment. Moreover, assessors must understand why they one of the most appreciated aspects of the NRA exercises are performing the assessment. They should be inspired and was the interaction and strengthened cooperation among have the confidence that the assessment will lead to meaningful stakeholders. In many jurisdictions, the NRA was the first time results and actions that will eventually contribute to the safety such a broad interaction occurred among AML/CFT agencies, and security of their country and its citizens. Therefore, at as well as between these agencies and the private sector. the beginning of a risk assessment, it is important to train the working group on the objective of the assessment and to The leadership of the NRA is critical not only to the success motivate them about the task they are undertaking. of the NRA but also to promoting and leveraging the NRA as an opportunity to understand and address coordination The assessors should have proper professional autonomy challenges and to start a constructive discussion toward and protection to carry out their work in an independent and improving cross-agency collaboration. See box 1 for objective way. The assessment environment should enable an example. candid discussions and information exchange about the risks. Both the leadership of the NRA and the management of stakeholder agencies should encourage the working group > > > members to be professional, open, and critical during the risk B O X 1 . Isle of Man National Risk Assessment assessments and guard against the fear of retaliation, even if the risk assessment reveals deficiencies and problems in their Isle of Man was one of the first jurisdictions to agencies and institutions. collaborate with the World Bank to conduct a National Money Laundering/Terrorism Financing During national risk assessment projects, as an integral part Risk Assessment (NRA). The jurisdiction completed of the NRA, the World Bank has encouraged and guided the the NRA in about eight months, one of the shortest NRA working groups to develop risk-based recommendations periods of all jurisdictions. The Isle of Man risk and action plans corresponding to each recommendation. assessment received quite positive feedback in the In some cases, risk assessment results may indicate a need mutual evaluation. One of the key factors that played for reform in the overall design of the AML/CFT framework, an important role in the efficiency and success of organizational structure of institutions, division of labor among the Isle of Man’s NRA was its leadership. The Isle of different agencies, or rules and protocols about information Man assigned a full-time, dedicated project leader to sharing as well as amendments to laws and regulations. manage the NRA process. In addition to coordinating When developing action plans, the majority of assessors were the NRA process effectively, the project leader reluctant to address these higher-level issues, which are more remained engaged in the risk-based action plan and strategic and long term in nature; assessors tended to focus also during the mutual evaluation of the jurisdiction. on the actions at a technical level within the framework. When In contrast, in some jurisdictions, World Bank project working group members were advised to focus on higher-level teams had to close NRA technical assistance projects recommendations, they perceived these high-level decisions as when the leadership was unresponsive despite out of their reach and did not feel empowered to question the repeated follow-up efforts. effectiveness of the broader AML/CFT framework. However, for a real risk-based approach to be implemented, countries Healthy communication to secure high-level buy-in to the NRA should be ready to make drastic changes in their overall AML/ process is another important consideration. The experience of CFT regime, if necessary, to mitigate risks and improve the the World Bank country project teams show that when all key effectiveness of the system. ministries receive clear direction, data collection challenges can more often be overcome. High-level buy-in also ensures Of course, the assessors are not the decision-makers. Such that staff assigned to the project have this work recognized substantial changes need to be made at the managerial level— as an activity they are involved in, and not as an add-on to an and sometimes at the ministerial level or higher. However, this existing work program. reality should not prevent the assessors from questioning the effectiveness of the current AML/CFT regime in the country; Empower the Assessors assessors must always be willing to propose risk-based Clearly, risk assessors need to know what they are doing, so changes, even if they may seem drastic on their face. they should be selected carefully. They should possess the 20 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Recommendations for a Deeper Understanding of ML/TF Risks See the Big Picture: Forest versus Trees The potential bias of experts poses another risk. For example, One of the operational risks in an NRA process is myopia. an expert who represents the tax authority and focuses on A variety of factors—such as the wide range of topics to value added tax (VAT) fraud investigations may view VAT be covered, involvement of a broad spectrum of experts fraud as the main source of proceeds of crime and money specializing in particular aspects of the national risk context, laundering risks in the country, an interpretation which may unavailability of data, and use of sometimes complex tools not necessarily be correct. Another risk that assessors must and templates—may distract the attention of the assessors guard against is relying on anecdotal evidence or events, away from the big picture in the country. such as a recent large-scale drug seizure in the country that received wide press coverage and may influence the views of As an example, experts in one sectoral assessment may use the NRA working group members. a more conservative approach and conduct a much deeper, more detailed risk assessment than experts in other sectors. During the NRA project in some jurisdictions, the World Bank Thus, the risk level of one sector may appear higher than project teams observed that excessive analyses of some other sectors that conducted more superficial, lower-quality technical compliance issues dominated the write-up, which risk assessments. However, this result may not accurately knowingly or unknowingly diluted the focus on the substance reflect the overall risk profile of the country. For cross-sector of risks. At least in some cases, this seemed to be an comparability of ML/TF risks, a holistic comparative review avoidance behavior driven by the lack of professional security process at the national level is in order, one that develops and comfort to discuss real ML/TF threats and vulnerabilities. standards to ensure consistent results. Considering these challenges, the World Bank has developed some tools that may help assessors maintain a holistic approach in the risk assessment. See box 2 and appendix F. 21 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > B O X 2 . Elevator Pitch Exercise and Anonymous Perception Surveys The World Bank uses two effective tools, the elevator pitch exercise and anonymous perception surveys, during national risk assessments. The elevator pitch asks participants to imagine they are at a big conference for criminal professionals who are seeking to identify ways to launder money that stems from corruption, organized crime, and tax fraud. One participant happens to catch an elevator with one of these money launderers and, in the two-minute ride up, has the chance to make a pitch for why the person in question should launder funds in that particular jurisdiction. This exercise serves as an excellent icebreaker during NRA workshops and helps assessors focus on the big picture in the country without being bogged down by technical details of the NRA template or methodology. The World Bank also conducts anonymous perception surveys at the beginning of kickoff workshops. Working group members are surveyed anonymously about their perceptions of the proceeds of crimes and money laundering/terrorist financing risks in the country. These surveys include questions on the overall level of ML/TF risks, most prominent predicate crimes in the jurisdiction, riskiest sectors, riskiest counterpart countries, and the main impediments to the effectiveness of the AML/CFT regime. Electronic polling software facilitates the surveys. These surveys serve as an effective warm-up exercise and provide real insights into the risks in the country. At later stages of the NRA, cross-comparison of actual NRA findings and records of these initial perception surveys serve as a useful tool for the review of NRA results. At the early stages of NRAs, countries can consider conducting such anonymous surveys that aim to capture the perceptions, experiences, and views of relevant experts in the public and private sectors on ML/TF risks. Invest in Data Collection and Academic Work Assessment of threats requires a good understanding of the One of the topics this study examined is the impact of money laundering and terrorist financing typologies in the problems in data and statistics in IO1. According to the country and, in particular, the techniques, sectors, products, analysis of MERs, although these problems are not as and international corridors used in these crimes. Lack of data prominent as some others, they still seem significant. Among significantly reduces the quality of the threat assessment. the study jurisdictions, 66 percent were criticized, and ratings To support threat assessment, the World Bank NRA Tool, in of 17 percent were explicitly affected, because of data- and its threat assessment module, includes an Excel template statistics-related reasons. In NRA Survey 1 conducted by the (module 1.B) to guide national authorities in performing World Bank, in response to the question, “What would you a more granular analysis of money laundering cases and do differently in the next NRA?,” one of the most prominent turning the information from cases into data, which can be pieces of advice is improving data and statistics to support analyzed, monitored, and used to inform countries about the future NRAs (appendix G). money laundering patterns and trends during a national risk assessment. This simple Excel template was designed like a In the majority of jurisdictions, including higher-capacity ones, registry; it collects key details on each money laundering case lack of data on the proceeds of crime has been a challenge. during the investigation, prosecution, and more advanced Obtaining data on the number of crimes and criminals in various stages. The information can then populate a database. This predicate offense categories was easier. In quite a number data collection does not extend to suspicious transaction of jurisdictions, obtaining even these relatively basic data reports unless they turn into an investigation. took a long time because of coordination problems between the stakeholders, particularly between the working group Despite the simple structure of this data collection template, and the prosecution or law enforcement authorities, or both. countries were not able to collect the required data properly, Moreover, almost no jurisdictions had a database to track and increasing the reliance on qualitative information such as collect information on proceeds and other financial aspects of anecdotal evidence and expert opinion during the threat crimes. Possessing little to no information about the proceeds assessments. Especially for relatively old cases, going back or financial flows related to crimes limits the ability of countries to the paper or information technology-based records and to estimate and understand the total criminal proceeds flowing collecting data on the details of cases was not always easy. to and from their jurisdictions. This retrospective data collection is a time- and resource- intensive process for the working group. 22 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Widespread data challenges during the NRAs reveal a lack on each money laundering case and other serious crimes with of awareness of the value of data collection and analysis for significant proceeds. These useful data and statistics are then better understanding the proceeds of crime and illicit financial readily available during national risk assessments and mutual flows. Data on the proceeds of crime are usually limited and evaluations. In addition, data that are collected properly can scattered among different agencies. Financial intelligence help a country monitor and respond to the changing trends units rarely have the support of specialists with statistics, and patterns in proceeds of crimes. econometrics, or data science skills. In cases where FIUs are not yet well established and recognized by other government The Disconnect between IO1 and Recommendation 33 agencies, the units’ access to data is more challenging. In the context of data and statistics, the study also analyzed the relationship between the criticism in IO1 in MERs and the Data collection will always be a necessity for all countries, jurisdictions’ ratings in FATF Recommendation 33 (R33) on both for understanding and monitoring ML/TF risks and statistics. The Spearman’s correlation is approximately −0.51, for analyzing the impact and effectiveness of the AML/CFT which is moderate but not insignificant. In some jurisdictions, regime, which are key in the FATF standards. In addition, data on these two categories seem quite consistent (that continuous development in information technology (IT) to is, a jurisdiction with a low R33 rating also receives strong facilitate data collection in all fields and the creation of data sets criticism in data/statistics-related issues in IO1, or vice versa). that can cross-support money laundering risk assessments But in some others, there is a discrepancy between these two (including more advanced use of IT by law enforcement, tax, data points (for example, a jurisdiction with a high R33 rating and customs authorities) must be made a priority. Countries receives strong criticism related to the availability of relevant should embrace this reality, invest in data collection and data- data/statistics in IO1). Appendix H lists the jurisdictions with based analyses, and establish a culture with those values. such discrepancies. Although developing a systematic data collection framework requires resources and effort at the early stages, over time, it Although IO1 effectiveness assessment methodology has a will facilitate the organic growth of data, conserve resources, cross-reference to it, R33 is not necessarily drafted in a way and result in more elaborate and robust risk analysis as well to support ML/TF risk assessments (box 3). The current text as more effective AML/CFT policies and institutions. is a legacy of the previous version of FATF Recommendations (40+9) and was not revised after the introduction of a Hiring data scientists, economists, and statisticians in FIUs and mandatory risk-based approach in 2012. As an example, it other AML/CFT agencies or making contractual arrangements does not contain an explicit requirement to collect data and to use these skill sets in day-to-day risk-based approach and statistics on value and monetary amounts in money laundering broader AML/CFT work is becoming more essential with the or terrorist financing cases, especially when there is nothing rapid evolution of information technologies. seized or confiscated. Also, it does not have any reference to ML/TF risks and does not require data collection on sectors Countries should also utilize data and information from and services abused in ML/TF cases. outside their boundaries. This may include obtaining data from international organizations and collaboration mechanisms, as well as requesting information and data from counterpart > > > countries through their liaison officers and other authorities. B O X 3 . FATF R33 on Statistics The usefulness and relevance of the data should also be monitored because risks may change over time. Collection Countries should maintain comprehensive statistics on of unnecessary data may cause noise and inefficiencies. matters relevant to the effectiveness and efficiency of Therefore, data and data sources should be subject to their anti-money laundering/countering the financing changes as necessary. of terrorism (AML/CFT) systems. This should include statistics on the suspicious transactions reports The World Bank has developed a new tool as an investment received and disseminated; on money laundering in the quality of the future risk assessments: the Proceeds and terrorist financing investigations, prosecutions, of Crime and Illicit Financial Flows Data Collection Tool. The and convictions; on property frozen, seized, and tool is intended to kick-start ongoing and systematic data confiscated; and on mutual legal assistance or other collection in World Bank client countries and to establish a live international requests for cooperation. database that grows over time. The tool collects the key data 23 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT The current focus of R33 is on monitoring the effectiveness 2013). In the United Kingdom, Matt Hopkins and Nikki Shelton of some preventive and suppressive measures; the (2019) conducted a study on “Identifying Money Laundering recommendation sets a relatively low threshold that does Risk in the United Kingdom: Observations from National Risk not necessarily support ML/TF risk assessments. The same Assessments and a Proposed Alternative Methodology.” Italian limitation may affect the quality of the strategic analysis that authorities also have been collaborating with academics to needs to be done by FIUs on a regular basis. Therefore, some develop more scientific and data-based tools to support a risk- improvements in R33 or a possible interpretative note on the based approach to AML/CFT. recommendation explaining what is meant by “comprehensive” could make the recommendation more meaningful and help In general, however, academic interest in AML/CFT and build the capacity to collect better data to support ML/TF risk more broadly on the proceeds of crimes is limited—mainly assessments. for two reasons: (a) limited funding for research on the topic, and (b) scarcity of data and limited access to existing data. Leveraging Academic Work for Better Triggering steady and increasing academic work in this area is Understanding of ML/TF Risks not possible without investment of resources with a medium- World Bank project teams have advised jurisdictions and long-term perspective. Investment in independent undertaking NRAs to identify and review academic studies that and scientific research in support of NRAs should be a key may contain useful information to support their NRAs. Even if consideration in AML/CFT strategies of jurisdictions. their focus is not ML/TF risks, studies on organized crimes, terrorism, proceeds of crimes, the informal economy, illicit Two annual academic conferences include ML/TF risk in financial flows, and so on can contain valuable information their agendas: the Cambridge International Symposium on that can contribute to the NRA. Economic Crime and the Central Bank of the Bahamas Annual Conference on Empirical Research on AML and Financial Project teams also advised jurisdictions to include academics Crime. These two main conferences in this front deserve more with relevant expertise in their NRA working groups. Although attention and support. In this regard, the FATF’s initiative to academics were frequently invited to NRA working groups and increase the organization’s engagement with academia, which key activities, most jurisdictions were not able to involve them started with the German presidency and continues under the in deeper data-based and analytical work in a systematic way. current Singapore presidency, is an important development. Their function was mostly providing feedback or some insights during working group meetings. The Colombia NRA is an Make the Best Use of Feedback example of successful deeper involvement by academics in During and After the NRA the NRA. The country was able to trigger academic interest in Before finalizing an NRA, countries should have their the NRA and proactively leveraged academic work in the NRA assessment reviewed by internal or external experts and process, mostly to develop novel approaches to assessment should incorporate the feedback. World Bank project teams and understanding of risks. have reviewed jurisdictions’ draft reports in almost all NRA projects and provided comments to the NRA working groups. Although not linked to the World Bank’s experience, it is worth Common issues detected by the World Bank teams and noting some good examples of academic work in support of reported back to the jurisdictions were as follows: assessment and understanding of ML/TF risks and a risk-based • Misinterpretation of the statistics on predicate crimes approach. Based on pilot applications for Italy, the Netherlands, • Negligence of the international context and too much focus and the United Kingdom, a report on Identifying and Assessing on domestic crimes the Risk of Money Laundering in Europe (IARM) proposed a • Lack of justification in ratings and disconnect between quantitative methodology that can be replicated in NRAs and narrative and ratings sectoral risk assessments (Savona and Riccardi 2017). Several • Lengthy reports loaded with technical-compliance such studies were done in the Netherlands. In “Estimating information Money Laundering Risks: An Application to Business Sectors • Unorganized report structure in the Netherlands,” Joras Ferwerda and Edward R. Kleemans • Defensive and overly optimistic assessments (2019) used IARM methodology to complement national risk • Disconnect between the evidence, reasons, results, and assessments. Two other examples from the Netherlands are proposed mitigating measures “The Amounts and the Effects of Money Laundering: Report • Internal inconsistencies within the risk assessment for the Ministry of Finance” (Unger et al. 2006) and “How to • Lack of harmonization among different chapters Dodge Drowning in Data? Rule- and Risk-Based Anti-money • Overlooking the threat (for sectors, products, and so on) Laundering Policies Compared” (Unger and Van Waarden • Inconsistencies with open information 24 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT • Lack of clear conclusions and recommendations that can the transformation in compliance behavior, the number and guide a risk-based approach quality of suspicious transaction reports, and other regulatory • Reliance on ill-designed questionnaires filings as a result of the communication of the national • Confusion about and wrong use of basic concepts, such as risk assessment. The quality of the institutional risk assessments risk, threat, and vulnerability and their correlation and consistency with the NRA can also be • Weak analysis of causal relationships (despite the structure a reliable indicator of the practicality and success of the NRA. of the NRA Tool, which has a specific focus on this aspect) • Top-down interventions at the final stages Countries should contemplate devising questionnaires to garner feedback from private sector institutions. Such When providing comments, the World Bank project teams questionnaires may also be executed in a face-to-face, also highlighted and commended the strengths of the anonymous manner in public/private syndication workshops risk assessments. Indeed, most of the time, criticism was or forums. The feedback from these assessments should be presented after or within a discussion of the strengths, used to enhance the caliber of the NRA and its communication to avoid discouraging the working groups. However, this to stakeholders. approach might have misled some jurisdictions and shadowed the criticism. The World Bank’s comments were advisory in nature and not binding, and jurisdictions did not always accept Recommendations for a Real or incorporate the comments and were usually reluctant to Transition to Risk-Based Approach make substantial changes in their reports. Therefore, for the review to practically benefit a country, and to Find Innovative and Country-Specific prepare it for the mutual evaluation (although this should not Solutions to Turn NRA Results into be the primary objective), reviewers should not hesitate to offer Risk-Based Policies, Strategies, and Actions constructive criticism, conduct the review using a conservative As the analysis of MERs shows, the most common challenges approach, and communicate the deficiencies and problems in in IO1 are the lack of risk-based policies and strategies and the risk assessments in a direct manner. the disconnect between the risk assessment results and the AML/CFT regime. Logically, a risk assessment is expected to Ideally, multiple reviewers having different perspectives lead to improvements and risk-based calibrations in countries’ should review the NRA. To better judge the clarity of the risk AML/CFT strategies and policies. A risk assessment that does assessment for a broader audience, some reviewers should not yield risk-based actions and policies and ultimately does have relatively deep technical knowledge (for example, experts not contribute to the effectiveness of the AML/CFT regime is a who have broad experience in national risk assessment, waste of resources. Quite often, jurisdictions face challenges mutual evaluation, or both), and some should have less in converting their risk assessments into policies and actions. technical backgrounds. The study team believes that the FATF’s guidance in this area is inadequate. More guidance and additional specific Obtaining feedback after the NRA is complete is no success stories from countries that used the risk assessments less important. Examination of MERs reveals that low to improve and even reform their AML/CFT systems would comprehension of ML/TF risks and confusion in applying encourage other countries to take this critical, practical step. risk-based approaches by nonbanking financial institutions and DNFBPs is a nearly universal issue. As such, a clear Another important aspect of the risk assessments and risk- articulation of the ML/TF risks to these sectors and getting based AML/CFT controls concerns high-risk jurisdictions. A their feedback on the usefulness of the NRA is essential good risk assessment should give authorities and the private for augmenting their contribution to the combat against ML and sector some insight into high-risk jurisdictions and the high-risk TF. financial corridors from and to the home jurisdiction, so that authorities and institutions can establish enhanced controls In addition, it is imperative to collect feedback about the on transactions with these jurisdictions. However, creating NRA from the private sector, not only to understand the a list of high-risk jurisdictions is a sensitive undertaking that effectiveness of its communication, but also to assess its some authorities are reluctant to do. In the AML/CFT regimes utility in the internal risk assessments and risk mitigation of many jurisdictions and institutions, “high-risk” refers solely measures of the reporting entities. Though the task may to the jurisdictions gray listed or blacklisted by the FATF and not be effortless, carrying out post-NRA impact analysis does not refer to the specific context and risks of a country and can be an advantageous exercise. Authorities can monitor its partner jurisdictions. 25 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT The label of Recommendation 19 (R19) may contribute to this border threat assessment (see box 5). However, in practice confusion, giving the impression that only the jurisdictions in their NRA reports, countries generally avoid naming certain listed by the FATF are high risk and should be subject to countries or corridors as high-risk. Even if this information enhanced controls (see box 4). However, risk assessments of is not published, countries should conduct this analysis and jurisdictions should include insights regarding jurisdictions that make it available to AML/CFT competent authorities. may not appear among the black- and gray-listed jurisdictions but are high risk in country context. > > > Countries also should bear in mind that the RBA involves B O X 5 . Suggested Steps to Determine understanding not only high risks, but also medium and low Jurisdictions to Be Included in risks, and that countries should develop policies and actions Cross-Border Threat Analysis that proportionately correspond to all risk levels. STEP 1: Start with the jurisdictions that were identified during the general discussion and brainstorming session on the first day of the workshop. > > > STEP 2: Analyze the ML convictions and identify the top B O X 4 . FATF R19 Higher-Risk Countries 10 jurisdictions (or as many as relevant) that appear in Financial institutions should be required to apply these cases. Compare this list with your list in Step 1 enhanced due diligence measures to business and expand the list to include these 10 jurisdictions. relationships and transactions with natural and legal STEP 3: Analyze the data of outgoing mutual legal persons and financial institutions from countries that assistance requests. Identify the top 10 jurisdictions this is called for by the FATF. The type of enhanced (or as many as relevant) and compare them with your due diligence measures applied should be effective list in Step 2. If there are new jurisdictions that are not and proportionate to the risks. already on your list, expand the list to include them. Countries should be able to apply appropriate STEP 4: Analyze the data of incoming mutual legal countermeasures when called upon to do so by assistance requests. Identify the top 10 jurisdictions the FATF. Countries should also be able to apply (or as many as relevant) and compare them with the countermeasures independently of any call by the list in Step 3. Repeat as above. FATF to do so. Such countermeasures should be STEP 5: If data on financial inflows (as set out in sub- effective and proportionate to the risks. module 1.C) are available, identify the top five jurisdic- tions (or as many as relevant) and repeat as above. In conducting risk assessments, consideration also should be STEP 6: If data on the financial outflows (as set out in given to the interaction between a country’s formal and informal submodule 1.C) are available, identify the top five juris- economies, as well as the overall effectiveness of the AML/CFT dictions (or as many as relevant) and repeat as above. regime. If a country’s AML/CFT policies fuel the informal economy STEP 7: If the home jurisdiction has a significant Trust and create unintended consequences–such as financial exclusion and Company Service Provision sector, identify the and de-risking of certain clients and client groups–such policies, top five origin jurisdictions (or as many as relevant) of even though they appear strong on paper, may increase risks and the clients. Repeat as above. reduce the effectiveness of the system. Therefore, it is crucial for any country to use exemptions and simplifications appropriately in low-risk areas, so that some of these valuable resources can Source: World Bank NRA Tool, Guidance on National Threat Assessment be reallocated to high-risk areas, thus contributing to the overall Module. effectiveness of the system. Unfortunately, not all countries fully understand and leverage the positive impact of exemptions and One area in which the World Bank has supported countries simplifications on the AML/CFT regime’s overall effectiveness; in implementing a risk-based approach is the development higher-capacity countries and supervisory authorities take better of strategies for carefully choosing between supervision advantage of these mechanisms (Celik 2021). and monitoring regimes on the basis of sectoral risk levels. According to FATF standards, FIs that are subject to core The World Bank has developed guidelines to help countries principles (banking, securities, and life insurance) and casinos identify the jurisdictions that should be included in a cross- should be subject to supervision, while the remaining sectors 26 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT can be subject to either supervision or monitoring. The FATF institutional memory. has not prescribed a one-size-fits-all definition of the monitoring As discussed in the previous chapter of this report, worldwide, regime; instead, it provides countries with flexibility in defining the most important reason for failure in the effectiveness of the and tailoring their monitoring regimes. Using a sectoral risk risk-based approach (IO1) is deficiencies in developing risk- map, countries can determine which sectors should be subject based national strategies and policies. Although developing to supervision and which ones can be subject to monitoring. risk-based policies requires ownership and involvement of multiple agencies, establishing a mechanism to coordinate the In general, countries need further guidance on how to development and implementation of national strategies and translate risk assessment results into national policies and policies can be a powerful tool to maintain momentum after strategies. While the vulnerability assessment provides better the NRA. guidance on this matter, translating the threat assessment into risk-based policies and actions is a challenge. For example, Countries need to build their internal capacity and preserve in their NRAs, most countries analyzed predicate offenses as the experience in assessing risks by converting them into sources of ML risk. But the implications of this analysis for policies and actions. This step is more challenging when there national strategies and policies are not necessarily clear. is staff turnover among leaders and members of the working groups. In many jurisdictions, updates or future rounds of risk Another potential area for improvement is developing assessments may have to be conducted by a new generation and updating red-flag indicators for sectors using the risk of working group leaders and members. These updates assessment. Often, red-flag indicators for sectors are not and new assessments should not start from scratch; rather, dynamic and not linked to the country’s risk assessment. members should leverage the experiences and information from the past assessments. With this perspective, the World Establish a Culture of Risk-Based Approach Bank recommends that countries document their NRAs well With the 2012 revisions, the risk-based approach became the and retain their records, including working documents, in an backbone of the FATF Recommendations. The initial round organized and accessible format. of NRAs was the first serious attempt by many countries to make the transition to this risk-based approach; it was also Documentation alone, however, is not adequate for the cross- an experiment. Going forward, countries should aim to build generation transfer of expertise. Countries should embrace a dynamic and continuous risk-based approach culture. In the reality that the risk-based approach is the future of the addition to some good practices covered below, feedback loops global AML/CFT landscape and consider forming dedicated (explained in the section, “Make the Best Use of Feedback and permanent national teams or units focusing on the during and after the NRA”) should be leveraged to establish this risk-based approach, such as a department in the financial risk-based culture. intelligence unit or another competent authority (see box 6). These national teams should be supported with adequate R1 requires countries to establish a mechanism to assess resources, own all the information related to the risk-based and understand risks and apply a risk-based approach. To approach, including NRAs, and be prepared to do the heavy conduct the risk assessment in an organized way, the World lifting on policy and strategy development. In addition to these Bank’s project teams have advised countries to establish main functions, similar to the FATF’s Risks, Trends, and working groups or task teams under the coordination of a Methodologies Groups, these units can monitor the new risks leader and secretariat. By nature, these structures were ad and trends and inform stakeholders about them. hoc, and almost all of them were dismissed after the NRA was completed. The World Bank supported the jurisdictions in Establishing a unit or department focused on ML/TF risks will developing risk-based action plans at the end of all the NRA help countries preserve data and build institutional memory. projects. But this draft action plan also marked the cutoff of Such units can also mitigate the two drawbacks related to the the World Bank projects. The implementation of an action plan risk-based approach and ensure the continuity and growth in is a much longer-term endeavor that often requires official memory and capacity in risk assessments. Risk assessments endorsements at political and senior levels and should be and updates will still require the involvement of a broader carried out by a wide range of stakeholders. group of experts from various public and private stakeholders. However, these risk units can constitute the permanent Although this structure worked well for the initial round of memory. Using experts knowledgeable on NRAs will be more NRAs and will be needed in future risk assessments, it effective than reading a bulky report. Such units should also comes with two main drawbacks: (a) interruption in turning be supported with adequate human and other resources. the assessments into policies and action and (b) loss of 27 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > B O X 6 . Divisions Focusing on ML/TF Risks FATF Recommendation 1 requires countries to establish a mechanism to understand and assess the money laundering/ terrorism financing (ML/TF) risks in their jurisdictions but does not prescribe what this mechanism should be. During their first national risk assessments, many countries established ad hoc working groups or task forces to undertake risk assessments. Some others established permanent units to conduct and coordinate ML/TF risk assessments. For example, Hong Kong SAR, China, has a specific department dedicated to ML/TF risk assessments of the jurisdiction. This risk assessment unit, which reported to Financial Services and the Treasury Bureau, played a pivotal role in the first risk assessment of the jurisdiction in 2017. In the mutual evaluation, the country was praised for having a good understanding of ML/TF risks and rated as substantially effective in Immediate Outcome (IO) 1. On June 1, 2021, together with the Joint Financial Intelligence Unit and Financial Investigation Division, the risk assessment unit joined the new Financial Intelligence and Investigation Bureau. The unit also led the second NRA in 2022. The United Arab Emirates also has a permanent division that focuses on risks. The country, which consists of seven emirates and has two global financial centers and several free trade zones, established an Executive Office of AML/ CFT in 2021 to centrally shape and implement the UAE’s National Strategy and Action Plan and coordinate between national entities and with international partners. The Executive Office of AML/CFT is tasked with facilitating the continued development and maintenance of a reliable financial system with high levels of protection against abuse for ML/TF and weapons proliferation and implementing strong regulatory frameworks. It has a permanent Risk and Policies Department that monitors and assesses any risks related to ML/TF, financing illegal organizations, and financing proliferation, and the department coordinates the NRA and development of risk-based national strategies and policies. Under the scope of this study, we also analyzed the jurisdictions topics. Some of these were done after a core national risk that were commended for good quality and practices in their assessment was conducted. Continuous strengthening of the risk assessments and risk-based approach to AML/CFT in understanding of risks by conducting risk assessments in new their MERs (see box 7). A characteristic that was highlighted areas/emerging risks is a best practice that adds dynamism to in New Zealand, Spain, and several other jurisdictions is the the RBA. Appendix I contains some excerpts from the MERs continuous and dynamic nature of their risk assessment work. of jurisdictions listed in box 7 and highlights the strengths of Several jurisdictions in this group have organized a series the RBA in these jurisdictions. of risk assessments, each focusing on different sectors or 28 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > B O X 7 . Jurisdictions Commended for the Strengths in Their Risk-Based Approach to AML/CFT Although not an exhaustive list, below are some jurisdictions that are commended for strengths in their risk assessments. Please note that some jurisdictions that were rated relatively lowly nonetheless earned positive remarks on their risk assessments. Antigua and Barbuda Greece Italy San Marino Aruba Hong Kong SAR, China Republic of Korea Saudi Arabia Bermuda Indonesia Moldova Spain Canada Ireland New Zealand United Kingdom Cyprus Isle of Man Philippines Ghana Israel Russian Federation Some common characteristics that received positive feedback from the assessors are as follows: • The political commitment to assess and understand the risks • Good understanding of risks based on dependable evidence and sound judgment • Reliance on diverse information sources that are both qualitative and quantitative • The continuous/dynamic nature of the risk assessments • Good organization and strong collaboration among government agencies • Strong public-private collaboration during the risk assessments • Strong collaboration with academia • Identification of data/information problems and plans for addressing them • Risk-based strategies based on the risk assessments Be Flexible and Efficient in Any report, write-up, presentation, or other output of the Reporting and Dissemination NRA should consider the issue of the “the forest versus the When working with countries, task teams from the World Bank trees.” These documents should always present the big often have advised the countries to write an NRA report. In picture in a professional, clear, and concise manner and response to countries’ requests, the World Bank developed effectively convey the main risk messages and priorities to the a standard report outline. However, it soon became apparent intended audience. They should not contain any unnecessary that writing the NRA report was an overwhelming process for technical details and jargon that may be difficult for end users some countries and could distract them from the main task, of the information to comprehend. For instance, rather than which is informing the risk-based approaches of public and presenting numerous and confusing details, a presentation private stakeholders. targeting a certain type of financial institution should include insights about the typologies where the sector was abused, Therefore, countries may consider using alternative methods identifying red-flag indicators for the sector as well as high-risk of communicating the initial risk assessment results to relevant lines and transactions the sector should focus on. stakeholders. These alternatives could include sector-specific briefs, presentations, meetings, workshops, and other forms Ideally, risk assessment reports, briefs, or presentations should of dissemination. The information also could be shared with be tailored to target audience. For example, a presentation stakeholders on a secure website, where users must identify that is addressed to supervisory authorities or national themselves before accessing the information. policy makers may not be fully relevant and useful for the private sector institutions, which need the outputs risk assessment as an input to their institutional risk assessments and risk-based approaches. 29 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT 4. Other Key Considerations Related to the Risk-Based Approach The Impact of Capacity Constraints During this research, the study team also examined the performance of countries in IO1 and the broader risk-based approach, including IO4 and IO5, in countries’ income groups. The team used the four country income categories defined by the World Bank—namely, high income, upper-middle income, lower-middle income, and low income. Figure 6 shows how the IO1 ratings are distributed in each income group. In IO1, an obvious relationship exists between the income levels of countries and the percentage of countries rated as having substantial effectiveness and low effectiveness. The distribution of moderate effectiveness ratings is more even across all income groups. In R1, the relationship between countries’ income levels and their performance seems to be limited and shows a clear pattern only in the noncompliant category. 30 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > F I G U R E 6 . Distribution of IO1 Ratings, by Income Group 100% 90% Percentage of jurisdictions 79% 80% in each income group 70% 60% 53% 48% 49% 50% 40% 40% 34% 28% 30% 19% 21% 20% 17% 8% 10% 3% 0% 0% 0% 0% 0% High Upper-middle Lower-middle Low income income income income High effectiveness Substantial effectiveness Moderate effectiveness Low effectiveness Source: Study data based on mutual evaluation reports. A statistically strongly significant Spearman’s correlation be read as a confirmation of the widespread impact of human (0.56) was found between gross domestic (GDP) per and other resource constraints on NRAs. Figure 7 indicates capita and IO1 scores. In this analysis, GDP per capita was that resource constraints are the most important impediment used as a basic indicator of the development level of each during NRAs. jurisdiction. Although caution should be used in interpreting the correlation analysis, the results may imply that a higher To further examine the possible fundamental challenges, income level allows a jurisdiction to allocate more resources the study team also ran a Spearman’s correlation analysis to RBA, or higher income affects the quality of governance between the quality of RBA in the jurisdictions and some of in a jurisdiction, which eventually affects the quality of RBA. the World Bank’s Governance Indicators as of 2021. Table 2 Also, both may have an impact on the quality of RBA together, summarizes the results of this analysis. combined with other factors. Indeed, the survey results can > > > TA B L E 2 . Spearman’s Correlation Coefficients between World Bank Governance Indicators and Indicators of Country Performance in the Risk-Based Approach GDP per capita Government effectiveness Regulatory quality Ratings of Immediate Outcome 1 0.56 0.51 0.51 Ratings of R1 0.35 0.28 0.31 Source: Study data based on mutual evaluation reports and World Bank Worldwide Governance Indicators: https://databank.worldbank.org/source/worldwide-governance-indicators. 31 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT As seen in table 2, compared to GDP per capita, government the quality of the next NRA, if not addressed properly (figure effectiveness and regulatory quality in countries exhibit slightly 7). The biggest challenge identified relates to the allocation weak correlations with indicators of country performance in of adequate resources, including human resources, for the risk-based approach. The strongest correlation is between assessing the risks. Lack of knowledge and experience was IO1 ratings and GDP per capita. While most correlations are also noted as a challenge, confirming the need for continuing of moderate size, they are all statistically (and monotonically) support for NRAs. Additionally, possible coordination problems significant, meaning the direction of the relationships were concerning for many participants. Survey 1 included a consistently exists in the direction indicated and is not by similar, open-ended question: Participants were asked what coincidence. they would do differently in a new NRA given their experience and observations in the country’s first NRA. Many participants In NRA Survey 2, a key question was about impediments to recommended improvements in public-public and public- the quality of ML/TF risk assessments. Using a given list of private cooperation, and in collection of better-quality data and options, participants were asked to identify the three most information. A list of responses appears in appendix G. important challenges in their jurisdictions that could hamper > > > F I G U R E 7. Most Significant Impediments to the Quality of ML/TF National Risk Assessments, as a Percentage of All Responses Resource–related challenges (i.e., time, staff) Lack of experience 6% 25% and knowledge Coordination problems 6% Lack of a risk assessment tool or methodology 9% 18% Lack of empowerment (of the NRA working group) Lack of political 10% commitment Intervention from upper management 11% 15% Concerns about country reputation Source: Study data based on mutual evaluation reports. Note: ML = money laundering; TF = terrorist financing; NRA = National ML/TF Risk Assessment 32 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Last-Minute National Risk Assessments Using the information in MERs, the study also analyzed the the study jurisdictions, 26 completed their risk assessment timing of NRAs. The analysis shows a widespread tendency within three months or less of the onsite visit (figure 8). to complete the assessment within the last year before the Approximately 20 in this group finished in the last month mutual evaluation onsite visit, which marks the cutoff date before the onsite visit. for progress to be included in the mutual evaluation. Among > > > F I G U R E 8 . Time between NRA Completion and Mutual Evaluation Team’s Onsite Visit (Months) [0, 3] (3, 6] (6, 9] (9, 12] (12,15] (15, 18] (18, 21] (21, 24] (24, 27] (27, 30] (30, 33] (33, 36] (36, 39] (39, 42] (42, 45] (45, 48] (48, 51] (51, 54] (54, 57] (57, 60] (60, 63] Time (months) (63, 66] (66, 69] (69, 72] (72, 75] (75, 78] (78, 81] (81, 84] (84, 87] (87, 90] (90, 93] (93, 96] (96, 99] (99, 102] (102, 105] (105, 108] (108, 111] (111, 114] (114. 117] (117, 120] (120, 123] (123, 126] (126, 129] (129, 132] (132, 135] (135, 138] (138, 141] (141, 144] 0 5 10 15 20 25 30 Number of jurisdictions Source: Study data based on mutual evaluation reports. Note: ML = money laundering; TF = terrorist financing; NRA = National ML/TF Risk Assessment 33 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Intuitively, the time between the NRA and the onsite visit of finding is also supported by figure E.3 in appendix E, where the mutual evaluation team can be expected to affect the Spearman’s correlation between methodological issues and rating of IO1, or at least cause problems in building risk-based IO1 ratings is statistically negligible and insignificant. national policies or strategies in a timely manner. Positive and significant Spearman’s correlation confirms this observation.8 Indeed, this result aligns with the FATF’s assessment Indeed, among 26 jurisdictions where this time span is three methodology, which states, “Assessors are not expected months or less (see figure 8), 17 received strong criticism about to conduct an in-depth review of or assess the country’s deficiencies in risk-based national policies and strategies— assessment(s) of risks. Assessors, based on their views of the as expected.9 However, many other jurisdictions completed reasonableness of the assessment(s) of risks, should focus on their NRAs in a timelier manner and had enough time to work how well the competent authorities use their understanding of on developing risk-based national policies, but they failed to the risks in practice to inform policy development and actions to do so. Given these observations, it is possible to defend the mitigate the risks.” notion that the time between NRA completion and mutual evaluation onsite visits matters, but apparently there are also The same finding also applies to the mutual evaluations of other common problems underlying the lack of or deficiencies jurisdictions that used the World Bank’s NRA Tool. Among 146 in risk-based national policies. Further guidance to countries study jurisdictions, 67 used the NRA Tool. In the MERs of these on how to turn risk assessment results into risk-based policies 67, criticism of the NRA Tool was rare. For example, Monaco’s and strategies, as well as relevant best practices, would help MER criticizes the tool (indirectly) for not having the notion of address this outstanding problem. The analysis shows that 16 consequences. The reports for Kenya and Estonia contain some percent of jurisdictions were not able to complete and submit any criticism, mainly on the pilot versions of the tool. These issues NRA to the mutual evaluation team, 25 percent completed two were addressed in the final version of the NRA Tool. Slovenia’s or more NRAs, and most met the mutual evaluation with one MER states that country authorities “strictly followed the NRA completed before the onsite visit. Indeed, the figure for the provided global tool, even where they sometimes found that this countries that have completed multiple NRAs is encouraging and did not allow them to sufficiently take the country’s specificities shows that quite a number of countries make the effort to keep into consideration.” However, this statement relates more to their understanding of risks up-to-date. The countries that have limiting the scope of the national risk assessment with the NRA completed multiple NRAs tend to update their NRAs in two- to Tool, even though the country-specific risks required additional four-year intervals (appendix E, figure E.5.) Excluding some very analyses. A similar concern was voiced in Croatia’s MER. But early NRAs from before 2012, the average NRA update interval limited criticism of the NRA Tool and other methodologies is 3.5 years. This figure is just a snapshot of what is happening used by countries should be read with caution, since the FATF on the ground. There is not a “one-size-fits-all” interval for NRA methodology does not expect that criticism from the assessors, updates. The timing depends on the country context and how as explained previously. The question of whether this issue fast the economy, crime profile, and risks in the country change. should be subject to further scrutiny, as proposed by Ferwerda The monitoring of country context and emerging risks should and Reuter (2022), is a separate question beyond the scope of be done in real time. But in the absence of unexpected, drastic this study, and it deserves further analysis and discussion. changes in a country’s profile, three to five years would seem to be a reasonable time frame to update the risk assessments. A Spearman’s correlation analysis between IO1 ratings and use of the NRA Tool also does not show any meaningful, large How Much Does the Risk correlation worthy of practical consideration. IO1 ratings seem more related to fundamental factors in assessed jurisdictions, Assessment Methodology Matter? discussed later in the report. Methodology-related issues do not appear to significantly Figure 9 compares FATF and FSRB jurisdictions on the affect IO1 ratings directly. Assessors generally focus on basis of the frequency of criticism in various categories. As the reasonableness of NRA results and rarely examine the expected, in general, FATF jurisdictions received less criticism methodologies and tools used for national risk assessments. than FSRB jurisdictions in most categories.10 One of the two As shown in figure 3, methodological issues are rarely seen categories in which FATF jurisdictions were criticized more as substantial problems that affect countries’ IO1 ratings. This frequently than FSRB jurisdictions is methodological issues. 8 Spearman’s correlation shows positive and significant association between the two (rho value = 0.27 and p = 0.0024) at the 95 percent significance level. In other words, as the time between the first NRA and the onsite visit of the team increases, evaluation consistently improves. 9 Moderate negative Spearman’s correlation attests to this finding (rho value = −0.25 and p-value = 0.005). As the months between the first NRA and the onsite visit of the team decrease, criticism about deficiencies increases. 10 A statistical t-test also suggests a significant difference between the levels of criticism both FATF and non-FATF receive. Generally, FATF countries receive a low level of criticism compared to non-FATFs. 34 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > F I G U R E 9 . Frequency of Criticisms of FATF and FSRB Jurisdictions Understanding of ML risks is not deep enough. National policies and/or strategies are not risk based. Understanding of the TF risks is not deep enough. Problems in dissemination/communication of the NRA results. Deficiencies in data and statistics to support the NRA. Exemptions or simplifications are not risk based. Absence of or deficiencies in LP risk assessment. Absence of or deficiencies in NPO risk assessment. NRA is not up-to-date. Overall TF risk level is not justified. NRA has not been completed. Criticism on methodological issues. Overall ML risk level is not justified. 0% 20% 40% 60% 80% 100% FATF FSRB Source: Study data based on mutual evaluation reports. Note: Percentages in 34 FATF and 112 FSRB jurisdictions. FATF = Financial Action Task Force; FSRB = FATF-style regional bodies; ML = money laundering; TF = terrorist financing; LP = legal person; NPO = nonprofit organization; NRA = National ML/TF Risk Assessment. In this analysis, the jurisdictions that are members of both the FATF and an FSRB are counted only in FATF. The second outlier concerns exemptions and simplifications are especially reluctant to use exemptions and simplifications that are not risk-based. This finding should be considered because of their lower capacity to tailor the AML/CFT along with those of the World Bank report on FATF regulations or their concerns about the mutual evaluation. Recommendations and financial inclusion (Celik 2021). The Therefore, the lower level of criticism of FSRBs in this category report shows that FATF member jurisdictions use exemptions reflects the lower use of exemptions and simplifications among and simplifications more frequently than FSRB jurisdictions FSRB jurisdictions. do. Developing countries, which are mostly FSRB members, 35 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT 5. A Way Forward for the World Bank and Other International Stakeholders A Way Forward for the World Bank’s Capacity-Building Program Related to NRAs The World Bank’s National Money Laundering/Terrorist Financing Risk Assessment technical assistance program has reached 114 jurisdictions and more than 5,000 experts in these jurisdictions since 2013. We believe this program has played an important role in the Financial Action Task Force (FATF)’s ongoing transition to a risk-based approach to anti-money laundering/countering the financing of terrorism (AML/CFT). Our analysis could not find any statistically significant relationship between the use of the World Bank’s NRA tool and countries’ understanding of money laundering and terrorist financing risks. Rather, the quality of the risk assessments seems significantly correlated with the income level or degree of overall government effectiveness in jurisdictions. On the other hand, country-specific experiences of the World Bank project leaders show that in many low-capacity jurisdictions, the World Bank’s NRA support was the first step toward the risk-based approach and has helped significantly in raising awareness and building the capacity of a broader group of stakeholder agencies, such as supervisors of nonbank sectors, prosecution, law enforcement, customs, and tax authorities. Also, feedback surveys done during these projects showed significant improvements in interagency cooperation and collaboration between the public and private sectors in AML/CFT. However, depending on the starting position of the jurisdiction at the beginning of the NRA, such improvements are not always enough to shift the effectiveness ratings up. The World Bank’s support was focused on the assessment of risks and did not include comprehensive support for risk-based strategies and policies, and for implementation of risk- based approaches, all of which are essential for effectiveness. Going forward, the World Bank management may wish to shift the focus of NRA-related technical assistance projects to more specific areas highlighted in this analysis rather than supporting second or later rounds of national risk assessments from beginning to end, which will have limited value added. The new focus could be on selective but more in-depth global and country engagements, such as 36 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT • Support for the development and implantation of risk- based national AML/CFT policies and strategies and The study also identified some specific points related to FATF implementation of these; Recommendations and assessment methodology, which may • Better data collection and analysis on the proceeds of crimes benefit from further clarifications and guidance: and academic research that can support understanding of • We found discrepancies in the treatment of LP risk the proceeds of crimes and their movement at the global assessments by evaluators during the mutual evaluations. It level and in client countries; may not be fully clear to the assessors whether deficiencies • Implementation of risk-based approaches to legal persons in LP risk assessment should be considered solely in (LPs), company and trust service providers, and other Immediate Outcome (IO)1 or in both IO1 and IO5. More designated non-financial businesses and professions guidance for assessors could help reduce potential (DNFBPs), and new technologies, including virtual assets; problems, such as double-counting of the same • Implementation of a risk-based approach in support of deficiencies in different parts of the assessments. financial inclusion, including digital financial products and • The current focus of FATF Recommendation 33 on statistics merchant payments. is on monitoring the effectiveness of some preventive and suppressive measures, and it sets a relatively low threshold that does not necessarily support ML/TF risk assessments. Recommendations for International The same limitation may affect the quality of the strategic analysis that needs to be done by the financial intelligence Organizations, Technical Assistance units on a regular basis. Some improvements in R33 or Providers, and Donors a possible interpretative note on the recommendation that explains what is meant by “comprehensive” could make the recommendation more meaningful and This study shows that despite the progress in risk-based encourage countries to collect better data to support approach and raising awareness, understanding of ML/TF ML/TF risk assessments. risks is still shallow in many jurisdictions, and implementation • In the AML/CFT regimes of many jurisdictions and of risk-based approaches at the national level and especially institutions, high-risk jurisdictions refer solely to the in nonbank sectors is a widespread challenge. The following jurisdictions gray-listed or black-listed by the FATF and do paragraphs contain some suggestions for international not refer to the specific context and risks of a country and organizations, technical assistance providers, and donors to its partner jurisdictions. The label of Recommendation 19 help advance the understanding of ML/TF risks and make real may also contribute to this confusion, giving the impression progress in risk-based approaches globally. that only the jurisdictions listed by the FATF are high risk • Supporting and funding academic work on criminal and should be subject to enhanced controls. The FATF proceeds and financial flows, ML, and TF risks can may wish to reconsider the title of Recommendation cross-support the understanding of risks by jurisdictions 19 and provide further guidance to governments about themselves and by the assessors during the mutual identifying high-risk jurisdictions in their country evaluations, as well as at the global level. In this regard, the context. FATF’s recent initiative to better collaborate with academia is an encouraging development. Donors and international organizations should further support academic work on the proceeds of crimes and criminal financial flows Other Research Topics That Emerged and should invest in independent data collection at the during the Study and Its Review international level. • The FATF and other international organizations may During the study and drawing from the comments of peer consider improving the guidance and facilitating the sharing reviewers, the project team identified some other topics that of best practices in the areas the jurisdictions are struggling are not under the scope of this report but may deserve further with most, notably in deepening the understanding of ML research: and TF risks; developing risk-based policies, strategies, and actions; and effective communication of risks to • Using mutual evaluation reports (MERs), this study also attempted to identify the main sources of the proceeds relevant stakeholders. Technical assistance providers and of crimes from a global perspective. Similarly, the sectors donors may intensify their support in these areas. indicated as high risk in MERs were included in data 37 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT collection. Some findings were shared with the peer but not necessarily from the country NRA reports reviewers and received constructive comments that can themselves. NRA reports that have been obtained by help deepen and refine the findings. Considering the the World Bank during the NRA projects are confidential importance of the topic and its divergence from the main documents unless published by countries. A future study that objective of this report, that analysis will be released as a analyses publicly available NRA reports and unpublished standalone document or blog, as appropriate. The analysis reports—with the consent of home jurisdictions—could can be expanded to TF in addition to ML. provide further insights into problems or promising practices • Although it was analyzed and included in this report to a in NRAs. certain extent, an in-depth effectiveness assessment of the • Considering the limitations of the MER process, a deep World Bank’s NRA Toolkit and technical assistance activities analysis of the NRAs themselves and the risk-based was not among the primary objectives of this report. Such approach (RBA) adopted by the countries could be a standalone effectiveness and impact analysis could be conducted with a more holistic approach. In this kind of considered by the World Bank management. study, the conceptualization of risk, how well the risk is • Several peer reviewers voiced the need for sharing good studied in the NRAs, and the soundness and consistency practices of risk-based strategies and policies and of the of the methodologies used could also be examined since implementation of risk-based approaches. The report how the risk is handled determines the level of risk—in itself recommends some principles in this regard but also other words, the inherent/residual risk and this concept of highlights the need for further exploring the proven risk- risk also affect the risk mitigation policies and the overall based approaches and best practices. effectiveness of the AML/CFT regime. This research can be • The study attempted some correlation and regression expanded to a comparative impact analysis of different risk analyses to explore the factors (independent variables) that assessment approaches. may influence countries’ IO1 ratings. This analysis could be • Are revisions and further clarification of concepts in subject to further research by expanding the scope to other FATF NRA guidance needed? What can be some practical immediate outcomes. Such a study could also examine the options in this regard that would add value without consistency between the mutual evaluations conducted by distracting and overwhelming the countries? Should mutual the FATF and FATF-style regional bodies (FSRBs). evaluations pay attention to assessment methodologies? If • This study draws lessons from the World Bank’s field yes, to what extent? experiences and partially from mutual evaluation reports, 38 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Appendixes Appendix A. Financial Action Task Force Recommendation 1 Recommendation 1 on Assessing Risks and Applying a Risk-Based Approach Countries should identify, assess, and understand the money laundering and terrorist financing risks for the country and should take action, including designating an authority or mechanism to coordinate actions to assess risks and apply resources aimed at ensuring the risks are mitigated effectively. Based on that assessment, countries should apply a risk-based approach (RBA) to ensure that measures to prevent or mitigate money laundering and terrorist financing are commensurate with the risks identified. This approach should be an essential foundation to efficient allocation of resources across the Anti-Money Laundering and countering the financing of terrorism (AML/CFT) regime and the implementation of risk-based measures throughout the FATF Recommendations. Where countries identify higher risks, they should ensure that their AML/CFT regime adequately addresses such risks. Where countries identify lower risks, they may decide to allow simplified measures for some of the FATF Recommendations under certain conditions. Countries should also identify, assess, and understand the proliferation financing risks for the country. In the context of Recommendation 1, “proliferation financing risk” refers strictly and only to the potential breach, non-implementation or evasion of the targeted financial sanctions obligations referred to in Recommendation 7. Countries should take commensurate action aimed at ensuring that these risks are mitigated effectively, including designating an authority or mechanism to coordinate actions to assess risks, and allocate resources efficiently for this purpose. Where countries identify higher risks, they should ensure that they adequately address such risks. Where countries identify lower risks, they should ensure that the measures applied are commensurate with the level of proliferation financing risk, while still ensuring full implementation of the targeted financial sanctions as required in Recommendation 7. Countries should require financial institutions and designated non-financial businesses and professions (DNFBPs) to identify, assess and take effective action to mitigate their money laundering, terrorist financing and proliferation financing risks. Source: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation, The FATF Recommendations (updated March 2022). 39 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Appendix B. Financial Action Task Force Immediate Outcome 1 Effectiveness Assessment Criteria > > > FIGURE B.1. FATF High-Level Objective, Intermediate Outcomes, and Immediate Outcomes for Effectiveness High-Level Objective: Financial systems and the broader economy are protected from the threats of money laundering and the financing of terrorism and proliferation, thereby strengthening financial sector integrity and contributing to safety and security. Intermediate Outcomes: Immediate Outcomes: Money laundering and terrorist financing risks are understood and, 1 where appropriate, actions coordinated domestically to combat Policy, coordination and money laundering and the financing of terrorism and proliferation. cooperation mitigate the money laundering and International cooperation delivers appropriate information, financial financing of terrorism risks. 2 intelligence, and evidence, and facilitates action against criminals and their assets. Supervisors appropriately supervise, monitor and regulate financial 3 institutions, DNFBPs and VASPs for compliance with AML/CFT requirements commensurate with their risks. Proceeds of crime and funds in Financial institutions, DNFBPs and VASPs adequately apply AML/ support of terrorism are prevented 4 CFT preventive measures commensurate with their risks, and report from entering the financial and suspicious transactions. other sectors or are detected and reported by these sectors. 5 Legal persons and arrangements are prevented from misuse for money laundering or terrorist financing, and infomation on their beneficial ownership is available to competent authorities without impediments. 6 Financial intelligence and all other relevant information are appropriately used by competent authorities for money laundering and terrorist financing investigations. Money laundering offences and activities are investigated and 7 offenders are prosecuted and subject to effective, proportionate Money laundering threats are and dissuasive sanctions. detected and disrupted, and criminals are sanctioned and deprived of illicit proceeds. 8 Proceeds and instrumentalities of crime are confiscated. Terrorist financing threats are 9 Terrorist financing offenses and activities are investigated and detected and disrupted, terrorists persons who finance terrorism are prosecuted and subject to are deprived of resources, and effective, proportinate and dissuasive sanctions. those who finance terrorism are sanctioned, thereby contributing 10 Terrorists, terrorist organizations and terrorist financiers are to the prevention of terrorist acts. prevented from raising, moving and using funds, and from abusing the NPO sector. Persons and entities involved in the proliferation of weapons of mass 11 destruction are prevented from raising, moving and using funds, consistent with the relevant UNSCRs. Source: FATF 2021. Note: DNFBPs = designated nonfinancial businesses and professions; VASP = virtual assets service providers; AML = anti-money laundering; CFT = countering the financing of terrorism; NPO = nonprofit organization; UNSCRs = United Nations Security Council Resolutions. 40 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Characteristics of an effective system 1.4. To what extent are the objectives and activities of the A country properly identifies, assesses, and understands competent authorities and SRBs consistent with the its money laundering and terrorist financing risks, and evolving national AML/CFT policies and with the ML/ coordinates domestically to put in place actions to mitigate TF risks identified? these risks. This includes the involvement of competent 1.5. To what extent do the competent authorities and authorities and other relevant authorities; using a wide range SRBs cooperate and coordinate the development and of reliable information sources; using the assessment(s) implementation of policies and activities to combat of risks as a basis for developing and prioritizing AML/CFT ML/TF and, where appropriate, the financing of policies and activities; and communicating and implementing proliferation of weapons of mass destruction? those policies and activities in a coordinated way across 1.6. To what extent does the country ensure that respective appropriate channels. The relevant competent authorities also financial institutions, DNFBPs, and other sectors cooperate and coordinate policies and activities to combat the affected by the application of the FATF Standards are financing of proliferation. Over time, this results in substantial aware of the relevant results of the National ML/TF mitigation of money laundering and terrorist financing risks. Risk Assessment(s)? This outcome relates primarily to Recommendations 1, 2, 33, and 34, and also elements of R15. a) Examples of Information that could support the conclusions on Core Issues Note to Assessors 1. The country’s assessment(s) of its ML/TF risks (e.g., 1. Assessors are not expected to conduct an in-depth types of assessment(s) produced; types of assessment(s) review of, or assess the country’s assessment(s) of risks. published/communicated) Assessors, based on their views of the reasonableness of 2. AML/CFT policies and strategies (e.g., AML/CFT policies, the assessment(s) of risks, should focus on how well the strategies, and statements communicated/published; competent authorities use their understanding of the risks engagement and commitment at the senior officials and in practice to inform policy development and actions to political level) mitigate the risks. 3. Outreach activities to private sector and relevant 2. Assessors should take into consideration their findings authorities (e.g., briefings and guidance on relevant for this Immediate Outcome (IO) in their assessment of conclusions from risk assessment(s); frequency and the other IOs. However, assessors should only let their relevancy of consultation on policies and legislation, input findings relating to the cooperation and coordination of to develop risk assessment(s), and other policy products) measures to combat the financing of proliferation affect the assessments of IO11 and not of the other IOs. (i.e., b) Examples of Specific Factors that could support the IO2 to IO10) that deal with combating money laundering conclusions on Core Issues and terrorist financing. 4. What are the methods, tools, and information used to develop, review, and evaluate the conclusions of the assessment(s) of risks? How comprehensive are the Core Issues to be considered in determining information and data used? if the Outcome is being achieved 5. How useful are strategic financial intelligence, analysis, 1.1. How well does the country understand its ML/TF typologies, and guidance? risks? 6. Which competent authorities and relevant stakeholders 1.2. How well are the identified ML/TF risks addressed (including financial institutions and DNFBPs) are involved by national AML/CFT policies and activities? To what in the assessment(s) of risks? How do they provide inputs extent are the results of the assessment(s) of risks to the national level ML/TF assessment(s) of risks, and at properly used to justify exemptions and support what stage? the application of enhanced measures for higher- 7. Is the assessment(s) of risks kept up-to-date, reviewed risk scenarios, or simplified measures for lower-risk regularly, and responsive to significant events or scenarios? developments (including new threats and trends)? 1.3. To what extent are the results of the assessment(s) of 8. To what extent is the assessment(s) of risks reasonable risks properly used to justify exemptions and support and consistent with the ML/TF threats, vulnerabilities, and the application of enhanced measures for higher- specificities faced by the country? Where appropriate, risk scenarios, or simplified measures for lower-risk does it take into account risks identified by other credible scenarios? sources? 41 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT 9. Do the policies of competent authorities respond to destruction)? Does the mechanism or body include all changing ML/TF risks? relevant authorities? 10. What mechanism(s) or body do the authorities use to 11. Is interagency information sharing undertaken in a timely ensure proper and regular cooperation and coordination manner on a bilateral or multiagency basis as appropriate? of the national framework and development and 12. Are there adequate resources and expertise involved in implementation of policies to combat ML/TF, at both conducting the assessment(s) of risks and for domestic policy making and operational levels (and where relevant, cooperation and coordination? the financing of proliferation of weapons of mass Source: FATF 2021. Appendix C. Key Differences between NRAs and Mutual Evaluations National Risk Assessment Mutual Evaluation External assessment by FATF or FSRB assessment teams. Self-assessment by a national task force or working group that These assessment teams comprise four to seven foreign Assessors usually includes experts from all relevant state agencies and the experts from FATF or FSRB secretariats and member countries. private sector. The International Monetary Fund and the World Bank are also assessor bodies and conduct the evaluations of some countries. Complying with FATF Recommendations by understanding the Assessing the compliance of the country with FATF’s 40 Objective ML/TF risks in the country and building a risk-based AML/CFT Recommendations in terms of both technical compliance and regime. effectiveness. Is determined by the jurisdiction. A country is expected to conduct Decided by FATF or FSRBs. Happens once in an assessment the assessment of ML/TF risks before the mutual evaluation. The Timing round. The current round started in 2013 and is expected to end assessment and understanding of risks should be updated as in 2025. necessary. Depends on the NRA tool or methodology developed or used by Based on FATF’s official assessment methodology, which should Criteria the country. Each may have different criteria. be consistently applied in all assessments. An NRA report or other type of documentation about money Mutual Evaluation Report (MER). This report has a standard laundering risks. The countries may choose to publish these. format that lists and explains the country’s 40 technical Output Depending on the NRA methodology, the report may contain compliance and 11 immediate outcome ratings. MERs are always some ratings or scores. published. By exhibiting a good understanding of risks and effective If the country cannot pass a threshold in complying with the 40 implementation of a risk-based approach, the country expects Recommendations and 11 Immediate Outcomes, it becomes Outcome to receive a good rating mainly on Recommendation 1 and subject to enhanced monitoring, which may lead to gray listing or Immediate Outcome 1 (of 40 Recommendations and 11 blacklisting. Immediate Outcomes) in the Mutual Evaluation. Source: Cited, with adjustments, from Celik et al. 2020. Note: FATF = Financial Action Task Force; FSRB = FATF-style regional body; AML = anti-money laundering; CFT = countering the financing of terrorism; NRA = National ML/ TF Risk Assessment.  42 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Appendix D. NRA Survey Questions NRA SURVEY 1 – NRA SURVEY 2 – Conducted during the Training Conducted during the Dissemination Event on New NRA Tools for a World Bank Study on NRAs Date: May 6, 2022 Date: May 30, 2022 Participants: 268 Participants: 173 Jurisdictions: 60 Jurisdictions: 48 1. Please indicate your country. 1. How would you rate the effectiveness of your country’s last National ML/TF Risk Assessment? 2. Have you ever been involved in your country’s National Money Laundering/Terrorist Financing Risk Assessment? 2. What challenges may impact the quality of the next Yes NRA of your country if not addressed properly? (You No can indicate up to 4 options.) Lack of a risk assessment tool or methodology 3. Has your country ever used the World Bank’s NRA Lack of experience and knowledge Tool? Intervention from upper management Yes Lack of empowerment (of the NRA working group) No Resource-related challenges (i.e., time, staff) Not sure Unintended consequences on the country’s reputation Lack of political commitment 4. How would you rate the effectiveness of your Coordination problems country’s last National ML/TF Risk Assessment? Low 3. In your view, which crimes generate the highest Moderate amount of criminal proceeds in your jurisdiction? Substantial (Please rank from high to low.) High Human/migrant smuggling Drug trafficking 5. What should your authorities do differently in the Environmental (and wildlife) crimes next National ML/TF Risk Assessment to make it more Corruption (all types) effective than the past experience? Cybercrimes Open-ended. Tax fraud and evasion Other fraud (e.g., banking, insurance, ponzy schemes) 6. In your view, has the past NRA had any tangible impact Robbery and theft on the effectiveness of your AML/CFT system? No or minimal impact 4. Please indicate your country. Had partial impact Yes, it had a significant impact. 7. In your view, has your country built the capacity to do the next National ML/TF Risk Assessment without any external support (i.e., from the World Bank or IMF)? Yes, to a large extent Partially, support is still needed. No, significant support is needed. 43 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Appendix E. Supplementary Tables and Figures > > > T A B L E E . 1 . Immediate Outcome 1 Ratings in FATF and FSRBs Immediate APG CFATF EAG ESAAMLG FATF GABAC GAFILAT GIABA MENAFATF MONEYVAL Grand Total Outcome 1 High Effectiveness 1 1 2 Substantial Effectiveness 5 1 3 26 2 2 7 46 Moderate Effectiveness 9 6 3 5 10 3 5 17 58 Low Effectiveness 6 6 1 11 1 3 1 9 1 1 40 Total 20 14 4 14 33 3 13 12 8 25 146 Percentage in APG CFATF EAG ESAAMLG FATF GABAC GAFILAT GIABA MENAFATF MONEYVAL Overall each body High Effectiveness 0% 7% 0% 0% 3% 0% 0% 0% 0% 0% 1% Substantial Effectiveness 25% 7% 75% 0% 79% 0% 15% 0% 25% 28% 32% Moderate Effectiveness 45% 43% 0% 21% 15% 0% 77% 25% 63% 68% 40% Low Effectiveness 30% 43% 25% 79% 3% 100% 8% 75% 13% 4% 27% Source: Study data based on mutual evaluation reports. Note: Please note that the number of total members and assessed countries is quite low in some of the FSRBs, requiring caution in interpreting the percentage results in these countries. APG = Asia/Pacific Group on Money Laundering; CFATF = Caribbean Financial Action Task Force; EAG = Eurasian Group; ESAAMLG = Eastern and Southern Africa Anti-Money Laundering Group; FATF = Financial Action Task Force; FSRB = FATF-style regional bodies; GABAC = Action Group against Money Laundering in Central Africa; GAFILAT = Financial Action Task Force of Latin America; GIABA = Inter-Governmental Action Group against Money Laundering in West Africa; MENAFATF = Middle East and North Africa Financial Action Task Force; MONEYVAL = Committee of Experts on the Evaluation of AML/CFT. > > > T A B L E E . 2 . Recommendation 1 Ratings in FATF and FSRBs Recommen- APG CFATF EAG ESAAMLG FATF GABAC GAFILAT GIABA MENAFATF MONEYVAL Overall dation 1 Compliant 1 1 1 3 Largely Compliant 5 3 3 3 25 10 6 2 13 70 Partially Compliant 13 9 1 6 7 2 3 6 5 11 63 Non- compliant 2 1 5 1 1 10 Total 20 14 4 14 33 3 13 12 8 25 146 Percentage in APG CFATF EAG ESAAMLG FATF GABAC GAFILAT GIABA MENAFATF MONEYVAL Overall each body Compliant 0% 7% 0% 0% 3% 0% 0% 0% 0% 4% 2% Largely Compliant 25% 21% 75% 21% 76% 0% 77% 50% 25% 52% 48% Partially Compliant 65% 64% 25% 43% 21% 67% 23% 50% 63% 44% 43% Non- compliant 10% 7% 0% 36% 0% 33% 0% 0% 13% 0% 7% Source: Study data based on mutual evaluation reports. Note: Please note that the number of total members and assessed countries is quite low in some of the FSRBs, requiring caution in interpreting the percentage results in these countries. APG = Asia/Pacific Group on Money Laundering; CFATF = Caribbean Financial Action Task Force; EAG = Eurasian Group; ESAAMLG = Eastern and Southern African Anti-Money Laundering Group; FATF = Financial Action Task Force; FSRB = FATF-style regional bodies; GABAC = Action Group against Money Laundering in Central Africa; GAFILAT = Financial Action Task Force of Latin America; GIABA = Inter-Governmental Action Group against Money Laundering in West Africa; MENAFATF = Middle East and North Africa Financial Action Task Force; MONEYVAL = Committee of Experts on the Evaluation of AML/CFT. 44 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > F I G U R E E . 1 . Degree of Criticism Related to Immediate Outcome 1, by Number of Countries 9 NRA has not been completed. 7 7 7 NRA is not up-to-date. 8 28 64 Understanding of ML risks is not deep enough. 54 21 53 Understanding of the TF risks is not 42 deep enough. 28 1 Overall ML risk level is not justified. 2 5 6 Overall TF risk level is not justified. 11 20 National policies and/or strategies 69 40 are not risk based. 21 11 Exemptions or simplifications are not risk based. 29 48 Problems in dissemination/ 32 43 communication of the NRA results. 25 25 Deficiencies in data and statistics to 42 support the NRA. 29 21 Absence of or deficiencies in NPO 28 risk assessment. 15 34 Absence of or deficiencies in 26 legal persons risk assessment. 9 5 Criticism on methodological issues. 12 17 0 20 40 60 80 Number of jurisdictions Strong criticism (which explicitly affected the rating) Moderate criticism Lighter criticism Source: Study data based on mutual evaluation reports. Note: NRA = National ML/TF Risk Assessment; ML = money laundering; TF = terrorist financing; NPO = nonprofit organization; LP = legal person. 45 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > FIGURE E.2. Criticism on the Risk-Based Approach in IO1, IO4, and IO5, as a Percentage of the Assessed Jurisdictions 84% DNFBPs do not apply risk-based approaches. 99% 61% DNFBPs do not assess/understand their risks. 99% 40% Nonbank FIs do not apply risk-based approaches. 99% 24% Nonbank FIs do not assess/understand their risks. 97% 44% Understanding of ML risk is not deep enough. 95% 56% Legal persons risk assessment absent or deficient (including IO5). 94% 47% National policies and/or strategies are not risk based. 89% 36% Understanding of the TF risks is not deep enough. 84% 13% Banks do not apply risk-based approaches. 73% 22% Problems in dissemination/communication of the NRA results. 68% 17% Deficiencies in data and statistics to support the NRA. 66% 8% Exemptions or simplifications are not risk based. 60% 5% Banks do not assess/understand their risks. 58% 14% NPO risk assessment is absent or deficient. 44% 5% NRA is not up-to-date. 29% 4% Overall TF risk level is not justified. 25% 3% Criticism on methodological issues. 23% 6% NRA has not been completed. 16% 1% Overall ML risk level is not justified. 5% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Percentage of assessed countries Strong criticism (which explicitly affected the rating) Total criticism (strong, moderate, or light) Source: Study data based on mutual evaluation reports. Note: Affected rating means that the criticism affected the rating. IO1 = İmmediate Outcome 1; IO4 = Immediate Outcome 4; IO5 = Immediate Outcome 5; DNFBPs = designated nonfinancial businesses and professions; nonbank FIs = nonbank financial institutions; ML = money laundering; TF = terrorist financing; NRA = National ML/TF Risk Assessment; NPO = nonprofit organization; LP = legal person. 46 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > F I G U R E E . 3 . Spearman’s Correlations between Criticism Categories and IO1 Effectiveness Ratings National policies and/or strategies are not risk based. -0.68 Understanding of the TF risks is not deep enough. -0.64 Understanding of ML risks is not deep enough. -0.63 Problems in dissemination/communication of the NRA results. -0.54 NRA has not been completed. -0.42 NRA is not up-to-date. -0.34 Overall TF risk level is not justified. -0.36 Deficiencies in data and statistics to support the NRA. -0.31 Absence of or deficiencies in NPO risk assessment. -0.08 Absence of or deficiencies in legal persons risk assessment. -0.06 Criticism on methodological issues. 0.01 Overall ML risk level is not justified. 0.02 Exemptions or simplifications are not risk based. 0.00 -1 -0.75 -0.5 -0.25 0 0.25 0.5 0.75 1 Correlation coefficient Source: Study data based on mutual evaluation reports. Note: ML = money laundering; NPO = nonprofit organization; NRA = national risk assessment; TF = terrorist financing. > > > FIGURE E.4. Number of NRAs Completed by Jurisdiction as of Mutual Evaluation Onsite Visit Date 21% 4% Incomplete NRA 16% One NRA Two NRAs Three or more 59% Source: Study data based on mutual evaluation reports. Note: NRA = national risk assessment. 47 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT > > > FIGURE E.5. Frequency of NRA (in Jurisdictions with More than One NRA) 10 9 Number of jurisdictions 8 7 6 5 4 3 2 1 0 [0.0, 1.0] [1.0, 2.0] [2.0, 3.0] [3.0, 4.0] [4.0, 5.0] [5.0, 6.0] [6.0, 7.0] [7.0, 8.0] [8.0, 9.0] [9.0, 10.0] Number of years Source: Study data based on mutual evaluation reports. Note: Bins in x-axis exclude lower and include upper value. NRA = National ML/TF Risk Assessment. > > > FIGURE E.6. Number of Jurisdictions That Received NRA Support from the World Bank 95 10 9 Number of jurisdictions 8 7 6 5 4 3 19 2 12 1 4 0 Completed Ongoing Request received Dropped Status of the NRA engagement Source: World Bank Financial Stability and Integrity Team records. Note: NRA = National ML/TF Risk Assessment. > > > F I G U R E E . 7 . Number of the World Bank’s NRA Engagements, by Region 60 6 Number of jurisdictions 50 40 12 9 5 30 1 15 20 36 3 10 20 4 2 20 1 1 2 8 6 4 0 Africa East Asia and Europe and Latin America Middle East and South (Sub-Saharan) Pacific Central Asia and Caribbean North Africa Asia Completed Ongoing Requests Source: World Bank Financial Stability and Integrity Team records. Note: Numbers include updates and partial assessments. NRA = National ML/TF Risk Assessment. 48 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Appendix F. Perceptions Survey for National Risk Assessment Working Group Members 1. Do you think your country detects: 6. From which countries of origin do most illegal A. All incidents of money laundering? proceeds come to your jurisdiction (forming the B. Most incidents? biggest money laundering threat)? C. Some incidents? (Please rank the top 5 countries/regions that may be the D. Just a few incidents? main originators of the proceeds of crimes within your E. Almost none? jurisdiction.) … 2. What factors in your country hinder the effectiveness of the ML/TF regime? 7. Which countries/regions are the main destinations (Please identify the top 3 impediments.) for the proceeds of crimes from your jurisdiction? A. Political commitment (Please rank the 5 countries/regions that you consider B. Corruption the main destination countries.) C. Public awareness D. Laws and regulations 8. What are the high-risk sectors within your country? E. The FIU and its leadership And why? F. The supervisory agencies (Please rank the 5 sectors that you consider at the G. Law enforcement agencies highest risk of abuse for ML/TF purposes.) H. The prosecution/judicial system … I. Domestic or international cooperation J. Other matters… 9. What are the riskiest products/services in your country? And why? 3. Estimate the size of the proceeds of crime in your (Please rank the top 5 products/services that you country. consider to be at highest risk of abuse for ML/TF A. Low purposes.) B. Medium Low C. Medium 10. Is the terrorism risk in jour jurisdiction. D. Medium High A. Low? E. High B. Medium Low? C. Medium? 4. Which crimes are the main source of illicit proceeds D. Medium High? in your country? E. High? (Please list at least the top 5 criminal activities.) … 11. Is the terrorist financing risk in your jurisdiction. 5. Are these illicit proceeds generated within your A. Low country or abroad? B. Medium Low (Please identify the main pattern within your country.) C. Medium 1 2 3 4 5 D. Medium High E. High Proceeds Proceeds Proceeds Combination of Combination of generated and generated are gener- 1 and 3. 1, 2 and 3. also laundered abroad, but ated within the (or used) within country abused country but 12. epending on the terrorism and TF risk levels, please the country. for money transferred to discuss: laundering other countries (transit or final for launder- • The financial resources of the terrorist groups. destination). ing (and • Links with other countries, especially in terms of investment) purposes. terrorist financing. • Effectiveness issues in fighting against terrorist financing. 49 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Appendix G. Responses to the Survey Question, “What Would You Do Differently in a Future NRA?” (Unedited) • Be less dependent on the results and methodology of the • Request data upfront. previous NRA. • Provide more guidance to participants. • [Establish] more public-private and public-public • Seek a solution for the limited availability of human collaboration. resources to conduct the assessment. • Try to elicit better participation from more public competent • Ensure that everyone gets the opportunity to work on this authorities. and is focused. • Update the NRA with current data to ensure that it remains • Have participants that are able to allocate more time to the relevant. assessment. • Better scheduling and management of the overall risk- • Make use of statistics and gather data beforehand. assessment process. • While the effectiveness was substantial, some factors • Establish a formalized process to centralize and organize hindered the ability of the working group. It is always a information from different sources by establishing a complex situation to maintain participation. procedure enabling a central agency to obtain information from institutions and increased resource allocation • Broader participation. dedicated to the NRA. • More resources. • Ensure necessary resources are committed to the • The threat assessment should be much more efficient. assessment. • To pay more attention to the methodology of TF threats’ • Continue to improve and refine data and qualitative and vulnerabilities’ assessment, because we have no information. significant cases of TF. • Main NRA report (full report) should not be shortened as • The country should include all stakeholders that manage risk the previous time, so that all findings with all supporting relate to ML/TF, including the NPO sector and immigration reasons and priorities are expressed. as well as legal entities and legal arrangements. • Remedial actions and distribution of results to main actors • Bring in all relevant stakeholders. should be the top priority. • More stakeholders should be involved and more resources • Be more committed to collecting quality information and should [be] assigned for the assessment. data. • Some of the working group from the NRA should do the • Lack of appreciation from and/or coordinated efforts with the NRA genuinely. And some government offices should have executives of different stakeholders involved in the NRA. It to present genuine data. seems that middle management is always constrained by • Provide better training on NRA tools for members of the executive decisions. assessing groups. • Be more practical. • Bring all accountable institution into the scope. • Improve data capture and broaden the scope of • Mobilize relevant stakeholders; increase understanding of stakeholders involved. the process; collect more data; mobilize more resources; • Draft a more concise document. cover more sectors; improve the communication of results • Additional quantitative data is needed to make more to the wider audience. accurate assessments. Generally, the tool should be • Active participation and coordination from government more focused on leading the national agencies in which institutions is required as well as sharing information about quantitative data to use. identified patterns and trends in the use of financial services • Some modules should precede others or the same data and/or economic trades and professions. should be submitted to different modules. • Update the NRA with current information in order to expose • Enhance data collection systems. risks, and assess them in an opportune time. The previous NRA, when published, was no longer current. 50 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT • The establishment of a permanent agency solely • Effectively assess BO [beneficial ownership], NPOs, and responsible for conducting the assessment and monitoring/ tax crimes. overseeing the implementation of the action plan would go • Have in place an adequate data collection system. a long way in terms of effectiveness. • Ensure that relevant experienced officers are involved in • Alignment of definition of data collected. the exercise. • Earlier engagement to set out the details (timeline, • Collect more data. milestones, etc.) of the assessment. • The main lesson is that the Action Plan that is a product • Amendment of the law, involvement of more stakeholders, of the NRA should be completed by a country as much as etc. possible. • Put in more regarding terrorist financing risks, as well as • Assess all sectors in depth. more details around NPOs. • More data are needed. • Perhaps more engagement with the private sector. • NRA should also be able to detect low/lower risk area/ • Early focus on the structure of the final report. sectors. NRA focuses only on “AML/CFT obliged entities” • More outreach with industry prior to publication. sectors (e.g. what about other economic sectors?). This would help the application on simplified customer due • Complete targeted work by sector—taking on all FIs and diligence measures. DNFBPs at once is daunting. • Have up-to-date, quality data. • There is necessity to have more systematic and continuous approach to NRA (especially related to collection of • Increased understanding of TF and context will feed into statistics), to raise awareness on the importance of NRA the NRA. among heads of relevant institutions, and have devoted • Involve industry more, at all levels of seniority (i.e., heads and skilled working group representatives. of firms to compliance assistants). • We should conduct more capacity building for the staffs • Include a Proliferation Financing Risk Assessment. involved and provide practical experience to the people working on the NRA. • Address its [the country’s] vulnerability and deficiency, which are the result of the last assessment. • Be more specific in data and information to be collected to feed into the module. Be more engaged with experts and • Coordinate with all sectors to implement and follow the locals. AML legislation. • Improve their own legislation in accordance with AML Law. • More industry input. • There is need for political will. • More statistics, cooperation. • Recordkeeping is critical in assessment of the risk. • Ensure better communication and exchange of information between different modules. • Understanding of ML/TF across all stakeholders is equally important. • Include additional stakeholders, more coordination, etc. • Implementation of the recommendations of the report. • Interagency collaboration and prepare domestic stakeholders/authorities to understand ML/TF risks. • Assess all sectors. More sensitization and awareness about the process should be made. The understanding • Improve data sharing among different agencies. of the responding institutions has to be improved for • Have a timeframe. It must not take too long because the quality responses and timely submission of data and other risks are not static. By the time the NRA is finalized, it may information. not reflect the current material on the ground. • Tool given to managers, not technicians. • Ensure bottlenecks that hamstring the prosecution of serious corruption cases are resolved and that there is • Stakeholders’ focal points change. a proper bullet-proof process for registering NPOs to • Tool too complex to be mastered quickly. avoid the exploitation of gaps by terrorists, as well as a • Suggestions: train larger group of people including transparent entity registry. technicians, nominate a focal point within the World Bank • Provide more quantitative data, information, statistics, and to receive questions about the tool. case studies to substantiate the NRA methodology used. 51 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT • Ensure better coordination of information and have better • The has many issues which created a flawed NRA. One of political will. the biggest issues lies in understanding the risks associated with ML/TF, and the lack of knowledge on ML/TF within • Obtain cooperation from various role players. the government and private sector. More awareness in all • Understand the entire risk environment. forms is needed. • Interpret the data correctly. • Ensure that authorities and private entities provide more • Besides relevant government entities being part of this data for input in the Tool. Assess more risks such as VASPs process, the private sector, including financial institutions, and Proliferation Financing. DNFBPs, and VASPs should be included and should provide • Provide more data. their input/comments on the NRA from their perspective. • Build capacity in the awareness on ML/FT to relevant parties • To start early, involve all relevant role players, and update such as the DNFBP sector, including their supervision. at least every 2 years, as risk can change. • Analyses of data need to be improved and independent of • Some modules were too complicated. So, if World Bank can the sectors being analyzed. introduce simple modules, it will be useful to the countries that are having difficulties with collecting information from • There is need for more trainings on utilization of the Tool. formal sectors. • Increase budget for risk assessment. • Increase the number of stakeholders who take part in the • Provide more practical experiences. NRA. • Better planning, coordinating. • Consider all possible sources of money laundering and • Clearly explain the role of each member. terrorist financing risk, and involve many stakeholders in the risk assessment process. • Familiarize members on the NRA World Bank Toolkit. • Increase the number of shareholders who participate in • Strengthen controls to prevent and mitigate risks. NRA. • Improve the knowledge of the Final Beneficiary. • Concrete and clearly formulated questions regarding the • Consolidate Risk Management Systems. gathering of qualitative and quantitative information. • Use technologies that improve prevention systems. • Involve more DNFBPs during the NRA and try to gather as • Periodic self-assessments to apply the Risk-Based much data as possible. Approach. • Provide good-quality statistics. • Some new issues were not covered in the last NRA, such • Collect data/statistics. as VA [virtual asset], BO transparency, some contents • Share resources more freely and collaborate more actively. are limited. Thus, in the next NRA, our authorities should expand the scope of the NRA to cover new components • Plan adequately, get buy-in from higher level, provide and address the limitations of the last NRA. adequate and meaningful training to key players, allocate resources dedicated to the NRA tasks, and involve private • Focus more on data gathering and the identification of sector at the early stages. threats and linking those threats to sectoral vulnerabilities. • The authorities should ensure that the assessment is • Improve coordination. conducted by the most qualified persons and that measures • Consider all parameters and all new products. are put in place to sensitize the public of the assessment • It is important to include the private sector when conducting and to ensure participation. certain aspects of the NRA. Details about deficiencies in • [Improve] data coordination and follow up on Recommended supervising and monitoring the system need to be well Action items. managed so as to avoid possible abuse before authorities • Ensure the availability of data. Ensure all stakeholders and remediate gaps. private sector fully understand the process and perhaps • Keep the data collection timeframe short and focused, and are exposed to some training at the outset. develop clear information requests/questionnaires for data collection. 52 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Appendix H. Recommendation 33 Ratings and Data and Statistics-Related Criticism in Immediate Outcome 1 > > > T A B L E H . 1 . Discrepancies between Data-Related Issues in IO1 and R33 Ratings Criticism (in Immediate Outcome 1) (CFATF) Country for deficiencies in data and statistics Caribbean Financial to support the NRA Action Task Force. Armenia Explicit impact on IO 1 rating C Cabo Verde Explicit impact on IO 1 rating C Andorra Explicit impact on IO 1 rating LC Burkina Faso Explicit impact on IO 1 rating LC Costa Rica Explicit impact on IO 1 rating LC Cuba Explicit impact on IO 1 rating LC Gambia, The Explicit impact on IO 1 rating LC Isle of Man Explicit impact on IO 1 rating LC Nicaragua Explicit impact on IO 1 rating LC Suriname Explicit impact on IO 1 rating LC Sweden Explicit impact on IO 1 rating LC Turks and Caicos Islands Explicit impact on IO 1 rating LC Malta Moderate criticism in IO 1 C Paraguay Moderate criticism in IO 1 C St. Kitts and Nevis Moderate criticism in IO 1 C Bahrain Moderate criticism in IO 1 LC Belarus Moderate criticism in IO 1 LC Benin Moderate criticism in IO 1 LC Kyrgyz Republic Moderate criticism in IO 1 LC Lithuania Moderate criticism in IO 1 LC Netherlands Moderate criticism in IO 1 LC Niger Moderate criticism in IO 1 LC Portugal Moderate criticism in IO 1 LC Serbia Moderate criticism in IO 1 LC Sierra Leone Moderate criticism in IO 1 LC South Africa Moderate criticism in IO 1 LC Tajikistan Moderate criticism in IO 1 LC Tonga Moderate criticism in IO 1 LC Türkie Moderate criticism in IO 1 LC United Arab Emirates Moderate criticism in IO 1 LC United Kingdom Moderate criticism in IO 1 LC Source: Study data based on mutual evaluation reports. Note: C = compliant; LC = largely compliant; IO1 = Immediate Outcome 1; NRA = National ML/TF Risk Assessment; R33 = Recommendation 33 (statistics). 53 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Appendix I. Excerpts from Mutual Evaluation Reports of Jurisdictions Commended for Their Risk Assessments Antigua and Barbuda For the completion of the NRA, Antigua and Barbuda demonstrated that both the public and private sectors stakeholders were involved in the process and were part of the various working groups (p.9). The Assessors considered the results and conclusions of the NRA as reasonable as they covered a wide spectrum of the ML/TF regime of Antigua and Barbuda (p. 23). The NRA process involved the participation of a wide array of persons including representatives from both the public and private sector; and involved contributions from high-ranked government officials to the process. The involvement of the latter demonstrates the country’s commitment at the highest level in completing the process (p. 34). A considerable amount of resources and efforts were invested by the jurisdiction to collect and analyse information and data (p. 36). Aruba There is a good understanding of the ML/TF risks among most competent authorities. The understanding of the ML/TF risks is based on the published findings of the ML/TF/PF NRAs, sectoral risk assessments conducted by the CBA, participation in regional typology exercises and the NRAs, ML/TF risk assessments conducted by the FIs and DNFBPs and the institutional knowledge and expertise of various competent authorities, primarily LEAs, the PPO, the FIU and CBA. The foregoing has resulted in a shared understanding among most competent authorities of the higher risk issues that have an impact on the jurisdiction (p. 39). The 2021 NRAs involved participation of public and private sector officials and the findings are considered to be reasonable. The NRAs considered a wide cross-section of threats and vulnerabilities (p. 12). Inadequate statistics, lack of information pertaining to financial inflows and outflows and lack of data on the informal economy were some of the main challenges experienced by competent authorities in the conduct of the 2021 NRAs. However, the challenges experienced did not significantly impact the conduct and outcomes of the NRAs, as these were mitigated by alternative sources of information, for example, qualitative data such as case studies on ML investigations and prosecutions, and publications from regional and international organisations and countries, including the FATF and the USA (p. 39). The assessors found that there was a shared understanding of ML/TF risks, most importantly the higher risk issues as reflected in the NRAs, among most competent authorities (p. 41). The assessors found that the authorities were honest in the conduct of the NRAs, as challenges, including the absence of statistics in some instances (ML investigations and prosecutions by LEAs and the PPO) and lack of information on the informal economy and financial flows were clearly cited (p. 43). 54 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Bermuda The NRA processes undertaken by the jurisdiction were well structured, and the conclusions were reasonable. The onsite interviews confirmed the involvement of a wide range of government agencies, and the private sector in the NRA process (p. 17). Bermuda has successfully demonstrated that the ML/TF risks in each of its regulated sectors have been identified, analysed and understood. Bermuda’s NRA process has established a basis for the DNFBPs, private sector and government agencies to understand the jurisdiction’s ML/TF risks (p. 31). Bermuda has taken significant steps and has comprehensively engaged all critical stakeholders to fairly assess their ML/TF risks and as a result, Bermuda’s assessments of ML/TF risks, especially in the 2016 and 2017 NRAs were reasonable, credible and comprehensive. The efforts undertaken by NAMLC and all supervisory authorities to engage and communicate with relevant stakeholders about the results of the 2016 and 2017 NRAs, as well as the appropriate steps to be taken in relation to these findings, has resulted in CAs, the SRB and private sector stakeholders having a very robust understanding of sectoral and national ML/TF risks (p. 34). Bermuda took a comprehensive approach in conducting its NRA as private and public-sector officials participated in working groups to identify and assess the jurisdiction’s ML/TF risks. The majority of the FIs, DNFBPs and NPOs interviewed during the onsite visit confirmed that they were aware of the NRA which provided an enhanced understanding of the potential risk and vulnerabilities that in some instances were already identified through their own risk assessments (p. 39). Bermuda’s CAs properly identify, assess and understand existing and emerging ML and TF risks on a continuous basis, and co-ordinate appropriate actions domestically to mitigate these risks (p. 39). Canada The authorities have a generally good level of understanding of Canada’s main ML/TF risks. The public version of the 2015 NRA is of good quality. It is based on dependable evidence and sound judgment, and supported by a convincing rationale. In many respects, the NRA confirmed the authorities’ overall understanding of the sectors, activities, services and products exposed to ML/TF risk (p. 7). Canada’s NRA is comprehensive, and also takes into account some activities not currently subject to the AML/CFT measures (p. 33). The authorities demonstrated a sound understanding of the issues highlighted in Chapter 1, including a good understanding of the linkages between the threats and inherent vulnerabilities of the different sectors and the domestic and foreign offenses that are a source of most of the ML/TF in the country. The NRA process has also contributed to a deeper understanding of the powers, resources and operational needs of all regime partners (p. 34). Canada’s ML/TF Inherent RA is supported by a documented NRA Methodology with defined concepts on ML/TF risks and rating criteria (p. 117). The NRA consists of an assessment of the inherent (that is, before the application of any mitigation measures) ML/TF threats and inherent ML/TF vulnerabilities of key economic sectors and financial products, while considering the contextual vulnerabilities of Canada, such as geography, economy, financial system and demographics (p. 117). 55 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Cyprus Cyprus published its first National Risk Assessment (NRA) in October 2018 with the participation of all relevant competent authorities and the involvement of private sector entities (p. 17). During the process, information, including statistical data, was provided by stakeholders across the public and private sectors. Reports issued by MONEYVAL and other relevant reports from independent sources were also taken into consideration (p. 17). There was also a significant increase in the quantity and quality of information available at the time of the assessment team’s visit to Cyprus compared with post 2013 (p. 29). The assessment was based on public sector and private sector workshops, surveys and interviews and the analysis of a wide set of qualitative and quantitative data (p. 193). Ghana The process for the conduct of the NRA was inclusive, involving all critical stakeholders in the public and private sectors thus, ensuring a broad understanding of the ML/TF risks and improvement in inter-agency cooperation and collaboration on ML/TF issues (p. 39). The public version of the 2016 NRA is of good quality. It is based on dependable evidence and sound judgment and supported by a convincing rationale. In many respects, the NRA confirmed the authorities’ overall understanding of the sectors, activities, services and products exposed to ML/TF risk (p. 13). The country adopted a research-based approach, using people who are very knowledgeable on the subject and deploying tools provided by the World Bank to capture data from relevant sectors of society (p. 42). Greece Greece completed its first National Money Laundering and Terrorist Financing Risk Assessment (NRA) in May 2018, which provides a high-level overview of a range of ML threats and risks in Greece, including areas thought to pose low risk (p. 155). The working groups considered both qualitative and quantitative data, including information publicly available and obtained through their supervisory actions, and private sectors’ response to a questionnaire. They also conducted interviews with experts and consulted relevant members of the private sector to evaluate the individual threat and vulnerability variables. The groups also considered the EU supranational risk assessment (pp. 36–37). The NRA covers both ML and TF and identifies major threats, ML/TF risk enhancing and reducing factors, and provides a final residual risk rating (i.e., taking into account AML/CFT measures in place) to financial and nonfinancial sectors operating in Greece (p. 21). 56 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Hong Kong SAR, China HKC [Hong Kong SAR, China] has a reasonably good level of understanding of its ML/TF risks. This understanding is largely informed by the territory-wide risk assessment exercise which was developed over several years and culminated in the HRA (published in April 2018) (p. 37). HKC has separately assessed its TF threats and vulnerabilities and has a good understanding of its TF risk. This was informed by both the HRA exercise and more importantly, additional analysis based on investigations of potential TF and intelligence from the FSCCT, which sits within the HKPF and assesses intelligence from all relevant LEAs (p. 39). The risk assessment is generally comprehensive and demonstrates HKC has identified and assessed most of the ML/TF risks in HKC (p. 165). Some competent authorities (e.g., the HKPF, the HKMA) have conducted their own targeted assessments which have a positive effect on HKC’s overall risk understanding (p. 35). Indonesia In 2021, Indonesia conducted a holistic risk assessment of ML/TF/PF, with the involvement of a number of ministries, law enforcement authorities, supervisory agencies and regulators, reporting entities and trade bodies and associations. Indonesia also engaged with academics and subject matter experts in developing the 2021 risk assessment (p. 16). In addition, since 2015 to 2022, Indonesia have undertaken eighty-seven separate NRAs, regional risk assessments and sectoral or strategic risk assessments (SRAs) (p. 16). Indonesia has demonstrated strong political commitment to establishing and maintaining a robust AML/CFT system, which is subject to proactive development. This commitment is underpinned by, and reflected in, the significant work undertaken for almost ten years to identify, assess and understand ML/TF risks. . . . Overall, Indonesia has a good understanding of its ML/TF risks, as reflected in NRAs and a number of sectoral and thematic risk assessments (SRAs). . . . This systematic and routine approach to updating the NRAs is commendable (p. 28). The depth of discussions with the AT emphasised that understanding was greater than the contents of the numerous risk assessments and reports published by Indonesia. . . . The AT considers that there is a strong understanding of the effects of the COVID-19 pandemic on risk (p. 29). Ireland Ireland’s NRA is focused on the residual risks, with the “consequences component being regarded as constantly significant”. The report identified a range of specified threats and vulnerabilities that it is facing. The results, which are based on multi-sectoral workshops and the discussions of the Anti-Money Laundering and Steering Committee (AMLSC), take into account the observed experience of competent authorities and input of the private sector including via surveys. The Private Sector Consultative Forum (PSCF), formed in March 2015, also assisted in providing private sector feedback on risks (p. 34). The NRA exercise relies strongly on qualitative information and uses some quantitative data such as size of the sector, STR information, confiscated or seized proceeds of crime and general investigative data. The NRA exercise has sought to supplement its risk understanding through its regular participation at the FATF working groups, EUROPOL, other international fora, and through the EU risk assessment exercise (although this had yet to be completed at the time of the on-site) (p. 34). 57 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT The steering committee’s sub-group on NRA will continue to meet frequently (approximately every six to eight weeks) and is intended to feed into ongoing sectoral risk assessments by competent authorities (p. 129). Isle of Man The NRA process, which was a multi-stakeholder exercise, was conducted very diligently and transparently by the authorities, backed by political commitment at the highest level. Where data and information was missing, this was acknowledged in the NRA document itself. Efforts were made to minimise the impact on risk understanding resulting from information gaps. Besides the NRA, the understanding of vulnerabilities within the financial sector (including TCSPs) is supported by years of supervisory experience (p. 36). The authorities endeavoured to conduct a candid assessment of the institutional vulnerabilities, which has resulted in the identification of important gaps in the national system. This has enabled the authorities to undertake a number of targeted measures and allocate resources where needed (p. 32). The process appears to have been conducted very diligently. The NRA contains sound conclusions on the sectors which are considered to represent a higher risk within the specific context of the IoM [Isle of Man] (p. 18). Israel Representatives from all law enforcement, intelligence community, supervisory authorities, and the private sector (e.g., financial institutions, diamond dealers, and the Israel Bar Association (IBA) were involved in the process (p. 20). Private sector entities, including all licensed entities, participated in the NRA. As the ML/TF risks facing Israel are complex and multi-faceted, the NRA enabled Israel not only to consolidate and articulate existing knowledge, but also to develop its understanding in various areas, including fraud, real estate, and legal arrangements in particular (p. 37). The private sector played an important role by providing a significant amount of data on identified ML and TF sectorial risks, but also the type and nature of services provided and customer, as well as on mitigation measures take (p. 21). Notably, the assessment material considers all three elements of risk, namely threat, vulnerability, and consequence. In general, the depth of the process is at the top end of the NRA processes which have been undertaken internationally (p. 36). In addition to these NRAs, Israel also conducted a number of sectoral and thematic assessments (e.g., gambling, alternative payment systems, MSBs and use of cash) and assessments of issues relevant to ML/TF (p. 179). Republic of Korea Korea’s risk understanding is informed by an ongoing risk assessment process that has resulted in three NRAs (2014, 2016 and 2018) supplemented by additional assessments in specific areas. Each NRA reflects lessons from the previous NRA, resulting in ongoing improvements to the risk assessment process and an improved assessment and understanding of Korea’s risks (p. 35). The 2018 NRA process received input from a wide range of relevant government agencies and private sector institutions, resulting in a broad and consistent risk understanding in line with the NRA (p. 35). 58 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT The NRA identified risks based on qualitative and quantitative data provided by agencies and the private sector. Preliminary findings were then tested and further refined through discussions among the agencies to identify any gaps. The methodology for the 2018 NRA was broad, employing a “CELF” approach (p. 37). Discussions with the authorities emphasised Korea’s strong focus on understanding its emerging and evolving risks. Each NRA took a slightly different approach with Korea applying the lessons learned in the previous NRA to improve and enhance the methodology for the next one (p. 36). Moldova The NRA was developed using the World Bank methodology and with the participation of all relevant stakeholders (incl. Government authorities and the private sector) and using comprehensive data and information. The NRA constitutes a solid base for the domestic understanding of identified ML/FT threats, vulnerabilities and risks (p. 32). the NRA provides a sound picture of the main ML threats and the features of the internal and external money flows which is consistent with the risks identified by other (credible) sources (p. 35). A number of law enforcement, supervisory and other public authorities, and private sector were involved. This inclusive approach facilitated the analysis of the different categories of data and information provided by the authorities and associations (p. 33). To address the methodological and procedural difficulties encountered during the assessment process, the authorities included a distinct chapter on actions to improve the statistical data, and respective remedial measures have been included in the Action Plan (p. 34). New Zealand New Zealand has a robust understanding of its ML/TF risks and has established a comprehensive multi-tiered risk assessment process. This includes their NRA and four sectoral risk assessments (SRAs). The NRA is comprehensive and systematic in its identification of New Zealand’s ML/ TF risks and has been refined over successive updates, though there is scope for further minor improvements (p. 8). At the second tier, the supervisors (RBNZ, FMA and DIA) produce more specific assessments of the risks faced by the sector they each supervise (SRAs). The SRAs are informed by the findings of the NRA. At the bottom tier, reporting entities are required by the AML/CFT Act to produce their own risk assessments (p. 35). New Zealand authorities share a sound understanding of their risks, with the results of the NRA and SRAs communicated to all stakeholders in a systemic manner (p. 33). The methodology of the NRA is sound, producing a multi-dimensional assessment of domestic and international threats, vulnerabilities and the potential impact of these on the objectives of the AML/CFT Act (p. 35). The NRA uses quantitative and qualitative data from a range of public and non-public sources to identify and analyse the major domestic and international ML/TF risks. The NRA process uses case studies, international studies, intelligence, and information from the NZPFIU, LEAs and the supervisors and input from reporting entities to identify major domestic and international ML/TF risks (p. 35). 59 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT The FIU is also the lead for the Police’s public-private partnership with reporting entities, the Financial Crime Prevention Network (FCPN), which was formally established in October 2018. The FCPN consists of the NZPFIU, five major banks in New Zealand, Customs and RBNZ (p. 42). Philippines The Philippines has reasonably assessed a range of its ML/TF risks in iterations of national risk assessments (NRAs), serious and organized crime threat assessments (SOCTAs) and various stand-alone risk assessments or strategic analyses such as for NPOs, virtual currency, external threats and cross-border fraud, tactical analysis and regional assessments on TF (including foreign terrorist fighters (FTF), though some gaps remain (p. 38). For the 2017 NRA in particular, the cumulative effect of various sectoral assessments by respective working groups, which consisted of relevant supervisors, added depth to the assessment (p. 40). These gaps were somewhat mitigated through the assessment of qualitative information, including surveys and other literature, as well as expert interviews and national validation workshops (p. 40). The Philippines has reasonably assessed its ML risk through various iterations of risk assessments (NRAs or other assessments) which have drawn from the data and experience of multiple stakeholders. Further, the understanding of risk has been supplemented by various topical risk assessments (p. 49). Russian Federation Russian authorities have a very developed understanding of the country’s ML/TF risks. Identification and assessment of ML/TF risks is done as a systemic exercise, which benefits from the high-level political commitment and the participation of all major stakeholders from both the public and the private sectors. The ML NRA uses a large amount of quantitative and qualitative data from a multiplicity of public and non-public sources. The methodology of the ML NRA is generally sound, although some improvements can be made (p. 31). The ML risks identified seem comprehensive and reasonable. The authorities met on-site demonstrated advanced understanding of and clear views on the constituents of risk, are aware of the most relevant countrywide and sector-specific risks, including the applicable risk scenarios, methods, and tools (p. 8). Qualitative information analysed includes independent reports from the IMF, World Bank and other international organisations, expert judgments from supervisors, LEAs and other key stakeholders, and responses to perception surveys from the private sector and self-regulatory bodies (SROs) (p. 33). San Marino The results of the NRAs generally appear reasonable to ensure that the ML/TF risks are properly identified and assessed (p. 172). There is a strong political commitment of San Marino’s government for the National ML/TF Risk Assessment process and the adoption of a National AML/CFT Strategy (p. 45). The understanding of the main ML risks and methods identified in the 2019 NRA is equal across authorities due to close involvement in the NRA exercise. In general, the 2019 NRA is of a very good quality (p. 38). 60 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Saudi Arabia Saudi Arabia has a solid understanding of its ML and TF risks, based on a robust risk assessment process and a wide range of information. Saudi authorities have produced two parallel National Risk Assessments (NRAs) of ML and TF risks (p. 8). Based on its national risk assessments, Saudi Arabia has a good understanding of its ML risks and a very good understanding of its TF risks. The NRAs benefited from wide participation by authorities, good access to information and a sophisticated analytic approach (p. 33). The NRA used a wide range of information including statistical data and reports from all relevant agencies; academic studies of vulnerabilities; outcomes of criminal investigations; reports from international organisations, strategic analysis by the FIU, and self-assessments of vulnerabilities, with bilateral meetings and workshops used to gather and understand the information (p. 34). The assessment used diverse quantitative and qualitative data in order to avoid confirmation bias, coding qualitative responses in order to reflect them in the analysis (p. 34). The main sources of information used to develop to the TF NRA were the results of TF investigations. . . . This exceptionally large number of cases (530 cases) gives Saudi Arabia a uniquely rich pool of information to use as the basis for a detailed evaluation of its TF risks, trends, and methods. This has been supplemented by other sources of information on vulnerabilities and methods, as well as the ML NRA (p. 35). Spain Spain demonstrates a high level of understanding of its ML/TF risks which is informed by a wide variety of good quality risk assessments from several sources, although these have not been brought together in a single national risk assessment (which is not a deficiency). Spain has developed a sound AML/CFT strategy, using its understanding of the ML/TF risks to inform both its policy and operational objectives and activities (p. 9). The detailed basis for each assessment is different, but in general they use multiple sources of information and data, apply well-developed analytic methods, and have inter-agency input to their conclusions (p. 38). The risk assessments provided to assessors were high quality, in particular by providing specific and operationally relevant conclusions to their primary users (p. 38). The sectoral and geographical assessments reviewed by the team are of good quality, use multiple sources of information, are prepared through inter-agency processes, identify and assess important ML/TF risks, and set out operationally-relevant conclusions (p. 139). United Kingdom The UK’s ML/TF risk assessments and understanding of risk is informed by a wide range of qualitative and quantitative data, including the experience of the relevant competent authorities and feedback from the private sector (p. 35). The UK has a robust understanding of its ML/TF risks as reflected in its public NRAs and shared across UK government departments, LEAs, and regulatory agencies. Generally, financial institutions and DNFBPs appear to understand their risk as framed in the NRA and use it to inform their own risk assessments (p. 35). 61 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT UK agencies and regulators were particularly sensitive to evolving risks and new and emerging threats. The authorities acknowledged that, like all risk assessments, the 2017 NRA represents a snapshot in time which must be complemented by ongoing work to maintain an up-to-date understanding of emerging risks. For this reason, they emphasised the importance of conducting ongoing risk and threat assessments to ensure an up-to-date picture of the UK’s risk profile (p. 36). The UK’s understanding of TF is similarly comprehensive and consistent (p. 36). HMT and the Home Office are required to take appropriate steps to ensure that the risk assessment is kept up to date. Other government agencies (including the NCA) produce multiple assessments each year on areas of high risk (p. 176). 62 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT References Celik, Kuntay. 2021. Impact of the FATF Recommendations and Their Implementation on Financial Inclusion: Insights from Mutual Evaluations and National Risk Assessments. Washington, DC: International Bank for Reconstruction and Development/World Bank. Celik, Kuntay, I. E. Zuccardi, J. Ferwerda, and D. Sevinc. 2020. “What Do National Risk Assessments on Money Laundering Tell Us? A Quantitative Analysis.” Internal report for the Financial Stability and Integrity unit, World Bank. FATF (Financial Action Task Force). 2004. The Forty Recommendations. Paris: FATF. June. https://www.fatf-gafi.org/en/publications/Fatfrecommendations /The40recommendationspublishedoctober2004.html. FATF (Financial Action Task Force). 2012. International Standards on Countering Money Laundering and the Financing of Terrorism and Proliferation—The FATF Recommendations. Paris: FATF. February. https://www.fatf-gafi.org/en/publications/Fatfrecommendations /Fatf-recommendations.html. FATF (Financial Action Task Force). 2013. FATF Guidance: National Money Laundering and Terrorist Financing Risk Assessment. Paris: FATF. February. https://www.fatf-gafi.org/content/fatf-gafi/en/publications/Methodsandtrends /Nationalmoneylaunderingandterroristfinancingriskassessment.html. FATF (Financial Action Task Force). 2019. Terrorist Financing Risk Assessment Guidance. Paris: FATF. July. https://www.fatf-gafi.org/en/publications/Methodsandtrends /Terrorist-financing-risk-assessment-guidance.html. FATF (Financial Action Task Force). 2021. Methodology for Assessing Compliance with the FATF Recommendations and the Effectiveness of AML/CFT Systems. Update of 2013 document. Paris: FATF. http://www.fatf-gafi.org/publications/mutualevaluations/documents /fatf-methodology.html. FATF (Financial Action Task Force). 2022. Report on the State of Effectiveness and Compliance with the FATF Standards. Paris: FATF. April. https://www.fatf-gafi.org/en /publications/Fatfgeneral/Effectiveness-compliance-standards.html. 63 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Ferwerda, Joras, and Edward R. Kleemans. 2019. “Estimating Money Laundering Risks: An Application to Business Sectors in the Netherlands.” European Journal on Criminal Policy and Research 25: 45–62. https://doi.org/10.1007/s10610-018-9391-4. Ferwerda, Joras, and Peter Reuter. 2019. “Learning from Money Laundering National Risk Assessments: The Case of Italy and Switzerland.” European Journal on Criminal Policy and Research 25: 5–20. https://doi.org/10.1007/s10610-018-9395-0. Ferwerda, Joras, and Peter Reuter. 2022. National Assessments of Money Laundering Risks: Learning from Eight Advanced Countries’ NRAs. Washington, DC: International Bank for Reconstruction and Development/World Bank. Hopkins, Matt, and Nikki Shelton. 2019. “Identifying Money Laundering Risk in the United Kingdom: Observations from National Risk Assessments and a Proposed Alternative Methodology.” European Journal on Criminal Policy and Research 25: 63–82. https://doi.org/10.1007/s10610-018-9390-5. Levi, Michael, Peter Reuter, and Terence Halliday. 2018. “Can the AML System Be Evaluated without Better Data?” Crime, Law and Social Change 69: 307–28. https://doi.org/10.1007/s10611-017-9757-4. Savona, Ernesto U., and Michele Riccardi, eds. 2017. Assessing the Risk of Money Laundering in Europe: Final Report of Project IARM. Milan, Italy: Transcrime, Università Cattolica del Sacro Cuore. www.transcrime.it/iarm. Unger, Brigitte, Melissa Siegel, Joras Ferwerda, Wouter de Kruijf, Madalina Busuioic, Kristen Wokke, and Greg Rawlings. 2006. “The Amounts and the Effects of Money Laundering: Report for the Ministry of Finance.” Utrecht School of Economics, the Netherlands. February. Unger, Brigitte, and Frans Van Waarden. 2013. “How to Dodge Drowning in Data? Rule- and Risk-Based Anti-money Laundering Policies Compared.” Chapter 29 in Research Handbook on Money Laundering, edited by Brigitte Unger and Daan van der Linde, 399–425. Cheltenham, UK: Edward Elgar. World Bank. 2015. National Money Laundering and Terrorist Financing Risk Assessment Toolkit: Generic National ML/TF Risk Assessment Tool. Washington, DC: World Bank. https://www.worldbank.org/en/topic/financialmarketintegrity/brief/national-money-laundering -and-terrorist-financing-risk-assessment-toolkit-disclaimer-and-terms-of-use. World Bank. 2021. The Impact of the FATF Recommendations and Their Implementation on Financial Inclusion. Washington, DC: World Bank. https://documents.worldbank.org/en /publication/documents-reports/documentdetail/597781637558061429/impact-of-the-fatf -recommendations-and-their-implementation-on-financial-inclusion-insights-from-mutual -evaluations-and-national-risk-assessments. World Bank. 2022. National Money Laundering and Terrorist Financing Risk Assessment Toolkit: Specific National ML/TF Risk Assessment Tools. Washington DC: World Bank. https://www.worldbank.org/en/topic/financialmarketintegrity/brief/national-money-laundering -and-terrorist-financing-risk-assessment-toolkit-disclaimer-and-terms-of-use. 64 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT Mutual Evaluation Reports of: 1 Albania Aug/21 44 Finland Apr/19 2 Andorra Sep/17 45 France May/22 3 Antigua and Barbuda Jul/18 46 Gambia, The Oct/22 4 Armenia Jan/16 47 Georgia Sep/20 5 Aruba Jul/22 48 Germany Aug/22 6 Australia Apr/15 49 Ghana Apr/18 7 Austria Sep/16 50 Gibraltar Dec/19 8 Bahamas, The Aug/17 51 Greece Sep/19 9 Bahrain Sep/18 52 Grenada Jul/22 10 Bangladesh Nov/16 53 Guatemala Feb/17 11 Barbados Feb/18 54 Guinea-Bissau May/22 12 Belarus Dec/19 55 Haiti Jul/19 13 Belgium Apr/15 56 Holy See Aug/21 14 Benin Sep/21 57 Honduras Jan/17 15 Bermuda Jan/20 58 Hong Kong SAR, China Sep/19 16 Bhutan Oct/16 59 Hungary Sep/16 17 Botswana May/17 60 Iceland Apr/18 18 Bulgaria Jul/22 61 Indonesia Mar/23 19 Burkina Faso May/19 62 Ireland Sep/17 20 Cabo Verde May/19 63 Isle of Man Dec/16 21 Cambodia Sep/17 64 Israel Dec/18 22 Cameroon Mar/22 65 Italy Feb/16 23 Canada Sep/16 66 Jamaica Jan/17 24 Cayman Islands Mar/19 67 Japan Aug/21 25 Chile Sep/21 68 Jordan Jan/20 26 China Apr/19 69 Kenya Jan/23 27 Colombia Nov/18 70 Korea, Rep. Apr/20 28 Congo, Dem. Rep. Apr/21 71 Kyrgyz Republic Sep/18 29 Congo, Rep. Sep/22 72 Latvia Jul/18 30 Cook Islands Sep/18 73 Liechtenstein Jul/22 31 Costa Rica Dec/15 74 Lithuania Feb/19 32 Croatia Feb/22 75 Macao SAR, China Dec/17 33 Cuba Dec/15 76 Madagascar Sep/18 34 Cyprus Dec/19 77 Malawi Sep/19 35 Czech Republic Feb/19 78 Malaysia Sep/15 36 Denmark Aug/17 79 Mali Mar/20 37 Dominican Republic Sep/18 80 Malta Jul/19 38 Ecuador Jan/23 81 Mauritania Nov/18 39 Egypt, Arab Rep. Aug/21 82 Mauritius Jul/18 40 Estonia Jan/23 83 Mexico Jan/18 41 Eswatini Aug/22 84 Moldova Jul/19 42 Ethiopia Jun/15 85 Monaco Jan/23 43 Fiji Nov/16 86 Mongolia Sep/17 65 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT 87 Morocco Jun/19 132 Trinidad and Tobago Jun/16 88 Mozambique Jun/21 133 Tunisia Jun/16 89 Myanmar Sep/18 134 Türkiye Dec/19 90 Namibia Jan/23 135 Turks and Caicos Islands Jan/20 91 Netherlands Aug/22 136 Uganda Sep/16 92 New Zealand Apr/21 137 Ukraine Jan/18 93 Nicaragua Oct/17 138 United Arab Emirates Apr/20 94 Niger Nov/21 139 United Kingdom Dec/18 95 Nigeria Nov/21 140 United States Dec/16 96 Norway Dec/14 141 Uruguay Jan/20 97 Pakistan Oct/19 142 Uzbekistan Aug/22 98 Palau Sep/18 143 Vanuatu Oct/15 99 Panama Jan/18 144 Vietnam Feb/22 100 Paraguay Nov/22 145 Zambia Jun/19 101 Peru Feb/19 146 Zimbabwe Jan/17 102 Philippines Oct/19 103 Poland Feb/21 104 Portugal Dec/17 105 Qatar Mar/23 106 Russian Federation Dec/19 107 Saint Lucia Jan/21 108 Samoa Oct/15 109 San Marino Jul/21 110 Saudi Arabia Sep/18 111 Senegal May/18 112 Serbia Apr/16 113 Seychelles Sep/18 114 Sierra Leone Jan/21 115 Singapore Sep/16 116 Slovak Republic Sep/20 117 Slovenia Aug/17 118 Solomon Island Oct/19 119 South Africa Oct/21 120 Spain Dec/14 121 Sri Lanka Oct/15 122 St. Kitts and Nevis Feb/22 123 Suriname Jan/23 124 Sweden Apr/17 125 Switzerland Dec/16 126 Chinese Taipei Oct/19 127 Tajikistan Dec/18 128 Tanzania Jun/21 129 Thailand Dec/17 130 Togo Oct/22 131 Tonga Sep/21 66 >>> EQUITABLE GROWTH, FINANCE & INSTITUTIONS INSIGHT