Editor's note: This article is the second in a series that examines how banks can better assess geographical risk. Both at client take-on and in transaction monitoring, geography plays a key role in helping banks carry out their risk-based approach to anti-money laundering (AML) compliance. The previous article looked at the risks of limited recognition countries.

Bouvet Island has never been an easy place to find. Even the famed explorer James Cook had to call off a search when he could not locate it. He was not missing much, though. Bouvet is the glacier-covered tip of an inactive South Atlantic volcano. Its forbidding terrain and equally harsh climate assure that only passing penguins and the occasional seal are happy to have stumbled across it.

For an unpopulated speck of land at the bottom of the world, Bouvet Island is remarkably easy to find on banks' geographical risk matrices. It is usually a quarter of the way down the first page.

The uninhabited island that has an AML risk rating is a telltale sign that the International Organization for Standardization (ISO) Country Code list¹ underpins the matrix. The list can be a good foundation for making a geographical risk matrix, as long as banks know its limitations.

Why We Rate

Understanding the geographies associated with a client or transaction allows banks to measure and manage AML risk. To do this, banks have to develop a matrix quantifying the risk each country poses. Since it is a critical risk management tool, compliance officers usually put a lot of thought into constructing it. They scour government and civil society web sites to identify the reports and analyses that will underpin ratings. They develop formulas and weights to assure that each risk factor properly contributes to the outcome. They mull over the advantages of having four tiers of risk rather than three. But the most important aspect of any geographical risk matrix—which countries and territories get rated and which do not — often receives little consideration. Banks simply accept the ISO Country Code list and begin crunching the data.

The ISO Country Code list makes a tempting starting point for several reasons.
Compiled by a non-governmental standards-setting organization in Geneva, and containing over 230 entries, the list appears at once authoritative and exhaustive. It is freely available and used in a range of applications from SWIFT bank identifiers to top-level Internet domains.

But the list was never designed to be an inventory of countries and territories that could present AML risks to a bank. In fact, it is neither authoritative nor exhaustive and its use introduces arbitrariness into a key risk management mechanism that should be anything but.

ISO-lating the Problem

If you had to think of a place completely opposite to Bouvet Island, it would have to be Madeira. Warmed by a tropical sun, Bouvet's glaciers and penguins are nowhere to be found. But you can find people—nearly a quarter of a million of them, as well as 40 offshore banks. Despite Madeira's well-known tax haven status, the two differ in another way with even bigger consequences for how banks see AML risk: Bouvet has an ISO code and Madeira does not.

This difference is due to the way codes are assigned. To begin with, what is commonly referred to as the "country code list" is actually a composite of countries, territories and subdivisions of countries. The list comes from materials published by the United Nations (UN). The UN provides the names only as a "statistical convenience" and conspicuously notes that entry in its materials does not represent an opinion about the location's legal status. ISO also adds codes that countries have requested for their subdivisions. If a country sees a statistical or commercial need to identify a particular territory separately, it can apply to ISO for a code. This is what accounts for Bouvet's conspicuous presence on and Madeira's frequent absence from AML risk matrices. Essentially, no one in Portugal has seen a statistical convenience or commercial benefit to identifying Madeira separately from the mainland.

At the same time as it ignores places presenting AML risk worth identifying, the ISO list contains codes for places that do not present unique AML risk. Several codes belong to territories that are geographically separate but legally indistinct from their associated countries. The island of Reunion is a prime example. Nearly 6,000 miles southeast of Paris lies Saint-Denis, the capital of Reunion. Despite being on the opposite side of the equator and a whole lot closer to Madagascar than Montpellier, Reunion is a department (province) of France. Basically, Reunion has the same relationship to France as Hawaii has to the U.S. — a long way from the mainland, but still an integral part of the country. However, since Reunion happens to have its own ISO code, it usually gets treated by banks as completely separate from France and can even end up with a different risk rating if not enough information can be found out about it.

(See chart for a list of ISO codes that may not contribute to banks' understanding of geographical risk).

Icebergs for Islands

It was 1772 when Captain Cook went looking for Bouvet Island. He thought it could lead him to the rumored great southern continent. When he arrived at the co-ordinates that the Frenchman Jean-Baptiste Bouvet de Lozier recorded thirty years earlier, the island was nowhere to be found. Concluding that Bouvet had mistaken an iceberg for an island, Cook called off the search and headed for other adventures. When it comes to AML risk, the ISO country code list contains both islands and icebergs. It is up to banks to figure out which are which.

Max R. Tappeiner, global AML advisor, Royal Bank of Scotland NV, Amsterdam, Netherlands. max.r.tappeiner@rbs.com

The views expressed in this article are those of its author and do not necessarily represent the views of the Royal Bank of Scotland Group.

1. This article deals with the ISO 3166-1 List of 2-letter country codes