Editor's note: This article is the second in a series that examines how banks can better assess geographical risk. Both at client take-on and in transaction monitoring, geography plays a key role in helping banks carry out their risk-based approach to anti-money laundering (AML) compliance. The previous article looked at the risks of limited recognition countries.
Bouvet Island has never been an easy place to find. Even the famed explorer James Cook had to call off a search when he could not locate it. He was not missing much, though. Bouvet is the glacier-covered tip of an inactive South Atlantic volcano. Its forbidding terrain and equally harsh climate assure that only passing penguins and the occasional seal are happy to have stumbled across it.
For an unpopulated speck of land at the bottom of the world, Bouvet Island is remarkably easy to find on banks' geographical risk matrices. It is usually a quarter of the way down the first page.
The uninhabited island that has an AML risk rating is a telltale sign that the International Organization for Standardization (ISO) Country Code list1 underpins the matrix. The list can be a good foundation for making a geographical risk matrix, as long as banks know its limitations.
Why We Rate
Understanding the geographies associated with a client or transaction allows banks to measure and manage AML risk. To do this, banks have to develop a matrix quantifying the risk each country poses. Since it is a critical risk management tool, compliance officers usually put a lot of thought into constructing it. They scour government and civil society web sites to identify the reports and analyses that will underpin ratings. They develop formulas and weights to assure that each risk factor properly contributes to the outcome. They mull over the advantages of having four tiers of risk rather than three. But the most important aspect of any geographical risk matrix—which countries and territories get rated and which do not — often receives little consideration. Banks simply accept the ISO Country Code list and begin crunching the data.
The ISO Country Code list makes a tempting starting point for several reasons.
Compiled by a non-governmental standards-setting organization in Geneva, and containing over 230 entries, the list appears at once authoritative and exhaustive. It is freely available and used in a range of applications from SWIFT bank identifiers to top-level Internet domains.
But the list was never designed to be an inventory of countries and territories that could present AML risks to a bank. In fact, it is neither authoritative nor exhaustive and its use introduces arbitrariness into a key risk management mechanism that should be anything but.
ISO-lating the Problem
If you had to think of a place completely opposite to Bouvet Island, it would have to be Madeira. Warmed by a tropical sun, Bouvet's glaciers and penguins are nowhere to be found. But you can find people—nearly a quarter of a million of them, as well as 40 offshore banks. Despite Madeira's well-known tax haven status, the two differ in another way with even bigger consequences for how banks see AML risk: Bouvet has an ISO code and Madeira does not.
This difference is due to the way codes are assigned. To begin with, what is commonly referred to as the "country code list" is actually a composite of countries, territories and subdivisions of countries. The list comes from materials published by the United Nations (UN). The UN provides the names only as a "statistical convenience" and conspicuously notes that entry in its materials does not represent an opinion about the location's legal status. ISO also adds codes that countries have requested for their subdivisions. If a country sees a statistical or commercial need to identify a particular territory separately, it can apply to ISO for a code. This is what accounts for Bouvet's conspicuous presence on and Madeira's frequent absence from AML risk matrices. Essentially, no one in Portugal has seen a statistical convenience or commercial benefit to identifying Madeira separately from the mainland.
At the same time as it ignores places presenting AML risk worth identifying, the ISO list contains codes for places that do not present unique AML risk. Several codes belong to territories that are geographically separate but legally indistinct from their associated countries. The island of Reunion is a prime example. Nearly 6,000 miles southeast of Paris lies Saint-Denis, the capital of Reunion. Despite being on the opposite side of the equator and a whole lot closer to Madagascar than Montpellier, Reunion is a department (province) of France. Basically, Reunion has the same relationship to France as Hawaii has to the U.S. — a long way from the mainland, but still an integral part of the country. However, since Reunion happens to have its own ISO code, it usually gets treated by banks as completely separate from France and can even end up with a different risk rating if not enough information can be found out about it.
(See chart for a list of ISO codes that may not contribute to banks' understanding of geographical risk).
|Antarctica||AQ||No permanent population, only temporary scientific/military habitation. By treaty any inhabitants are governed by the laws of their home countries.|
|Bonaire, Saint Eustatius and Saba||BQ||Legally integrated into the Netherlands upon dissolution of the Netherlands Antilles in Oct 2010.|
|Bouvet Island||BV||No permanent population, only temporary scientific/military habitation.|
|British Indian Ocean Territory||IO||No permanent population. Native population forcibly removed between 1966 and 1971 by the British government so the islands could be used as a military base. Current population (approx. 4,000) is entirely UK and U.S. military and support staff.|
|Christmas Island||CX||Legally separate from Australia but administered directly by the Australian Attorney General's Department.|
|Cocos (Keeling) Islands||CC||Legally separate from Australia but administered directly by the Australian Attorney General's Department.|
|French Guyana||GF||Integral part of France with the same status as any continental French department.|
|French Southern Territories||TF||No permanent population, only temporary scientific/military habitation.|
|Guadeloupe||GP||Integral part of France with the same status as any continental French department.|
|Heard Island and McDonald Islands||HM||No permanent population, only temporary scientific/military habitation.|
|Martinique||MQ||Integral part of France with the same status as any continental French department.|
|Mayotte||YT||In 2011, Mayotte will become integrated into France with the same status as any continental French department.|
|Reunion||RE||Integral part of France with the same status as any continental French department.|
|South Georgia and The South Sandwich Islands||GS||No permanent population, only temporary scientific/military habitation.|
|Svalbard and Jan Mayen||SJ||Both Svalbard and Jan Mayen are integral parts of Norway. Further Jan Mayen has no permanent population, only temporary scientific/military habitation.|
|United States Minor Outlying Islands||UM||No permanent population, only temporary scientific/military habitation.|
Icebergs for Islands
It was 1772 when Captain Cook went looking for Bouvet Island. He thought it could lead him to the rumored great southern continent. When he arrived at the co-ordinates that the Frenchman Jean-Baptiste Bouvet de Lozier recorded thirty years earlier, the island was nowhere to be found. Concluding that Bouvet had mistaken an iceberg for an island, Cook called off the search and headed for other adventures. When it comes to AML risk, the ISO country code list contains both islands and icebergs. It is up to banks to figure out which are which.
The views expressed in this article are those of its author and do not necessarily represent the views of the Royal Bank of Scotland Group.
- This article deals with the ISO 3166-1 List of 2-letter country codes