List B Countries – Jurisdictions that may pose a higher risk
In response to recent enquiries, the Isle of Man Financial Services Authority wishes to provide further clarity around the approach expected of regulated and registered firms (together “firms”) in respect of countries that are included in, or added to, the List B Country List updated from time to time by the Department of Home Affairs.
What is “List B”?
List B is a list maintained by the Department of Home Affairs on its website specifying jurisdictions that may pose a higher risk of money laundering or terrorist financing. List B comes in two parts:
- Main List B - this section specifies jurisdictions with strategic AML/CFT deficiencies and is based on statements issued by the Financial Action Task Force (“FATF”). Listed jurisdictions are usually involved in some form of remediation with FATF and links to any relevant press statements issued by FATF are included.
- List B(ii) – this section specifies additional jurisdictions that have also been identified as those that may pose a higher risk of money laundering (“ML”) or financing of terrorism (“FT”) by the IOM Government. The list is prepared, in accordance with an established methodology, using data gathered from various commercial intelligence sources that cover ML, FT, crime, transparency and bribery / corruption risk.
Both the Main List B, and List B(ii) are generally reviewed and updated 3 times a year. Reference to List B is contained in the Anti-Money Laundering and Countering the Financing of Terrorism Code 2019 (“the Code”).
What must firms do in relation to List B countries?
All firms should regularly review the website of the Department of the Home Affairs, which contains information about the country lists. The Authority also issues news releases when the Country Lists are updated. Firms should review the changes and carry out their own evaluation for any potential impact on their risk assessments and procedures.
Risk assessment methodology
Section 2.2.4 of the Authority's AML/CFT Handbook provides guidance for firms in relation to identifying risks and assessing those risks, including that firms should have regard to a wide variety of sources of information, including List B. Some key points to remember include:
- In conducting risk assessments (for example the business risk assessment, customer risk assessment, and technology risk assessment), firms should determine the risk factors relevant to their/their customers’ particular circumstances. There is no expectation that firms should deal with all their relevant risk factors to the same extent; in the context of List B countries and whether those countries’ risk profile may pose a higher risk, this will be different for each firm. Firms should determine, and document, how far it is necessary to deal with a particular risk factor (e.g. List B country) according to their/their customers’ respective circumstances.
- Importantly, just because a country is included on List B does not automatically mean it poses a higher risk – each firm will have a different view of risk in the context of their business.
- Firms should take a holistic view of the ML/FT risks they have identified that together will determine the level of ML/FT risk associated with an area of their business or their business as a whole, a particular business relationship/occasional transaction or technology/delivery channel. Isolated risk factors  (which could include a country moving to List B) do not necessarily move a relationship into a higher risk category.
- When assessing ML/FT risk, some firms may weight risk factors differently depending on their relative importance. When weighting risk factors, firms should make an informed judgement about the relevance of different risk factors in the context of their business. For example, a firm may decide that a customer’s personal links to a List B jurisdiction are less relevant in light of the features of the product they seek. The weight given to each of these risk factors is likely to vary from product to product, customer to customer (or category of customer) and from one firm to another.
However, when weighting risk factors firms should ensure that:
- economic or profit considerations do not influence the risk rating; and
- weighting does not lead to a situation where it is impossible for any business relationship etc. to be classified as higher risk.
Business risk assessments (BRA)
The Code does not explicitly refer to geographic risk as a BRA relevant risk factor (except through the link to customer risk assessment). However, depending on the circumstances of the firm, geographic risk (whether this concerns a particular country, geographic area or border region within a country), can be relevant to the BRA.
A firm should have regard to the jurisdictions they are exposed to, whether through their own activities and operations, those of other group entities, the activities of its customers or its customers’ beneficial owners/beneficiaries or through any third parties on whom reliance is placed. In this context, a country moving to List B may be a trigger for the BRA to be reviewed, and where applicable, updated.
Further guidance in respect of the BRA is contained in sections 2.2.6 to 2.2.8 of the Authority's AML/CFT Handbook.
Customer risk assessments (CRAs)
For the purpose of CRAs, a relevant risk factor includes the risk factors included in paragraph 15(7) of the Code, which states that matters that may pose a higher risk include:
(a) activity in a jurisdiction the relevant person deems to be higher risk of ML/FT;
(b) a business relationship or occasional transaction with a customer resident or located in a jurisdiction in List B;
(c) activity in a jurisdiction in List A or B.
Further, another relevant risk factor is the nature, scale, complexity and location of the customer’s activities.
Section 2.2.9 of the Authority's AML/CFT Handbook provides guidance for firms in relation to the CRA. Some key points to remember, in the context of List B countries, include:
- The risk factors listed in paragraph 15(7) are matters that may pose a higher ML/FT risk. Whether they in fact pose a higher risk is a matter for firms to determine in the context of their BRA, CRA and TRAs.
- When assessing whether to deem a jurisdiction higher risk or whether the matters specified above do pose a higher risk in respect of any particular case, firms should consider the factors listed below (further guidance for each area is contained in section 2.2.9 of the AML/CFT Handbook):
- The nature and purpose of the business relationship / occasional transaction with the jurisdiction;
- The level of predicate offences relevant to money laundering within the jurisdiction;
- The level of terrorist / terrorist financing / proliferation risk within a jurisdiction;
- The effectiveness of the jurisdictions AML/CFT regime; and
- The level of legal and beneficial ownership transparency and tax compliance within the jurisdiction.
Further information and guidance is available via the links below:
AML/CFT requirements and guidance
Department of Home Affairs AML/CFT website
 Except where paragraph 15(5) of the Code applies (List A countries).