We are pleased to announce the release of Version 2 of the CountryRisk.io AML Country Risk Index Methodology, available now to our clients alongside the existing methodology. This release represents a significant step forward in how we assess country-level money laundering and terrorist financing (ML/TF) risks, combining a robust quantitative foundation with clearer regulatory alignment and improved real-world usability.

As global financial flows grow more complex and enforcement expectations continue to rise, organisations are under increasing pressure to demonstrate that their AML country risk frameworks are transparent, defensible, and consistent over time. Version 2 has been designed to meet these expectations—strengthening analytical depth while preserving methodological stability.

A key innovation of the updated CountryRisk.io AML Country Risk Index is the systematic availability of regional and national methodology variants, designed to reflect local regulatory expectations without compromising the integrity of the underlying quantitative model. In addition to a Global Base Version, CountryRisk.io provides EU, US, Germany, and France–specific versions that automatically incorporate jurisdiction-relevant high-risk country lists. These include the FATF grey and black lists, the EU list of high-risk third countries, the EU list of non-cooperative jurisdictions for tax purposes, FinCEN special measures for jurisdictions of primary money laundering concern (US), Annex 4 of the German National Risk Assessment, and the French list of non-cooperative jurisdictions for tax purposes. Other country-specific variants can be made available on request. By embedding these lists directly into the risk classification logic, CountryRisk.io removes the need for manual overrides, ensures regulatory consistency, and allows organisations to deploy a single, scalable country risk framework across multiple jurisdictions.

Motivation for the updated methodology

An effective AML country risk methodology must evolve to remain aligned with regulatory developments, emerging money laundering typologies, and improvements in data availability. Significant enforcement actions and high-profile money laundering cases frequently lead regulators to refine their expectations around country risk assessments, including the treatment of predicate offences, institutional effectiveness, and high-risk jurisdiction lists published by authorities such as the EU Commission and the Financial Action Task Force (FATF).

At the same time, excessive or frequent methodological changes can introduce operational complexity, reduce comparability over time, and create uncertainty for stakeholders. Stability is essential for tracking trends, explaining score movements to regulators, and embedding country risk outputs into downstream compliance processes.

Version 2 reflects CountryRisk.io’s deliberate effort to strike a balance between adaptability and consistency. Changes have been introduced only where there is a clear regulatory, analytical, or data-driven rationale. We recognise that methodological updates can affect country classifications and client workflows, and we therefore apply a careful, transparent implementation process—working closely with clients to ensure clarity, continuity, and a smooth transition.

A comprehensive, data-driven framework

The AML Country Risk Index is built on a purely quantitative approach, drawing on carefully selected indicators from leading international institutions such as the World Bank, OECD, FATF, and other specialised organisations. These indicators are grouped into four core risk sections that together capture the full spectrum of country-level ML/TF risk:

• Inherent Risks / Predicate Offences, assessing the prevalence and impact of criminal activities that generate illicit financial flows
• Money Laundering Assessment, Regulation & Enforcement, focusing on FATF assessments, sanctions regimes, and external AML risk classifications
• Quality of Institutions, evaluating rule of law, governance, and enforcement capacity
• Transparency, analysing financial secrecy, tax transparency, and disclosure standards

Each section is assessed independently and then aggregated using clearly defined weights, resulting in an overall risk score that is mapped to five intuitive risk categories: Very Low, Low, Medium, High, and Very High.

Key methodological changes in Version 2

The updates introduced in Version 2 can be grouped into four main areas:

1. Risk section adjustments

A new risk section titled “Inherent Risks / Predicate Offences” has been introduced. This section captures a broad range of inherent money laundering risks that exist prior to evaluating the control environment and aligns closely with the predicate offences defined under the 6th EU Money Laundering Directive. It includes risks related to organised crime, environmental crime, cybercrime, trafficking, and similar activities.

As part of this restructuring, Corruption and Sanctions, which were previously treated as separate risk sections, have been fully integrated into this new category. Improved country-level data now allows these risks to be captured in a more consistent and analytically coherent manner.

2. Modified indicators and weighting approach

Several indicators have been refined, replaced, or recalibrated to reflect improvements in data availability and analytical relevance. In addition, Version 2 moves away from equal weighting within individual risk sections toward a weighted indicator approach that ensures balanced representation across all risk factors. This change is particularly relevant for the predicate offences risk section, where the availability of indicators varies significantly across offence types. For example, corruption is covered by a relatively rich set of indicators, while fewer comparable data points exist for cybercrime. The revised weighting framework mitigates the risk of overrepresenting certain criminal activities simply due to data abundance, resulting in a more proportionate and analytically robust assessment of inherent risk.

3. Jurisdictional mapping

For selected jurisdictions—particularly small islands and overseas territories—the AML country risk score is derived from a closely related country or sovereign jurisdiction. For example, the AML country risk score for the Åland Islands is mapped directly to Finland. This approach enhances consistency and avoids artificial differentiation where legal, regulatory, and institutional frameworks are effectively shared. A detailed list of affected jurisdictions, together with the underlying rationale, is documented in the methodology.

4. Jurisdiction-specific heuristics for risk classification

While the original methodology was conceived as a global base framework, Version 2 introduces jurisdiction-specific heuristic overrides aligned with local regulatory requirements. These overrides ensure that countries appearing on authoritative lists—such as the FATF grey and black lists, the EU list of high-risk third countries, or national risk assessments—are automatically mapped to the appropriate risk categories. As a result, clients no longer need to apply manual adjustments to align model outputs with supervisory expectations. Alongside the Global Base Version, CountryRisk.io now offers dedicated EU, US, Germany, and France versions, each embedding the relevant high-risk country lists directly into the risk classification logic and enabling immediate use within regulated AML frameworks.

What changed in practice: results and distribution

Comparing the updated methodology with the previous version shows a high degree of continuity, with an approximately 85% correlation between the two models. At the same time, Version 2 delivers a more balanced and intuitive distribution of risk categories.

Under the revised methodology, a larger number of countries fall into the Medium Risk category, while fewer countries are classified at the extremes of Very Low or Very High Risk. This reflects a more cautious and conservative design philosophy: very low-risk ratings are assigned more selectively, and very high-risk ratings are reserved for jurisdictions exhibiting consistently weak indicators across multiple dimensions.

When risk categories are simplified to Low, Medium, and High, the resulting distribution is well balanced and better suited to risk-based decision-making. The greater concentration in the middle range is considered a positive outcome, while recognising that the interpretation of results ultimately depends on each organisation’s individual risk appetite.

Looking ahead

Version 2 of the AML Country Risk Methodology represents a meaningful step forward in delivering a stable, regulator-ready, and data-driven country risk framework. The index is updated on a monthly basis and ad hoc following FATF plenary sessions, with periodic methodological reviews to incorporate new high-quality data sources and evolving regulatory guidance.

The full methodology document is available now (Link). If you would like a walkthrough of the updated model or a demonstration of how the AML Country Risk Index can be integrated into your compliance workflows, please contact us at [email protected].