National risk assessments (NRA) are the apparatuses used by nations to assess their exposure to threats such as financial fraud and money laundering. The World Bank has just released a report on the state of NRAs suggesting others need to learn from the practices of eight “advanced countries.” Anonymous authors plus their confidently on-the-record editor — an insider with vast experience — are unimpressed by the suggestion.
The title from a new World Bank report on money laundering risks could scarcely be blander: “National Assessments of Money Laundering Risks: Learning from Eight Advanced Countries’ NRAs.” The content is anything but. Authored by Joras Ferwerda of Utrecht University and Peter Reuter of the University of Maryland, the report concludes that not a one of the eight money-laundering risk assessments examined, all done as the report’s title advertises by “advanced” countries, is worth a damn.
Not a one merits a passing grade from the two professors, both highly regarded money laundering experts. What’s worse, despite close to a decade of experience doing such assessments, the two find that no government seems to have learned a thing from the mistakes of others. This raises a fundamental question about the existing AML regime. How can it be effective if national authorities lack an understanding of the money-laundering risks their countries face?
All adopted an approach to risk assessment enshrined in a 2013 Financial Action Task Force (FATF) guidance document. This is where the problem begins, for the FATF document is inconsistent with best practice in risk assessment, as articulated by the International Standards Organization.
For example, a critical issue in conducting a risk assessment is the identification of threats. But the NRAs are all over the place when it comes to defining just what a threat is. Canada characterized money-laundering threats as any kind of group that might launder money (organized gangs or professional money launderers), while Singapore characterized specific crimes as threats.
FATF now requires that every country show a good understanding of the distribution of risks, preferably through a published NRA. Ferwerda and Reuter analyzed the national risks assessments prepared by the governments of Canada, Italy, Japan, Netherlands, Singapore, Switzerland, the UK, and the U.S.; all are rated by the IMF as systemically important countries. And they are surely among the countries with the most sophisticated financial regulatory and research communities.
Each country relied heavily on expert opinion, solicited without any awareness of the standards of practice for eliciting expert opinion. Most provided just the broadest hints of the methodology that they used. The Netherlands was the only one that described its approach in sufficient detail that it could in principle be replicated. Finally, almost none provided what the FATF asked for, an assessment of where risks are significant and where they are modest.
Risk assessment is difficult in any field. Though there is a well-developed profession of risk assessment, each area requires adapting the methodology to that area’s unique data limitations and institutional arrangements. Money laundering is a novel field for risk assessment; data on money laundering events are hard to find. So there is no shame in not having strong NRAs the first time around. What is harder to justify is the casualness of the exercises. Why not lay out the methods so that other countries can learn from each other’s mistakes and so that the field will develop?
One gets the sense that NRAs are simply a box-checking exercise to meet an international requirement. Most are done just before a FATF Mutual Evaluation Report, as the new FATF self-evaluation itself reports. There is little evidence that the assessments affect policy decisions, though that is the whole point of doing them. Ferwerda and Reuter suggest that the closed world of AML is part of the problem; professional risk assessors have played no role either in the development of the FATF methodology or in its operationalization at the national level.
How can the international risk-based AML strategy succeed if even the most developed countries fail to research and explain their risks well? The FATF needs to clearly explain what it expects from an NRA. A variety of research methods is healthy, but when countries are not researching the same topic and each country comes up with their own meaning of relevant terms, learning from each other is not possible. Countries must be transparent about how they analyze risks and involve risk assessment professionals so that at least the bare minimum of academic standards for analysis are met. The NRA exercise is in its early stages. There is no shame in stumbling at the starting gate, but without intervention, all will just continue to stumble.
Richard E. Messick consults for international organizations, development agencies, and non-governmental organizations on legal development and anticorruption issues. As an attorney in the United States he advised political parties, office holders, corporations, and political committees on campaign finance and ethics issues and represented individuals and corporations in state and federal matters involving fraud and corruption. 
