KYC for Customers in High Risk Countries: A Practical Guide

KYC for customers in high risk countries is normal KYC with more evidence, more verification and a named approver. You collect the same identity and ownership facts you always collect. Then you go further. You verify beneficial ownership to a higher standard, establish where the money came from, widen your screening, and record why you accepted the relationship.

The country flag changes the depth of the file. It rarely decides the answer on its own.

Most guidance stops at “apply enhanced due diligence” and leaves you to guess what that means. Below is who decides a country is high risk, which country counts when a customer touches several, what to ask for, and what to do when the usual documents do not exist.

What “high risk country” means inside a KYC file

Country risk is one input into a customer risk rating. It sits alongside the customer type, the product and the expected transaction pattern. A courier company in a listed country is not the same risk as a private investment vehicle in the same country. Treat the country flag as a multiplier. A high risk customer type in a high risk country goes straight to the top tier and needs senior approval.

A second point gets missed. Country risk is not one score. It is at least four separate questions, and a customer can be clean on three and a problem on the fourth.

Money laundering and terrorist financing risk, which drives your AML obligations.
Sanctions risk, which is a legal prohibition rather than a risk rating.
Export control and diversion risk, which matters if you ship goods, software or technology.
Corruption and bribery risk, which changes how you treat intermediaries and agents.

Who decides that a country is high risk

Nobody publishes a single global list. Several bodies publish overlapping ones, and your own policy sits on top.

FATF

The Financial Action Task Force publishes two statements after each of its plenary meetings, which fall three times a year in February, June and October. One covers high risk jurisdictions subject to a call for action. The other covers jurisdictions under increased monitoring, usually called the grey list.

The call for action list is short and has for years included North Korea and Iran. Countries land on the grey list after a mutual evaluation identifies strategic deficiencies and the government commits to an action plan with deadlines. They leave when FATF verifies the plan is done. Check the current statements rather than a list you saved last year.

Regional and national lists

The European Union maintains its own list of high risk third countries, adopted through delegated regulation. It draws heavily on FATF but is not identical and does not update on the same clock. The United Kingdom’s money laundering regulations require enhanced due diligence for high risk third countries and define that set by reference to the published FATF statements. In the United States, FinCEN issues advisories telling banks how to treat particular jurisdictions.

If you operate across borders, you are subject to the strictest list that applies to you, not the most convenient one.

Your own country risk model

Regulators expect a firm to hold a view beyond the official lists. Most build a scoring model from published indices covering corruption perception, governance quality and financial secrecy, then apply a manual override where they have seen problems first hand. Write the model down. Date it. Review it at a fixed interval.

Which country actually counts

This is the question competitor guides skip, and it causes more filing errors than anything else. A single corporate customer can touch six countries at once.

Country of incorporation, taken from the registry extract.
Country of the registered office and the country of actual operations, which are often different.
Country of residence and nationality of each beneficial owner and each director.
Country of the bank account receiving or sending funds.
Countries in the supply chain, including transshipment points and the final destination of goods.
Country of any agent, distributor or freight forwarder acting for the customer.

Score each one. Take the highest as the driver of the customer rating, and record the others. A company incorporated in a low risk jurisdiction, run by residents of a listed country and banking through a third country is a high risk customer however clean the incorporation certificate looks.

Pay particular attention to the payment route. A customer whose invoices are settled from an account in a country with no connection to the business is one of the clearest red flags of sanctions evasion you will see, and it is visible in the first payment.

The sanctions and export control overlay

Country risk under AML rules and country risk under trade rules are different systems. AML country risk tells you how much evidence to gather. Sanctions tell you whether you may deal at all. Export controls tell you whether a licence is needed for a specific item going to a specific end user. A country can be quiet on the AML lists and still be tightly controlled for exports. The reverse also happens. The difference between export controls and sanctions is worth understanding before you design your onboarding questions.

Three practical points follow for any business that moves goods.

Screen the whole party set, not the customer alone. That means the buyer, the consignee, the end user, the intermediate consignee, the freight forwarder, the bank and every named beneficial owner. A free denied party screening tool makes this a few minutes of work instead of an afternoon.
Apply the ownership rule. Sanctions authorities generally treat an entity as blocked if designated persons own it above a set threshold, directly or in aggregate. The 50 percent rule in sanctions screening means an unlisted company can still be off limits because of who owns it.
Ask about the end use in writing. For customers in high risk countries, a signed end use statement naming the actual user and application is worth more than a tick box, because it creates a record you can point to later.

What the file looks like at each tier

The table below shows a workable split. Adjust the thresholds to your own policy, but keep the principle that each tier adds specific, named evidence rather than vague extra effort.

Requirement	Standard risk country	Elevated risk country	Listed high risk country
Corporate identity	Registry extract, certificate of incorporation	Registry extract dated within 3 months, plus articles	Certified or notarised registry extract, plus independent registry check by you
Beneficial ownership	Customer declaration of owners above threshold	Declaration plus register or share certificate evidence	Full chain traced to natural persons, each identified and screened
Identity of owners and directors	Passport or national ID copy	ID plus proof of address	Certified ID, proof of address, liveness or video check
Source of funds and wealth	Stated business activity	Recent financial statements or bank references	Documented source of wealth for each owner, with supporting evidence
Screening scope	Entity and directors	Entity, directors, owners, bank	Full party set, plus adverse media in local language
Approval	Onboarding analyst	Compliance officer	Senior management, recorded by name and date
Review cycle	Every 3 years or on trigger	Annually	Every 6 to 12 months, plus rescreen on every list update

The extra steps in practice

Enhanced due diligence is a short list of concrete actions. Write them into your procedure so the analyst is not improvising.

Verify the company exists in the local register yourself. Do not accept a PDF the customer supplied without checking it against the source.
Trace ownership to natural persons. Stop only when you reach a human, a listed company on a recognised exchange, or a government body. Record each layer.
Screen every name in that chain. Rerun the check when a name changes.
Ask for source of wealth with evidence. Sale of a business, dividends, salary, inheritance, property sale. Each needs a document behind it.
Understand the commercial logic. Why does this customer buy from you, in this quantity, on these terms? Write the answer in the file in plain language.
Run adverse media in the local language, not only in English. This is where most of the useful information sits.
Set the expected activity profile before the first transaction, so monitoring has something to compare against.
Get senior approval and date it.

Screening is the step people most often under scope. Building it properly into the onboarding flow is covered in more depth in this guide to sanctions screening in customer onboarding.

When the documents you want do not exist

Here is the gap in most published guidance. It tells you to collect documents that a given country may not produce. Some registries are not searchable online. Some do not record shareholders at all. Some national IDs carry no address. Utility bills may be issued to a landlord rather than a resident.

Refusing every customer whose country runs a weak registry is one option, and it is how firms end up excluding legitimate businesses from entire regions. The better approach is documented substitution.

If the registry does not publish shareholders, ask for the share register certified by a director, plus the auditor’s or company secretary’s confirmation.
If no proof of address is available in the usual form, accept a bank statement, a tax notice, an employer letter or a lease, and note why the standard document was unavailable.
If financial statements are unaudited, ask for tax filings and a bank reference covering the same period.
If an official document is not in your working language, obtain a translation and keep both versions.

The rule is simple. Vary the document, never the fact you need to establish. Record the substitution, the reason and who approved it. An auditor will accept a reasoned deviation. They will not accept a silent gap.

Approving, declining and exiting

A high risk rating triggers a decision, and that decision belongs to a person, not a system. Three outcomes are legitimate.

Accept with controls. The file is complete, the commercial story holds, and you apply tighter limits and shorter review cycles. Accept with conditions, meaning you onboard but hold shipments or payments until a named document arrives. Or decline, because the evidence does not stand up.

Blanket exit from a whole country is a fourth option and a blunt one. It removes the risk and the revenue together. If you do exit, do it on a documented policy basis rather than case by case, so the reasoning stays consistent.

Whatever you decide, the record is the deliverable. Sound record keeping for denied party screening and KYC means keeping the search terms used, the lists checked, the date, the result and the reviewer’s name. A screening you cannot evidence did not happen as far as a regulator is concerned.

Keeping the file current

Country risk moves. A customer onboarded as medium risk can become high risk in a single afternoon when a plenary statement is published or a new designation lands.

Build two habits. First, a scheduled refresh by tier, as set out in the table. Second, event driven review. Trigger a fresh look when the country moves list, when ownership changes, when the customer asks to change the paying bank, or when adverse media appears.

Run a full portfolio rescreen after each list update. Small teams can do this with Globalior’s free screening tool rather than a paid platform.

Mistakes that show up in audits

Rating the country of incorporation only, and ignoring where the owners live.
Accepting a customer supplied registry printout without an independent check.
Stopping the ownership trace at the first corporate layer.
Treating a grey list country as prohibited. Increased monitoring means more evidence, not a ban.
Screening at onboarding and never again.
Recording the conclusion but not the reasoning behind it.

If you want a second opinion on how your country risk model and screening scope fit together, get in touch with the Globalior team and we will walk through it with you.

Key takeaways

A high risk country flag raises the evidence standard in the KYC file. It does not by itself prohibit the relationship.
FATF publishes its two jurisdiction statements three times a year, and the EU, the UK and US regulators each maintain related but separate positions.
Score every country a customer touches, including owner residence, banking route and shipment destination, then rate on the highest.
Sanctions and export controls sit on top of AML country risk and answer a different question, which is whether the deal is permitted at all.
Enhanced due diligence means tracing ownership to natural persons, evidencing source of wealth, widening screening and obtaining senior sign off.
Where a country cannot produce a standard document, substitute a different document for the same fact and record the reason.
Rescreen the portfolio after every list update, and trigger a fresh review when ownership, banking or routing changes.

Frequently asked questions

Can I refuse a customer purely because of their country?

You can, as a commercial decision, unless local law says otherwise. Regulators expect a risk based approach rather than blanket exclusion. If you do set a country exclusion, write it into policy, apply it consistently, and review it. Case by case refusals with no policy behind them are the weakest position.

Is the FATF grey list the same as a sanctions list?

No. The grey list identifies countries with deficiencies in their AML systems that have committed to fix them. It creates a due diligence obligation, not a prohibition. Sanctions lists name specific people, entities, vessels and sometimes whole territories, and dealing with them can be a criminal offence. Screen against sanctions lists separately from any country risk rating.

How far do I have to trace beneficial ownership?

To natural persons. Follow each layer until you reach an individual, a listed company on a recognised exchange, or a state body. Thresholds for who counts as a beneficial owner vary by jurisdiction and are set by the relevant regulator. For a high risk country customer, lower your internal threshold and identify anyone with effective control, including through nominee arrangements.

What counts as acceptable source of wealth evidence?

A document from a third party that explains how the money was earned. Audited accounts, a share sale agreement, a property sale contract, dividend statements, tax returns, or an employment contract with payslips. A customer’s own written explanation is a starting point, not evidence. Match the value of the documented wealth to the size of the expected activity.

How often should I rescreen a high risk customer?

Continuously against sanctions lists if your tooling allows, and in any case after every published list update. Refresh the full KYC file every six to twelve months for top tier customers. Add event driven reviews for ownership changes, new directors, a change of paying bank, a new shipping destination or negative press.

What should I do the day a country is added to a list?

Pull every customer, supplier and counterparty connected to that country, including by owner residence and banking route. Rerun screening on the full party set, reassess each risk rating, and check whether any open orders or payments need holding. Record the exercise with a date. You can run the screening pass with a denied party screening check before doing the slower file reviews.