Why Conventional BWRAs Fall Short
Business-Wide Risk Assessments (BWRAs) underpin an effective risk-based approach to AML, CTF and counter-proliferation financing. Yet many BWRAs produced by firms operating in African markets rely on methodologies developed for European regulatory environments. While these satisfy broad regulatory requirements, they frequently fail to capture the market-specific, jurisdictional and operational characteristics that shape financial crime risk across African financial services and payment corridors.
A country rating measures the characteristics of a jurisdiction; geographic exposure measures the firm’s interaction with that jurisdiction’
Many assessments depend heavily on global country ratings, generic customer classifications and standardised delivery channel assumptions, overlooking material differences in customer behaviour, payment infrastructure, regulatory maturity and transaction characteristics across individual African jurisdictions. A remittance corridor between the UK and Nigeria presents materially different financial crime risks from trade finance involving Ghana or correspondent banking with institutions in Côte d’Ivoire. Treating these as broadly similar weakens the BWRA and undermines the risk-based approach.
The consequences are measurable. An IFC survey[i] found that more than 80% of banks in Sub-Saharan Africa reported being affected by de-risking, the highest of any region surveyed. The Bank for International Settlements[ii] reports more than 22% of banks have terminated correspondent banking relationships due to AML concerns, costing African economies billions annually.
De-risking is driven by multiple factors, profitability pressures, sanctions exposure and regulatory uncertainty among them, but weak, undifferentiated risk assessments are frequently a material contributor. The perception that Africa presents uniformly high financial crime risk is not always evidence-based; it frequently results from applying broad classifications to 54 jurisdictions with markedly different regulatory frameworks, supervisory effectiveness and financial crime threats.
The Regulatory Baseline And Why Firms Must Go Beyond It
FATF Recommendation 1[iii] and Regulation 18 of the UK Money Laundering Regulations 2017[iv] require firms to identify, assess, document and regularly review their ML, TF and proliferation financing risks, proportionate to their nature, size and complexity, and to assess controls, determine residual risk and implement mitigating measures. The Sixth AMLD[v] applies equivalent obligations across the EU. From July 2027, the AMLA Single Rulebook[vi] will introduce harmonised supervisory expectations across all 27 EU member states, with draft guidelines in consultation until 15 July 2026.
Critically, AMLA’s draft guidelines[vii] require firms to draw on varied, credible and relevant information, both internal and external, appropriate to their business model, sector and geographic footprint. Country risk indices alone do not meet that standard.
These requirements establish the regulatory baseline, not the end objective. A credible BWRA goes further: providing a true picture of the firm’s inherent risk, enabling resources to be allocated where they matter most and driving the decisions that deliver real value to the business. However, less complex firms may adopt a proportionate, qualitative approach, but the obligation to evidence rationale and methodology remains.
The FCA’s Dear CEO letter[viii] and thematic reviews consistently identify the same weaknesses: generic assessments, insufficient operational detail and methodologies that fail to distinguish between customer groups, products, geographic exposures and transaction types. A BWRA that cannot explain why particular risks exist, how they were evaluated and why controls are proportionate will not withstand regulatory scrutiny or satisfy correspondent bank due diligence expectations.
Geographic Exposure: Why Country Ratings Alone Are Insufficient
Geographic exposure is one of the most significant inherent risk factors in a BWRA, yet consistently one of the least developed. For firms in African markets, it should extend well beyond identifying whether a country appears on the FATF Grey List, a sanctions list or the Basel AML Index. A country rating measures the characteristics of a jurisdiction; geographic exposure measures the firm’s interaction with that jurisdiction. Country ratings provide a macro-level assessment of national AML/CFT frameworks, governance and institutional effectiveness. Geographic exposure, by contrast, considers how a firm’s products, customers, transactions and delivery channels interact with the specific markets and payment corridors in which it operates. This requires understanding legal and regulatory environments, supervisory effectiveness, payment infrastructure maturity, corruption risks and the typologies through which illicit finance enters or moves through the financial system.
A robust BWRA should distinguish between country risk, jurisdictional risk, market-specific risk and corridor-level risk, recognising that each contributes differently to overall geographic exposure.
Corridor risk is not country risk
The UK–Nigeria corridor is characterised by high remittance volumes, World Bank estimates place 2024 inflows at approximately $19–20 billion, alongside extensive digital payments, significant crypto-asset activity and complex PEP networks not fully captured by standard screening tools.
The UK–Ghana corridor is shaped by mobile money infrastructure, with GH¢3.01 trillion in transactions recorded in 2024, a 56.8% year-on-year increase, creating distinct risks around agent networks and cash-in/cash-out layering.
The UK–Côte d’Ivoire corridor presents different considerations again: despite AML/CFT progress, continued FATF grey-list status as of February 2026 reflects ongoing weaknesses in beneficial ownership transparency, suspicious transaction reporting and unregulated VASP sector.
Treating Nigeria, Ghana and Côte d’Ivoire as a single “West Africa” risk category is a methodology driven by regional assumption rather than evidence. It will not satisfy supervisory expectations and does not accurately reflect inherent risk.
The 2025 Basel AML Index(ix) reported that seven of the ten most improved jurisdictions globally were in Sub-Saharan Africa. Progress at national level, however, does not automatically reduce corridor-level risk. Effective BWRAs should recognise both improvements in national AML/CFT frameworks and the continuing operational risks within individual payment corridors.
Products, Services, Delivery Channels and Emerging Technologies
Different products and delivery channels create distinct financial crime risks and require separate assessment. For African-market firms, mobile money warrants treatment as a distinct payment ecosystem, not simply another delivery channel. Agent networks require separate consideration: agents frequently act as the primary customer interface, and weak oversight, inconsistent CDD or inadequate monitoring across those networks significantly increases financial crime exposure.
Emerging technologies demand explicit assessment. Crypto-assets, VASPs and stablecoin settlement mechanisms increasingly support legitimate cross-border payments but introduce heightened risks around transaction anonymity, sanctions evasion and cross-border fund movement. AMLA’s draft guidelines specifically require firms to assess novel technologies within their BWRA, where these feature in customer activity or payment infrastructure, they should be treated as distinct inherent risk factors, not absorbed into general product risk.
Transaction Risk and Sanctions Scope
A Business-Wide Risk Assessment should assess transaction-specific risk as a distinct inherent risk, taking into consideration transaction size, frequency, velocity, complexity, cross-border flows, intermediary involvement and links to higher-risk jurisdictions.
The AMLA extends BWRA scope beyond ML/TF to include the risk of non-implementation and evasion of targeted financial sanctions, requiring transaction risk to be assessed as its own category rather than folded into product or delivery channel risk. For African corridors, this means evaluating trade finance separately from remittance flows given their distinct TBML typologies and layered intermediary structures common in cross-border trade, alongside sanctions evasion risk reachable through nested correspondent relationships, opaque ownership structures, and proliferation financing exposure through dual-use goods and weaker export control jurisdictions.
These risks should be assessed as a distinct BWRA category rather than assumed to be mitigated through sanctions screening alone.
Review Frequency: Annual Cycles Are Not Enough
FATF listings update three times yearly. Sanctions regimes can change overnight. Elections, civil unrest and regulatory reforms can materially alter a corridor’s risk profile within weeks. Annual reviews remain a governance requirement, but firms in higher-risk African corridors must complement them with trigger-based reviews activated by material changes: new products, new jurisdictions, significant customer onboarding, emerging typologies or major regulatory developments.
Conclusion
For African-led businesses and financial institutions, the greatest opportunity to strengthen the BWRA lies in moving beyond country risk ratings toward market-specific, jurisdictional and corridor-level analysis. Geographic exposure must be assessed as a standalone inherent risk factor, supported by operational evidence rather than regional assumption.
As supervisory expectations evolve and AMLA’s Single Rulebook takes effect from July 2027, firms that develop evidence-based, operationally grounded BWRAs will be better positioned to demonstrate an effective risk-based approach, sustain correspondent banking relationships and respond confidently to regulatory scrutiny.
We conduct independent BWRA reviews and financial crime framework assessments for firms operating in UK/EU-Africa banking and payments corridors. Email :nana.mante@opselcompliance.com or call +447950377849 to book a free 20-minute scoping call.
Reference
[i] https://documents1.worldbank.org/curated/en/895821510730571841/pdf/121275-WP-IFC-2017-Survey-on-Correspondent-Banking-in-EMs-PUBLIC.pdf
[ii] Bank for International Settlements
[iv] The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
[v] Directive – 2018/1673 – EN – EUR-Lex
[vi] https://www.amla.europa.eu/policy/public-consultations/consultation-draft-guidelines-business-wide-risk-assessment_en
[vii] Consultation on the draft Guidelines on business-wide risk assessment – Authority for Anti-Money Laundering and Countering the Financing of Terrorism
[viii] https://www.fca.org.uk/publication/correspondence/dear-ceo-letter-action-response-common-control-failings-anti-money-laundering-frameworks.pdf