High-Risk Countries: AML/CTF Country Risk Guide

For an Australian reporting entity, country risk works at two levels. One rule is fixed: enhanced customer due diligence (CDD) is required when a person connected to the customer is physically present in, or a company or trust was formed in, a jurisdiction for which the FATF has called for enhanced due diligence. Everything else about countries is a risk judgement that you document in your business-wide risk assessment and apply again to each customer’s risk rating. This guide sets out both levels, explains how sanctions screening differs, and lists the red flags that should send a file to an officer.

TL;DR

• Enhanced CDD is mandatory under section 32(d) when the customer, a beneficial owner, anyone acting for the customer, or anyone on whose behalf it receives the service is present in, or a company or trust was formed in, a FATF call-for-action jurisdiction.
• The test is presence or formation, not nationality. The FATF “increased monitoring” list does not trigger the mandatory rule, though it can still raise a risk rating.
• Your risk assessment must have regard to the countries you deal with (section 26C(3)(d)), and so must each customer’s risk rating (section 28(4)(e)).
• DFAT sanctions screening is a separate check against the Consolidated List, and it applies whether or not a country is on any FATF list.
• Record the screening result and the officer’s decision together, so the reasoning is on file when a supervisor asks for it.

Table of Contents

• What “high-risk country” means for a reporting entity
• The one fixed rule: section 32(d)
• Country risk in your risk assessment and customer ratings
• Sanctions are a separate check
• Sanctions evasion red flags in property transactions
• Suspicious matter red flags that call for escalation
• A repeatable country-risk process
• Putting this into practice with AML Guard
• FAQ
• Sources

What “high-risk country” means for a reporting entity

There is no single government list called “high-risk countries” that covers every obligation. AUSTRAC’s guidance describes a family of factors: a country or region may be high risk if the FATF has deemed it high risk or non-cooperative, if it is prescribed or subject to sanctions, if it is a known tax haven, or if it is known to support terrorist organisations. Where your business deals with such places, AUSTRAC expects appropriate controls, and potentially enhanced CDD, enhanced ongoing monitoring and suspicious matter reports (SMRs).

So the phrase covers three different things, and keeping them apart prevents most errors:

1. A fixed legal trigger. The FATF call-for-action rule in section 32(d).
2. A judgement factor. Country exposure that you weigh in the risk assessment and in each customer’s rating.
3. A separate legal prohibition. Sanctions, which are administered by DFAT’s Australian Sanctions Office, not by AUSTRAC.

Since Tranche 2 obligations commenced on 1 July 2026 for real estate, legal, accounting, and trust and company service providers, all three now sit within the day-to-day work of agencies, conveyancers, law firms and accountants, not only banks.

The one fixed rule: section 32(d)

Under the Act, enhanced CDD is required where the customer, a beneficial owner, a person acting for the customer, or a person on whose behalf the customer receives the designated service is physically present in a jurisdiction for which the FATF has called for enhanced due diligence. The same applies where a body corporate or legal arrangement was formed in such a jurisdiction. AUSTRAC sets this out in its high-risk countries guidance.

Three points matter in practice.

Presence or formation, not nationality. A citizen of a listed country who lives and works in Australia is not caught by the rule merely because of a passport. A company incorporated in a listed jurisdiction is caught even if its directors live in Sydney. Equally, a customer of any nationality who is physically present in a listed jurisdiction is caught. Staff who screen on passport country alone will both over-flag and under-flag.

Look through the whole structure. The rule reaches beneficial owners, agents and the people on whose behalf the service is received. A purchaser that is an Australian company with a foreign parent, or a buyer acting through a representative abroad, needs every connected person located before you can say the rule is not triggered.

Only the call-for-action list triggers it. The FATF publishes two public lists. High-risk jurisdictions subject to a call for action are those for which the FATF urges all jurisdictions to apply enhanced due diligence and, in the most serious cases, countermeasures. Jurisdictions under increased monitoring are working with the FATF to fix deficiencies. AUSTRAC’s high-risk countries guidance links to the FATF’s current statements on both, and they change. We deliberately name no countries here, because a list printed in an article goes stale. Read the live call-for-action list on the day you onboard the customer and again when you re-screen.

When the rule is triggered, enhanced CDD follows. Our guide to enhanced due diligence triggers in Australia walks through what the extra steps look like and who approves them.

Country risk in your risk assessment and customer ratings

The fixed rule is the floor. The wider obligation is that your ML/TF risk assessment must have regard to the countries you deal with (section 26C(3)(d)), and each customer’s risk rating must have regard to the countries connected to that customer (section 28(4)(e)). Those are the two places a supervisor will look for your country reasoning.

In the business-wide risk assessment

Start from your own client base and transaction flow, not from a generic list. Ask:

• Which countries do our customers live in, operate in or hold assets in?
• Where do our overseas purchasers, vendors and funding sources come from?
• Do we act for foreign-owned companies, or for trusts with offshore trustees or settlors?
• Which countries appear repeatedly in our referrals, introducers and payment routes?

Then assign a country exposure level to each pattern and say why. A suburban agency that sells almost entirely to local owner-occupiers will reach a different conclusion from a buyers agent who regularly acts for overseas clients. Both can be compliant, provided the assessment reflects the real business and the controls match it.

In each customer rating

The customer rating takes the business-wide view and applies it to the individual. The factors AUSTRAC points to are the ones listed earlier: FATF status, sanctions, tax haven status and links to terrorism support. Take the other country factors from AUSTRAC’s guidance, which is kept current, rather than from a static internal spreadsheet.

A practical rating approach:

The last row matters. A low rating still needs its reasoning on file. “No country concerns” is a finding, and a supervisor will want to see that someone made it.

Sanctions are a separate check

It is common to merge “high-risk countries” and “sanctioned countries” into one idea. They are different regimes with different owners.

Australian sanctions laws implement United Nations Security Council sanctions and Australian autonomous sanctions regimes. The Australian Sanctions Office maintains the Consolidated List of individuals, entities and vessels that are subject to those sanctions. Targeted financial sanctions prohibit using or dealing with assets owned or controlled by a designated person or entity, or making assets available to or for their benefit, directly or indirectly.

The consequences for your workflow:

• A customer can be on the Consolidated List while living in a country that is on no FATF list.
• A customer can live in a FATF call-for-action jurisdiction and be on no sanctions list. Enhanced CDD is still required, but the sanctions screen is clear.
• Both checks run at onboarding and again as lists change, so ongoing re-screening matters more than a one-off check.

Ownership and control

DFAT’s guidance explains that the prohibition extends to assets that are owned or controlled by designated persons and entities, which means an entity that does not appear on the list can still hold controlled assets. DFAT says ownership and control are decided on the facts, and the asset need not be held directly by the designated person or entity. The joint advisory below describes sanctioned people keeping access and control through family members, close associates, nominees and complex ownership structures. That is why beneficial ownership work cannot stop at the first layer, and why name-matching alone is not enough.

If you cannot rule out that a designated person owns or controls the other party, treat that as unresolved and escalate to your compliance officer before the transaction proceeds. For anything involving a possible controlled asset, take legal advice. A person holding an asset who forms the opinion that it is controlled must provide information to the AFP, and attempts to deal with controlled assets that have not taken place should be reported to the Australian Sanctions Office.

Sanctions evasion red flags in property transactions

A joint multilateral advisory on sanctions evasion describes real estate as a way to hold value, and names lawyers, accountants and trust and company service providers as possible enablers. The advisory lists these real estate indicators:

• intermediaries, nominees or straw purchasers;
• opaque corporate structures, including trusts;
• complex ownership structures;
• purchase prices below or above market value.

DFAT has also described contract features that suggest circumvention, such as insisting on anti-sanctions clauses, back-to-back agreements, or payment in currencies other than the Australian or US dollar. AUSTRAC’s real estate indicators add payment through virtual assets, and promissory notes, bills of exchange or other negotiable instruments that can be paid for in cash. The sanctions office asks businesses to assess sanctions risk thoroughly when dealing with Russian entities, and to seek independent legal advice.

Remote purchasing deserves its own attention. Many legitimate overseas buyers complete purchases without travelling, as shown by how overseas buyers close from abroad in other markets. The remote nature is not a red flag by itself, but it makes identity verification, source of funds and the location of every connected person more important, because section 32(d) turns on where people are and where entities were formed.

Suspicious matter red flags that call for escalation

AUSTRAC’s possible red flags include a customer who is obstructive or secretive, tries to avoid know-your-customer checks, cannot explain their source of funds or wealth, or asks for shortcuts and rapid transactions to close the deal quickly. AUSTRAC’s CEO has told agency leaders that deflecting or being difficult when asked to confirm identity should be treated as a red flag.

AUSTRAC is equally clear that one indicator on its own may not suggest suspicious activity. Where you are unsure whether there are reasonable grounds for suspicion, the guidance points to further monitoring and examination, including enhanced CDD. A workable internal rule is:

1. Log every indicator when it is noticed, with the date and who noticed it.
2. Check whether the indicator combines with others, for example an overseas connection plus an unexplained funding source.
3. Escalate to the compliance officer, who decides whether enhanced CDD or an SMR is warranted.
4. Record the decision and its reasoning, whichever way it goes.

Reporting and confidentiality

An SMR is due within 24 hours of forming a suspicion related to terrorism financing, or within 3 business days after the day you formed any other suspicion. The obligation applies even where the service is not ultimately provided, including when someone only asks for it. Under the tipping-off offence in section 123, disclosing SMR information is a criminal offence where it would or could reasonably be expected to prejudice an investigation, so the safe course is not to tell the customer. Our guide to suspicious matter reports for Tranche 2 firms covers the workflow in more detail.

A repeatable country-risk process

For each new customer or matter, the following sequence keeps the legal trigger, the judgement factors and the sanctions check distinct:

1. Map the connected persons. The customer, each beneficial owner, anyone acting for the customer and anyone on whose behalf the service is received.
2. Establish location and formation. Physical presence for individuals, place of formation for companies and trusts.
3. Check the live FATF call-for-action list. Any match means enhanced CDD under section 32(d).
4. Weigh the other country factors. Use AUSTRAC’s current guidance and your own risk assessment.
5. Screen against the Consolidated List. Include beneficial owners and, where relevant, the people who may control them.
6. Rate the customer. Record the country reasoning under section 28(4)(e).
7. Record the officer’s decision. Where your policies require approval, such as for enhanced CDD, note who approved it and when.
8. Check again as lists change. A clear result today does not last; your policies should say when you re-check.

For the underlying identity and beneficial ownership steps, see our overview of Tranche 2 customer due diligence.

Our perspective

Country risk is where compliance programs most often drift apart. The risk assessment says one thing about overseas exposure, the policies say another, and the staff training says a third. A supervisor does not need a dramatic failure to find fault, only an inconsistency.

We built AML Guard for Australian Tranche 2 reporting entities, not adapted from banking or global tools. Its guided wizards produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment, so what you record about the countries you deal with starts in one place.

At the customer level, the platform automates lookups and record keeping, not decisions. Screening results and the officer’s decision sit in one case record, so the answer to “why did you treat this customer this way?” is on file, not in someone’s memory. For companies, beneficial ownership is determined from the ACN, and an officer approves each determination. The judgement stays with your people.

AML Guard

Putting this into practice with AML Guard

If you run an agency, a conveyancing practice or a law or accounting firm, AML Guard keeps one case record holding each identity check, screening result and officer decision, with ACN-based beneficial ownership determination and an officer approving each one.

AML Guard is not self-service; every firm starts with a demo. Book a demo to see how the pieces fit on your own files, or see the pricing page for the subscription and per-check fees.

FAQ

Does the FATF “increased monitoring” list trigger enhanced CDD?

No. Section 32(d) turns on the FATF’s call for enhanced due diligence, not on the increased-monitoring list. A connection to an increased-monitoring jurisdiction is still a country factor to weigh in the customer’s risk rating, and you should record what you decided and why.

Is a customer’s nationality relevant to the section 32(d) rule?

Not on its own. The test is physical presence, or where a company or trust was formed. Nationality may still be one input in your wider assessment, but it does not by itself trigger enhanced CDD.

Is the sanctions check the same as checking for high-risk countries?

No. Sanctions screening runs against DFAT’s Consolidated List and covers designated persons, entities and vessels. It is a separate legal obligation from FATF-based enhanced CDD, and both can apply to the same customer.

Where do I find the current list of high-risk jurisdictions?

AUSTRAC’s high-risk countries guidance links to the FATF’s current statements, including the call-for-action list, and sets out the other country factors. Both are updated, so check them at onboarding and at each re-screen instead of relying on a saved copy.

Sources

• High-risk countries, regions and groups | AUSTRAC
• Sanctions regimes currently implemented under Australian sanctions law | DFAT
• Consolidated List | DFAT
• Tipping off, AUSTRAC
• Guidance Note: Dealing with assets owned or controlled by designated persons and entities | DFAT
• Guidance Note: Sanctions Compliance for Real Estate Professionals | DFAT
• Global Advisory on Russian Sanctions Evasion | DFAT
• Russian contracts aimed at circumventing sanctions | DFAT
• Risk insights and indicators of suspicious activity for the real estate sector | AUSTRAC
• AUSTRAC CEO Brendan Thomas speech, REIV Agency Leaders’ Summit 2025
• Suspicious matter reports | AUSTRAC
• International Buyers: Close a Houston Home from Abroad

Recommended

• AML training for law firms under Tranche 2
• Proliferation Financing Risk for Tranche 2 Firms
• Tranche 2 AML Australia: your compliance obligations explained
• AML/CTF policy template for Tranche 2 firms