Contact us
Facebook Linkedin Instagram

Beyond the FATF Lists: Why UK law firms must look further when assessing corruption risk

Picture of Anne Austin

Anne Austin

Director

Combining the Latest FATF Grey List Updates with Transparency International’s 2025 Corruption Perceptions Index

February 2026 has brought significant developments for UK law firm compliance professionals. The Financial Action Task Force (FATF) added Kuwait and Papua New Guinea to its grey list, triggering mandatory enhanced due diligence requirements under UK law. Just days later, Transparency International released its 2025 Corruption Perceptions Index (CPI), revealing a concerning global picture: corruption is worsening worldwide, with the global average score dropping to its lowest level in over a decade.

For Money Laundering Reporting Officers (MLROs) in UK law firms, these two developments together tell an important story: FATF lists are essential but don’t reveal the global picture. Corruption risk extends far beyond the countries formally designated by FATF. This article explains why a comprehensive approach to geographic risk assessment – one that incorporates multiple credible sources including the Corruption Perceptions Index – is not only best practice but a legal requirement under the Money Laundering Regulations 2017.

February 2026: Two critical developments

FATF Grey List Expansion

As covered in our companion guidance [insert link], the FATF’s addition of Kuwait and Papua New Guinea to its grey list (Jurisdictions Under Increased Monitoring) means these countries are now classified as ‘high-risk third countries’ under Regulation 33(3)(a) of the MLR 2017. This automatically triggers a legal requirement for UK law firms to apply enhanced due diligence to all business relationships and transactions involving persons established in these jurisdictions.

Corruption Perceptions Index 2025: A deteriorating global picture

Released on 10 February 2026, Transparency International’s Corruption Perceptions Index 2025 paints a stark picture of global corruption. The index ranks 182 countries and territories on a scale from 0 (highly corrupt) to 100 (very clean), drawing on 13 independent data sources including assessments by the World Bank, World Economic Forum, and specialist risk consultancies.

Key findings:

  • The global average score has dropped to 42 out of 100, the lowest in over a decade
  • 122 out of 182 countries (67%) score below 50, indicating serious corruption problems
  • Only five countries now score above 80, down from 12 a decade ago
  • Even established democracies are experiencing declines: United States (64), United Kingdom (70), Canada (75), France (66), New Zealand (81)
  • 36 of the 50 countries with significant CPI declines have also experienced restrictions on civic space and freedoms


The Critical Gap: High corruption risk beyond FATF lists

Here lies the critical insight for UK law firm MLROs: there are numerous countries with serious corruption problems that do not appear on any FATF list. These jurisdictions present genuine money laundering and terrorist financing risks that would be missed by a compliance approach focused solely on FATF designations.

High-Risk Countries Not on FATF Lists

Analysis of the 2025 CPI reveals multiple countries with very low scores (below 30 out of 100) that are NOT on either the FATF grey list or black list. These countries represent significant corruption risk that MLROs must independently assess:

Countries Scoring Below 30 (Not on FATF Lists):

  • Mexico (27)
  • Pakistan (28)
  • Iraq (28)
  • Madagascar (25)
  • Nicaragua (14)
  • Syria (15) – while on FATF grey list, its extremely low CPI score indicates much higher risk than FATF listing alone suggest

 

 

 

 

Countries Scoring 30-40 (Not on FATF Lists):

  • Azerbaijan (30)
  • Turkey (31)
  • Angola (32) – despite being on FATF grey list, included here as example of alignment
  • Serbia (33)
  • Nepal (34) – on FATF grey list
  • Indonesia (34)
  • Brazil (35)
  • Ukraine (36)
  • Colombia (37)
  • Dominican Republic (37)
  • India (39)
  • Tunisia (39)
  • Hungary (40)

These countries include major economies and jurisdictions where UK law firms commonly have client connections. Mexico, Brazil, India, Indonesia, and Turkey are all significant global economies with substantial cross-border trade and investment flows. Pakistan and Iraq are jurisdictions with known security and governance challenges. Yet none appear on FATF’s mandatory enhanced due diligence lists.

Declining democracies present emerging risks

The 2025 CPI also reveals a concerning trend among traditionally low-risk democracies. Countries that law firms might historically have considered low-risk are experiencing deteriorating corruption perceptions:

  • United Kingdom: 70 (down from previous years)
  • United States: 64 (lowest score ever, continuing downward trend)
  • France: 66
  • Canada: 75
  • New Zealand: 81
  • Sweden: 80

While these countries still score relatively well compared to the global average, the trend is concerning and suggests that even in established democracies, corruption risks can increase. For UK law firms, this reinforces that geographic risk assessment cannot be static – it must be regularly updated to reflect changing circumstances.

The UK legal requirement to consider broader corruption indicators

Some MLROs may ask: ‘If these countries aren’t on FATF lists, am I legally required to consider them in my risk assessment?’ The answer is an unequivocal yes. The Money Laundering Regulations 2017 explicitly require this broader assessment.

Regulation 18: Firm-Wide Risk Assessment

Regulation 18(1) of the MLR 2017 requires relevant persons to ‘take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject.’ Regulation 18(2) specifies that this assessment must take into account various factors, including under 18(2)(b): ‘the countries or geographic areas in which it operates.’

Critically, this requirement is separate from and additional to the mandatory enhanced due diligence requirements triggered by FATF listings under Regulation 33. The firm-wide risk assessment under Regulation 18 requires firms to look beyond FATF lists to assess ALL geographic risks relevant to their business.

Regulation 33: The ‘Credible Sources’ provision

While Regulation 33(3)(a) mandates enhanced due diligence for FATF-listed countries, Regulation 33(6) provides additional guidance on assessing geographic risk. It states that when determining whether a country presents higher risk, relevant persons must take into account whether the country has been:

  • ‘Identified by credible sources, such as mutual evaluations, detailed assessment reports or published follow-up reports, as not having effective systems to counter money laundering and terrorist financing’
  • ‘Identified by credible sources as having significant levels of corruption or other criminal activity’


This second provision is key. The MLR 2017 explicitly requires firms to consider countries identified by credible sources as having significant corruption. Transparency International, as the organisation behind the globally recognised Corruption Perceptions Index, clearly qualifies as such a credible source.

What constitutes a ‘Credible Source’?

The regulations do not exhaustively define ‘credible sources,’ but provide examples including mutual evaluations and detailed assessment reports. In practice, credible sources for corruption assessment include:

  • Transparency International’s Corruption Perceptions Index
  • World Bank governance indicators
  • OECD anti-bribery evaluations
  • United Nations Office on Drugs and Crime reports
  • European Commission assessments
  • Reputable international NGOs and think tanks focused on governance and corruption


The Legal Sector Affinity Group guidance reinforces this, noting that firms should consider multiple sources of information when assessing geographic risk, not rely solely on FATF designations.

SRA expectations

The Solicitors Regulation Authority has been clear in its guidance and enforcement approach that firm-wide risk assessments must genuinely assess risk, not simply list FATF countries. The SRA’s warning notice on firm-wide risk assessments explicitly states that when considering geographic risk, firms must assess ‘any country that may bring a risk of corruption or may be considered a high-risk third country.’

The SRA expects firms to consider their sectoral risk assessment, which identifies geographic areas of higher risk including those with significant corruption. A firm-wide risk assessment that only addresses FATF-listed countries while ignoring other high-corruption jurisdictions where the firm has clients would be considered inadequate.

Practical implementation: Incorporating the CPI into your risk assessment

Step 1: Review the 2025 CPI Data

MLROs should immediately review the full 2025 Corruption Perceptions Index and identify:

  • Countries scoring below 40 (indicating serious corruption concerns)
  • Countries with significant score declines since 2012 (indicating deteriorating conditions)
  • Any jurisdictions where your firm has client connections

 

 

 

 

 

 

Step 2: Update your firm-wide risk assessment

The geographic risk section of your firm-wide risk assessment should be updated to reflect CPI findings. This should include:

Tiered risk categories

Consider adopting a tiered approach that combines multiple indicators:

  • Very High Risk: FATF black list countries, CPI score below 25
  • High Risk: FATF grey list countries, CPI score 25-40, countries with significant recent CPI declines
  • Elevated Risk: CPI score 40-50, countries with moderate recent declines
  • Standard Risk: CPI score above 50 with stable or improving trend


Document the methodology

Your risk assessment should clearly document:

  • The sources consulted (e.g., ‘FATF lists, Transparency International CPI 2025, World Bank governance indicators’)
  • The thresholds applied (e.g., ‘Countries with CPI scores below 40 are categorised as high risk’)
  • The rationale for your categorisation
  • The date of the assessment and when it will next be reviewed

Step 3: Identify affected client files

Conduct a review of your client base to identify matters involving countries that are:

  • Newly added to FATF lists (Kuwait, Papua New Guinea)
  • Identified as high corruption risk through the CPI but not on FATF lists

This should include clients incorporated in these countries, beneficial owners from these countries, source of funds/wealth originating there, and transaction counterparties based in these jurisdictions.

 

 

 

 

 

 

 

 

Step 4: Calibrate due diligence measures

FATF-Listed countries (mandatory EDD)

For Kuwait and Papua New Guinea (and all other FATF grey/black list countries), enhanced due diligence is legally required under Regulation 33(1)(b). This is mandatory, not discretionary.

High-corruption countries not on FATF lists (risk-based EDD)

For countries with very low CPI scores (below 40) that are not on FATF lists, enhanced due diligence is not legally mandated by Regulation 33(1)(b), but should be strongly considered as part of your risk-based approach under Regulation 33(1)(c), which requires EDD in ‘any other situation which by its nature can present a higher risk of money laundering or terrorist financing.’

The decision to apply EDD should be based on:

  • The CPI score (lower scores indicate higher risk)
  • The nature and extent of the client’s connection to the jurisdiction
  • The presence of other risk factors (PEPs, high-value transactions, complex structures, etc.)
  • The specific services you are providing
  • Your firm’s risk appetite


For example, a client incorporated in Mexico (CPI score 27) seeking to structure a high-value UK property acquisition would warrant enhanced due diligence even though Mexico is not FATF-listed. The combination of low CPI score, high-value transaction, and property sector risk would clearly present ‘a higher risk of money laundering’ under Regulation 33(1)(c).

Step 5: Update policies and procedures

Ensure your firm’s AML policies and procedures document the requirement to consider corruption indicators beyond FATF lists. This should include:

  • Reference to the Corruption Perceptions Index as a credible source under Regulation 33(6)
  • Guidance for fee-earners on when to escalate matters involving high-corruption jurisdictions
  • Clear thresholds and decision-making processes
  • Requirements for documenting the assessment and decision

Step 6: Train staff

All relevant staff should be made aware that:

  • Corruption risk extends beyond FATF-listed countries
  • The Corruption Perceptions Index is a key reference tool
  • Certain high-risk countries (like Mexico, Brazil, India, Pakistan) require particular attention
  • Geographic risk assessment must be dynamic, not static

Required Action:

While India’s low CPI score is noted in the risk assessment, standard customer due diligence may be appropriate if the company is publicly listed, has transparent ownership, operates in a legitimate sector, and the transaction is clearly for genuine business purposes. However, this decision and rationale should be clearly documented. The firm should conduct enhanced monitoring if unusual patterns emerge.

This scenario illustrates that considering the CPI does not mean automatically applying EDD to all clients from lower-scoring countries—rather, it means factoring corruption risk into a holistic, risk-based assessment.

Why broader geographic risk assessment is best practice

Regulatory compliance

As demonstrated above, incorporating corruption indicators into geographic risk assessment is not merely best practice – it is a legal requirement under Regulation 33(6) of the MLR 2017. The SRA has been clear that firm-wide risk assessments must genuinely assess risk across all dimensions, including corruption. A narrow approach focused solely on FATF lists will not satisfy regulatory expectations.

Protection of the firm

Law firms face serious consequences from involvement in money laundering, whether inadvertent or otherwise. These include:

  • Criminal prosecution under the Proceeds of Crime Act 2002
  • SRA disciplinary action including fines and restrictions on practice
  • Reputational damage
  • Loss of professional indemnity insurance coverage
  • Civil liability to victims of fraud or crime


By considering corruption risk beyond FATF lists, firms protect themselves from these risks. Corruption is a predicate offence for money laundering – proceeds of corruption are criminal property that law firms must not assist in laundering.

Better risk management

The Corruption Perceptions Index provides valuable intelligence that enhances risk management:

  • Independent assessment: The CPI draws on 13 independent data sources, providing a more comprehensive view than any single indicator
  • Granular scoring: Unlike binary FATF listings, the CPI provides scores from 0-100, allowing for more nuanced risk assessment
  • Trend analysis: The CPI tracks changes over time, identifying deteriorating situations before they appear on FATF lists
  • Wider coverage: The CPI covers 182 jurisdictions, far more than the 24 countries currently on FATF lists


Professional standards

As gatekeepers to the financial system and privileged actors in complex transactions, solicitors have professional and ethical obligations to prevent their services being misused for criminal purposes. The SRA Principles require solicitors to act with integrity and uphold public trust in the profession. Failing to identify obvious corruption risks because they fall outside FATF lists would not meet these professional standards.

Client service

Sophisticated risk assessment also serves clients’ interests. Clients do not benefit from advisors who fail to identify risks that could expose them to criminal liability, regulatory sanction, or reputational damage. By properly assessing corruption risk, firms can provide better advice on structuring transactions, selecting counterparties, and managing compliance obligations.

Ongoing monitoring and review

Geographic risk assessment cannot be a one-time exercise. The 2025 CPI demonstrates that corruption levels change – both for better and for worse. Firms should:

  • Review the CPI annually when Transparency International publishes new data (typically in January/February)
  • Update firm-wide risk assessments to reflect CPI changes
  • Monitor FATF list updates (published three times yearly in February, June, and October)
  • Review other credible sources including World Bank governance indicators and OECD reports
  • Reassess existing high-risk client relationships annually
  • Document all reviews and updates

Conclusion

The FATF grey list expansion and the 2025 Corruption Perceptions Index together deliver a clear message to UK law firm MLROs: effective anti-money laundering compliance requires looking beyond mandatory lists to comprehensively assess geographic risk.

While FATF listings trigger mandatory enhanced due diligence under Regulation 33(1)(b), the Money Laundering Regulations 2017 explicitly require firms to consider countries identified by credible sources as having significant corruption when assessing risk. The Corruption Perceptions Index, produced by Transparency International and drawing on 13 independent data sources, clearly qualifies as such a credible source.

Countries like Mexico, Brazil, India, Pakistan, Indonesia, and others present genuine corruption and money laundering risks despite not appearing on FATF lists. UK law firms with client connections to these jurisdictions must assess and, where appropriate, apply enhanced due diligence measures based on the totality of risk factors.

This is not gold-plating or going beyond legal requirements – it is fulfilling the clear obligations under Regulation 18 (firm-wide risk assessment) and Regulation 33(6) (consideration of credible sources identifying corruption) of the MLR 2017. It is also sound risk management, professional best practice, and protection for both the firm and its clients.

MLROs should take immediate action to:

  1. Review the 2025 Corruption Perceptions Index
  2. Update firm-wide risk assessments to incorporate CPI data
  3. Identify client files involving high-corruption jurisdictions
  4. Apply appropriate due diligence measures based on comprehensive risk assessment
  5. Update policies and procedures to reflect this broader approach
  6. Train staff on the importance of considering corruption risk beyond FATF lists


In an increasingly complex global environment where corruption is worsening rather than improving, UK law firms must be vigilant. FATF lists are essential tools, but they are not sufficient. Only by combining multiple credible sources, including the Corruption Perceptions Index, can MLROs truly understand and manage the money laundering risks their firms face.

Can we help? Send us a message
Tagged ,