A proliferation financing risk assessment is a structured exercise in which a government, a bank or another regulated business works out how, and how likely, it is to be misused to finance the spread of nuclear, chemical or biological weapons and their means of delivery. It examines the threats faced, the weaknesses that could be exploited and the consequences, and it provides the basis for deciding which controls are needed. It is the counterpart, for proliferation financing, of the risk assessments long required for money laundering and terrorist financing.
The requirement comes from the Financial Action Task Force, which amended its standards in October 2020 to oblige countries and the private sector to identify, assess and understand their proliferation financing risks and to take proportionate action to mitigate them. Guidance on how to carry out the assessment followed in 2021. Countries have since been writing the obligation into national law and regulation.
What risk is being assessed
The standard defines the risk narrowly. For these purposes, proliferation financing risk means the potential breach, non-implementation or evasion of the targeted financial sanctions that the United Nations Security Council has imposed in connection with proliferation, which concern North Korea and Iran. The obligation is therefore anchored in sanctions: the question is how designated persons and those acting for them might obtain funds or financial services despite the asset freeze. In practice it is closely related to the analysis of sanctions evasion.
Many countries and firms choose to look more widely, covering the financing of trade in sensitive goods and technology whether or not a designated party is involved. The guidance allows this, and national laws on export control and on weapons of mass destruction may in any case require it.
National risk assessments
A country's assessment is normally led by a co-ordinating body and draws on intelligence services, customs, export licensing authorities, financial supervisors, the financial intelligence unit and the private sector. It considers the country's exposure through factors such as trade and transport links with states of concern, its role as a financial, shipping or company formation centre, the presence of industries producing dual-use goods, and the strength of its legal and supervisory framework. The findings are meant to guide the allocation of official resources, and a version is usually published so that firms can take it into account. Some countries produce a standalone document, and others include a chapter within their wider national risk assessment.
Assessments by firms
Financial institutions, virtual asset service providers and designated non-financial businesses such as lawyers, accountants and company service providers are expected to assess their own exposure, in a manner proportionate to their size and business. The assessment is usually organised around the same categories used in a compliance risk assessment for financial crime:
- Customers. Clients trading in dual-use or controlled goods, shipping and freight companies, opaque corporate structures, and customers with links to higher-risk jurisdictions.
- Countries. Dealings with, or near, states subject to proliferation sanctions, and with known transhipment and diversion points.
- Products and services. Trade finance, correspondent banking, maritime insurance, and crypto-asset services, each of which has featured in documented evasion cases.
- Delivery channels. Business conducted through intermediaries or without direct contact with the customer.
The firm rates the inherent risk in each area, evaluates how well its existing controls reduce it, and records the residual risk and any actions required. Sources include the national assessment, reports of the United Nations panels of experts, guidance from supervisors, and typologies describing methods such as the use of a shell company or front company, falsified shipping documents, ship-to-ship transfers and the theft and laundering of crypto-assets.
Using the results
Where the assessment finds higher risk, the firm is expected to apply enhanced measures; where risk is low, simplified measures may be acceptable. Whatever the outcome, the underlying duty to implement targeted financial sanctions in full, without delay, is not subject to a risk-based approach: a firm may not decide to screen less because it rates its risk as low. The assessment informs the measures that sit around screening, in line with the risk-based approach.
Typical responses include extending customer due diligence questions to cover the nature of goods traded and end users, adding checks on vessels and dual-use goods to trade finance processing, tuning sanctions screening to capture associates of designated parties, staff training, and escalation routes to the sanctions and export control specialists. The assessment must be documented, approved by senior management, kept up to date and made available to the supervisor.
Challenges
Proliferation financing is harder to assess than money laundering. Confirmed cases are few, so there is little data from which to estimate likelihood. Transactions typically look like ordinary trade payments, and the party of concern is usually hidden behind intermediaries in third countries. Identifying dual-use goods requires technical knowledge that financial institutions rarely have, and the documents they see may describe goods only in general terms.
Evaluations by the Financial Action Task Force and its regional bodies have found that understanding of this risk is weaker than for other financial crime, particularly outside the banking sector. Assessments also overlap with work on trade-based money laundering and with the analysis set out in a sanctions evasion typology, and many firms combine them in a single financial crime risk assessment with a dedicated section.