Assessing money laundering risks of legal persons and legal arrangements
Introduction
The integrity of a country's framework for preventing money laundering depends, in no small part, on how well it understands the risks posed by the legal persons and legal arrangements created or operating within its borders. Companies, partnerships, trusts, foundations, and similar vehicles serve indispensable commercial and estate-planning functions. Nevertheless, the same structural features that make them useful to legitimate actors can be exploited by those seeking to obscure the origins, movement, or ownership of criminal proceeds.
Recognizing this, the FATF has long required countries to identify, assess, and understand the money laundering (ML) risks associated with legal persons and legal arrangements. What has changed materially between the 2013 Methodology, which governed the most recent completed round of mutual evaluations for FATF members, and the 2022 Methodology is the breadth of that obligation. The revised standard now explicitly requires countries to assess the risks of legal arrangements (not only legal persons) and, critically, to extend their analysis to foreign-created legal persons and arrangements that maintain "sufficient links" with the country. These additions reflect the practical reality that criminal misuse of corporate vehicles is rarely confined to a single jurisdiction, and that a domestically focused risk assessment will inevitably produce an incomplete picture.
This article offers a brief overview of how such risk assessments should be approached, what data sources are available, and where current global practice falls short. It is intended as a reference for legal practitioners who may encounter these issues in advisory, compliance, or transactional work.
Understanding the risk landscape
The ML risk profile of a country's legal persons and arrangements does not exist in isolation; it is shaped by the broader context of the jurisdiction's legal framework, its economic structure, and its exposure to predicate offences. A country with significant natural-resource extraction, for example, faces different entity-related risks than one whose economy is built on financial services or real estate. Similarly, the prevalence of politically exposed persons (PEPs) with ownership interests in domestic companies, or the extent of foreign national ownership of local entities, are contextual factors that bear directly on the nature and scale of risk.
Jurisdictions that are attractive to foreign investors for legitimate reasons (political stability, a robust legal system, favorable tax treatment, a well-developed professional services sector) often find that the same attributes appeal to illicit actors. A strong rule of law and reliable courts, for instance, protect both honest investors and those who wish to park the proceeds of corruption in legally defensible structures. This duality does not imply that economic openness is inherently risky, but it does mean that the features that make a jurisdiction competitive must be examined through a risk lens as well as a commercial one.
Countries must also consider the legal recognition and treatment of different types of arrangements. Where trusts are not recognized under domestic law, the question is not simply whether they are irrelevant, but whether foreign trusts are nonetheless being administered by residents, and if so, whether any regulatory framework governs that activity. The answers to these structural questions shape the scope of the risk assessment itself.
Mapping legal persons and legal arrangements
A meaningful risk assessment begins with a comprehensive mapping exercise: identifying every type of legal person and legal arrangement that can be created under domestic law, along with their principal features, formation requirements, and governance structures. This is more than a systematic exercise. It requires understanding the processes by which each type of entity is created, the basic and beneficial ownership (BO) information that must be collected at formation, and the mechanisms through which that information is maintained, updated, and made accessible to competent authorities.
The scope of this mapping must be genuinely comprehensive. It includes not only commercial companies and partnerships but also associations, foundations, and other forms that may be used to establish non-profit organizations (NPOs). This last point carries a proportionality caution that practitioners should keep in mind: while the ML risks associated with NPO structures should be assessed, any resulting measures must be targeted and must not inadvertently disrupt or discourage legitimate charitable activity. FATF standards are explicit on this point, and countries that impose disproportionate obligations on the NPO sector risk both non-compliance and real-world harm.
Whether a country's definition of beneficial ownership is aligned with the FATF standard matters considerably at this stage. So does the practical question of whether authorities can obtain both basic information (legal form, registered office, directors) and BO information (the natural persons who ultimately own or control the entity) in a timely and reliable manner. A well-drafted law that is not operationally supported by accessible registries or effective supervisory mechanisms will not produce a sound risk assessment.
Sufficient links of entities created abroad
The 2022 Methodology's requirement to assess risks posed by foreign-created legal persons and arrangements rests on the concept of "sufficient links”, which is a deliberately flexible threshold that countries may calibrate based on risk. The principle is straightforward: if a foreign entity or arrangement has a meaningful operational, financial, or physical presence in a jurisdiction, that jurisdiction cannot simply disregard it because formation occurred elsewhere.
For legal persons, indicative links include maintaining a permanent establishment, branch, or agency in the country; conducting significant business activity (measured either by monetary threshold or by operational parameters appropriate to the jurisdiction); holding significant ongoing relationships with financial institutions, virtual asset service providers (VASPs), or designated non-financial businesses and professions (DNFBPs) subject to AML/CFT obligations in the country; owning significant real estate or other registrable assets; employing staff locally; or being tax-resident by reason of effective management or administration.
For trusts and similar legal arrangements, the analysis is similar. Sufficient links may arise where the trust, or a trustee or equivalent, holds significant ongoing business relationships with regulated entities in the country, owns local real estate or investments (including securities), or is subject to domestic taxation, whether income tax, property tax, VAT, or wealth tax.
The word "significant" is deliberately left to national determination, but it must be defined with some rigor. A jurisdiction that sets its threshold so high that virtually no foreign entity qualifies has not complied with the standard in substance. Equally, a threshold set so low as to capture every transient commercial nexus would be operationally unworkable. Countries must strike a proportionate balance, document their reasoning, and be prepared to defend it.
Obstacles to transparency and their relevance to ML risk
Legal arrangements (trusts in particular) can present distinctive obstacles to transparency that are directly relevant to ML risk. These include the inherently private nature of many trust structures (which, unlike companies, are often not subject to public registration); the ability to choose a governing law that may be less transparent than the jurisdiction in which the arrangement operates; the relative ease and speed with which some arrangements can be established; the flexibility to layer multiple structures and to insert distance between the ultimate beneficiary and the legal parties on record; the use of nominee shareholders, nominee directors, and shell companies to obscure ownership; and structural features such as flee clauses, which allow the address of a trust to be shifted to another jurisdiction at short notice.
None of these features is inherently illicit. Many serve legitimate asset-protection, succession-planning, or commercial objectives. But collectively, they create an environment in which the true ownership and control of assets can be concealed with relative ease, and practitioners involved in the formation, administration, or advising of such structures must understand the risk implications of each structural choice they facilitate.
Data sources for risk assessment
A credible risk assessment of legal persons and arrangements requires a multi-agency approach to data collection and analysis. The following categories of data sources, while not exhaustive, represent the core inputs that countries should draw upon.
Registration and formation data form the foundation: incorporation volumes and trends, the types of entities being created, the speed at which newly formed entities can begin operating, and whether supplementary requirements (such as opening a bank account or registering with tax authorities) apply. The ease with which ownership can be changed, and complex multi-layered structures can be assembled is itself a risk indicator.
Financial intelligence is equally critical. Suspicious activity reports (SARs) and suspicious transaction reports (STRs) analyzed by the Financial Intelligence Unit (FIU), together with case studies and typology reports from law enforcement and prosecutors, provide evidence of how legal persons and arrangements have practically been misused. These should be analyzed for common patterns: the type of legal structure involved, the jurisdiction of incorporation, the concealment techniques employed, the role of intermediaries (lawyers, accountants, trust and company service providers), and the nature of the predicate offence.
Tax data offers a distinct analytical dimension. Entities that have never filed a tax return since formation, or that have ceased filing while maintaining active bank accounts, are strong candidates for further scrutiny. The OECD's Common Reporting Standard (CRS) and bilateral Tax Information Exchange Agreements can supplement domestic data with cross-border information. Tax attractiveness indices, while not risk assessments in themselves, provide useful contextual input.
Supervisory data from TCSP regulators, including compliance records, inspection findings, and information on the marketing practices of formation agents, can reveal whether a jurisdiction is being actively promoted to non-residents based on attributes (anonymity, asset protection, minimal disclosure) that correlate with ML risk.
Public procurement data, when combined with financial intelligence and tax information, can identify specific red-flag patterns. A disproportionate number of public contracts awarded to entities created shortly before tender announcements, or to entities with no declared revenue, may indicate prearranged procurement or the use of shell companies as vehicles for corruption.
Finally, countries should draw on academic research, investigative journalism, reports from international organizations (including FATF and Egmont Group typology reports, the World Bank's analyses of nominee services, and the FATF's work on laundering the proceeds of corruption), and incoming and outgoing mutual legal assistance (MLA) requests relating to legal persons and arrangements.
Domestic V. Foreign entities/arrangements
The data points and risk indicators that are most informative vary depending on whether the assessment concerns domestic legal persons, foreign legal persons, or legal arrangements.
For domestic legal persons, registration statistics and trend analysis are the starting point, supplemented by examination of TCSP advertising practices, particularly where formation agents actively market the jurisdiction to non-residents by emphasizing attributes such as confidentiality or minimal regulatory burden. Information on dormant bank accounts linked to newly formed entities with negligible transaction activity is another useful indicator.
For foreign legal persons, cross-border transaction monitoring by the FIU is of value, as it can reveal funds moving through chains of legal persons across multiple jurisdictions, especially those involving high-risk or sanctioned jurisdictions, or territories subject to FATF calls for action or increased monitoring. Countries should also consider their exposure to risks arising from entities formed in jurisdictions subject to international financial sanctions or embargoes.
For legal arrangements, the key data sources include trust or arrangement registries (where they exist), tax authority records on the creation and registration of trusts and similar vehicles, cross-border transaction monitoring involving trust accounts, and BO registry data linking trusts to investments in real estate, luxury goods, or operating companies.
A Snapshot of the current global practice
The state of global practice remains uneven. Of the sixty countries that responded to the FATF's October 2023 survey for the ML National Risk Assessment (NRA) Guidance update, only thirty-one (55%) had conducted a risk assessment of legal persons within their NRA, and just nineteen (34%) had done so for legal arrangements. Fifteen countries (27%) had carried out a separate, dedicated risk assessment of legal persons and/or legal arrangements.
Mutual evaluation reports (MERs) and follow-up reports (FURs) for FATF members indicate that only 37% of countries have fully met criterion 24.2 (the requirement to assess the risks of legal persons) while 34% have only partly met or not met this criterion at all.
The most common criticisms of existing risk assessments are revealing. Evaluators have noted inadequate scope and depth, including failure to cover all types of legal persons; a tendency to overlook the potential for criminal misuse of domestic entities; an overly domestic focus that neglects the risks posed by foreign legal persons and foreign ownership; and insufficient attention to the mechanisms by which beneficial ownership information is obtained and verified. These shortcomings are not merely technical; they undermine the ability of countries to design effective preventive and enforcement measures.
Conclusion
A structured, data-informed risk assessment of legal persons and legal arrangements is not an optional refinement of AML/CFT policy. It is a foundational requirement under the FATF standards, and one that the 2022 Methodology has made materially more demanding. Good practice requires comprehensive mapping, multi-agency data collection, rigorous treatment of foreign entities and arrangements with sufficient links, and an appraisal of where domestic frameworks fall short.
Significant gaps remain globally. Too many jurisdictions still produce risk assessments that are narrow in scope, domestically focused, and disconnected from the practical realities of how legal vehicles are misused. Legal practitioners, whether acting as advisors, compliance officers, or intermediaries in the formation and administration of entities and arrangements, are uniquely positioned to identify both risk indicators and structural vulnerabilities. That role carries an obligation to look beyond formal compliance and to exercise independent professional judgment in assessing the risks that the structures they work with may present.
A final caution on proportionality: risk assessment is a tool for targeting measures at genuine threats, not a license for regulatory overreach. The NPO sector has been subject to disproportionate scrutiny in some jurisdictions, with consequences that undermine legitimate civil society activity. Any measures flowing from a risk assessment must be calibrated to the identified risk, and practitioners should be prepared to push back where proposed measures are excessive relative to the evidence.
Source: FATF