A foreign connection is a starting point
Country risk concerns the countries involved in providing your designated services and how those connections affect the risk you face. Identify the actual connection. A customer's location, an entity's place of formation and the destination of an asset are not interchangeable facts.
Sections 26C and 28 require relevant countries to be considered in the business and initial customer assessments for Australian permanent establishments. They do not make every foreign connection the same. A useful assessment explains why a connection matters to this service and the available information. Nationality alone is not a complete country risk assessment.
Source: Federal Register of Legislation: Sections 26C(3)(d), 28(4)(e), 32(d).
- Risk assessment
Identify the actual connection, such as location, formation or asset destination.
- Enhanced CDD trigger
Examine the persons, presence or formation links and jurisdiction conditions in section 32(d).
A country connection is not a complete legal test
These questions require separate checks. An overseas connection alone does not establish the specific trigger.
Separate evidence questions. An answer to one does not settle the others.
Examine the legal trigger separately
Section 32(d) creates a specific enhanced customer due diligence (CDD) trigger. For an individual, the connection is physical presence in the relevant jurisdiction. For a body corporate or legal arrangement, it is formation there. FATF must have called for enhanced due diligence for that high-risk jurisdiction. Read the provision's categories and conditions rather than substituting a broad label such as overseas.
The relevant persons include the customer and its beneficial owners. They also include persons on whose behalf the customer receives the service and persons acting for the customer. This page does not maintain a live country list. The business must examine the current FATF position when it applies that condition.
Source: Federal Register of Legislation: Sections 26C(3)(d), 28(4)(e), 32(d).
Invented example: two different connections
Consider two fictional files. In one, a customer has a historical connection to another country but no relevant current presence or formation link established in the file. In the other, the customer is a company formed in a jurisdiction covered by the specific trigger.
The business records the facts separately. It does not use the same country label to erase the distinction. The first file can still present risk requiring examination. The second needs the exact statutory condition assessed. Neither example determines the final response without the remaining facts, including the identity and role of the connected person.
Source: Federal Register of Legislation: Sections 26C(3)(d), 28(4)(e), 32(d).
Keep evidence dated
For practical review, record the country information checked, its date and the particular connection being assessed. A copied spreadsheet can become stale, while a current list can still be applied to the wrong person. Both problems affect the decision.
Keep general risk reasoning distinct from a mandatory trigger and from sanctions checks. They may overlap in a case but answer different questions. If a list or customer fact changes, a reviewer should be able to identify the affected decision. The aim is a traceable explanation, not a permanent judgement about every person associated with a country.
Source: Federal Register of Legislation: Sections 26C(3)(d), 28(4)(e), 32(d).