A foreign connection is a starting point
Country risk concerns the countries involved in providing your designated services and how those connections affect the risk you face. Identify the actual connection. A customer's location, an entity's place of formation and the destination of an asset are not interchangeable facts.
Sections 26C and 28 require relevant countries to be considered in the business and initial customer assessments for Australian permanent establishments. They do not make every foreign connection the same. A useful assessment explains why a connection matters to this service and the available information. Nationality alone is not a complete country risk assessment.
- Risk assessment
Identify the actual connection, such as location, formation or asset destination.
- Enhanced CDD trigger
Check the persons, presence or formation links and jurisdiction conditions in section 32(d).
A country connection is not a complete legal test
These questions require separate checks. An overseas connection alone does not establish the specific trigger.
Separate evidence questions. An answer to one does not settle the others.
Check the legal trigger separately
Section 32(d) creates a specific enhanced CDD trigger. It concerns listed relevant persons who are individuals physically present in a high-risk jurisdiction, or bodies corporate or legal arrangements formed there, where FATF has called for enhanced due diligence. Read the provision's categories and conditions rather than substituting a broad label such as overseas.
The relevant persons include the customer, beneficial owners, persons on whose behalf the service is received and persons acting for the customer. This page does not maintain a live country list. The current FATF position must be checked when applying that condition.
Worked example: two different connections
Consider two fictional files. In one, a customer has a historical connection to another country but no relevant current presence or formation link established in the file. In the other, the customer is a company formed in a jurisdiction covered by the specific trigger.
The business records the facts separately. It does not use the same country label to erase the distinction. The first file can still present risk requiring examination. The second needs the exact statutory condition assessed. Neither example determines the final response without the remaining facts, including the identity and role of the connected person.
Keep evidence dated
For practical review, record the country information checked, its date and the particular connection being assessed. A copied spreadsheet can become stale, while a current list can still be applied to the wrong person. Both problems affect the decision.
Keep general risk reasoning distinct from a mandatory trigger and from sanctions checks. They may overlap in a case but answer different questions. If a list or customer fact changes, a reviewer should be able to identify the affected decision. The aim is a traceable explanation, not a permanent judgement about every person associated with a country.