Jurisdiction Risk Matrix

What is inside

The matrix classifies 261 countries and territories into Low, Medium and High Risk and Blacklist. The workbook ships with a README, a lookup sheet, a dashboard, the full matrix, source data, a configuration sheet, a source register, a change log and the methodology in short form. Indicators are shown as risk categories (Low, Medium, High), not as the index values themselves.

The guide explains how the model decides, why each indicator is there, how the weights were set, and what a supervisor will ask when you present it.

Why a country risk score alone is not enough

A country risk score is a useful starting point, but a supervisor asks something else: how the risk of a country affects your own customers, products and payment corridors, and on what basis you decided. A label such as High Risk does not answer that question.

That is why every jurisdiction in the matrix carries its basis: which rule fired, a list or the index model. The indicator weights sit on the configuration sheet and follow your risk appetite, the home-jurisdiction sanctions column is filled with the law that binds you, every manual change to a rating needs a written rationale, and changes to data, thresholds and logic are recorded in the change log.

How the 261 jurisdictions fall out

Blacklist		3
High Risk		94
Medium Risk		111
Low Risk		53

What an answer looks like

One row per category and one Northhold default, as the file rates them today. The answer sits next to the name and the rule that produced it sits beside the answer: some jurisdictions are set by a list, others by the index, others by a documented default. The workings stay further along the same row.

How the model decides

Classification is strictly hierarchical: a tier only runs when the tier above it has not fired.

Five indicators and their weights

The Basel AML Index already contains corruption, transparency and governance measures, so equal weights would count them twice. The overlap is priced in openly: Basel carries the main weight and the indicators it overlaps with carry less. If your policy calls for equal weights, set each to 20% on the configuration sheet. The weighted mean is cut into equal thirds of the 1 to 3 scale: Low below 5/3, High from 7/3.

When the data runs out

No publisher covers every jurisdiction, and coverage is thinnest where risk is often highest: small offshore centres and disputed territories. The model follows three rules.

• No indicator available: Manual Review. The model never rates a jurisdiction Low by default.
• Exactly one indicator: the category is raised one level.
• Indicators covering less than half of the total weight: Manual Review, whatever they say.

So that Manual Review does not stay open forever, each of the 68 jurisdictions it covers carries a documented Northhold default rating with the rule behind it, from R1 to R6. You can keep it or replace it with your own decision. An offshore centre cannot rate below Medium.

Which jurisdictions to check

Check every jurisdiction connected to the relationship, not only the country of incorporation:

• where the customer is incorporated and actually operates;
• where payments come from and where they go;
• where the beneficial owners and controllers are;
• intermediary and correspondent banks;
• any place of physical presence, outsourcing or data storage.

Where several jurisdictions are in scope, the highest rating governs until due diligence resolves it. Crimea, Sevastopol and the areas of four oblasts not controlled by the Government of Ukraine have rows of their own: test the territory, not only the country.

What is new in version 1.1

After the FATF plenary of October 2026, Bulgaria, Côte d’Ivoire, the DR Congo and Monaco left the grey list. Bulgaria now scores Low Risk on the indices. Côte d’Ivoire, the DR Congo and Monaco stay High Risk because they remain on the EU list of high-risk third countries. Six territories under territorial sanctions were added (Crimea, Sevastopol and the areas of four oblasts not controlled by the Government of Ukraine), together with the level of each sanctions regime per country. The full change log is in the file and the guide.

What a supervisor will ask

Who needs it

Compliance officers who need a defensible country-risk rating for onboarding, periodic review, transaction monitoring calibration and product eligibility, and who would rather start from a documented model than from a blank sheet.

Putting it to work in your firm

• Fill the home-jurisdiction sanctions column with the regime that binds you.
• Check the weights and thresholds against your risk appetite and business model, and write down what you chose and why.
• Add your internal blacklist.
• Refresh every source and record the as-of date for each.
• Review the Northhold defaults, keep or replace them, approve the model and record it in the change log.

What it does not do

It does not screen names. Sanctions and PEP screening remain separate mandatory controls. It does not replace judgement: the model gives a defensible starting point, the Compliance function owns the final rating. It does not stay current by itself, because lists move. It is not legal advice.

The home-jurisdiction sanctions column ships empty on purpose. A template cannot assume whose law binds you, and the guide explains how to fill it.