Recently, one of our clients reached out to share a document issued by the Luxembourg regulator, the CSSF, concerning a thematic review on counter-proliferation financing controls. They also asked for feedback in relation to the CountryRisk.io AML Country Risk Score and methodology. You can find the document here (Link). In this short blog post, we share our response and some additional analysis.

Before we dive into the details, we want to emphasise how grateful we are when clients share such documents with us. This is one of the most effective ways for us to understand what matters to our users—and, by extension, to regulators across the jurisdictions in which our clients operate. Over the years, we have received questions on a wide range of topics, from offshore financial centres and sanctions evasion to golden visa schemes and many other AML-related issues. While every client query naturally brings a moment of nervousness—did we overlook something? are we giving the most accurate answer?—we genuinely appreciate this input. It ensures our product remains relevant and aligned with market and regulatory expectations.

CSSF Review

So, what did the CSSF review cover? The regulator engaged with five Luxembourg-based investment fund managers to examine how they manage risks related to the potential financing of proliferation weapons of mass destruction, as well as risks involving dual-use goods and investments linked to vessels, shipping, or other forms of transportation. This already illustrates the complexity and breadth of challenges that compliance teams must navigate.

The review refers to the FATF assessment criteria and to Luxembourg’s Law of 19 December 2020. To quote the CSSF document:

“Articles 2 and 3 of the Law of 19 December 2020 set the targeted financial sanctions (hereafter ‘TFS’) specific obligations for professionals, including for Luxembourg IFMs to apply restrictive measures in financial matters regarding funds, assets, and economic resources of any kind, where there is a risk of proliferation financing.”

CountryRisk.io AML Country Risk Context

Our client asked how such aspects are reflected in the CountryRisk.io AML country risk methodology. As we are currently preparing an updated version of this methodology, we refer below to both the current (2020) version (Link) and the upcoming update.

In the 2020 methodology, proliferation-related risks are assessed through a country’s compliance with FATF Recommendations 1, 2, and 7—all explicitly referenced in the CSSF review. Their focus is as follows:

• R.1: Assessing risks and applying a risk-based approach
• R.2: National cooperation and coordination
• R.7: Targeted financial sanctions related to proliferation

FATF assessments score each recommendation as:

• C: Compliant
• LC: Largely Compliant
• PC: Partially Compliant
• NC: Non-Compliant

In our methodology, we assign increasing risk points: zero for “Compliant” up to 100 for “Non-Compliant.” Because FATF assessments provide such essential insight into a country’s AML controls, we also assign the maximum score to countries without a completed FATF assessment. This may appear strict, but given the importance of FATF evaluations, a conservative stance is justified. You can find the full list of assessments here (Link).

From this perspective, our coverage is robust. However, the CSSF also highlights the Peddling Peril Index (PPI) as a best-practice risk measure. The PPI, produced by the Institute for Science and International Security (Link), assesses the strength of national strategic trade controls aimed at preventing the spread of nuclear and other destructive weapons—and the means to produce them. Its mission is well summarised in the latest PPI report:

“The Institute for Science and International Security is a non-profit, non-partisan institution dedicated to informing the public about science and policy issues affecting international security. Its primary focus is on stopping the spread of nuclear weapons and related technology to additional nations and to terrorists, bringing about greater transparency of nuclear activities worldwide, strengthening the international nonproliferation regime, and achieving deep cuts in nuclear arsenals.”

We do not currently include the PPI in the 2020 AML methodology. It will, however, form part of the updated methodology to be released in early 2026, alongside FATF assessments.

To evaluate potential gaps in the 2020 version, we compared our AML risk scores with the PPI. As shown in the chart below, the correlation is strong: countries with weaker PPI scores—i.e., weaker controls—also tend to exhibit higher AML country risk classifications. The countries with the poorest PPI ratings are the expected ones, such as North Korea and Iran.

In addition, we examined which countries score highest and lowest risk when considering only FATF Recommendations 1, 2, and 7, limited to jurisdictions with FATF assessments. The results:

Highest risk: Chad, Algeria, Central African Republic, Gabon, Haiti, Congo (DRC), Eswatini, Venezuela, Tanzania, Suriname, Solomon Islands, São Tomé and Príncipe, …

Lowest risk: Vanuatu, Mauritius, Iceland, Belize, Senegal, France, Malta, Malaysia, Luxembourg, Latvia, Jersey, Cuba, Costa Rica, Bolivia, Bermuda, Andorra, …

While the high-risk group contains few surprises, some countries in the low-risk category—such as Senegal, Cuba, or Bolivia—may seem unexpected. This is an important reminder that AML country risk is multi-dimensional. A comprehensive understanding requires examining a broad set of indicators rather than relying on any single measure.

Conclusion

The CSSF review is a timely reminder of how rapidly expectations around counter-proliferation financing and AML controls continue to evolve—and why a structured, data-driven approach to country risk remains essential. At CountryRisk.io, we support compliance teams with risk classifications for 249 jurisdictions, AI-powered tools for conducting enhanced due diligence, and seamless access to a wide range of compliance-relevant datasets, including the EU High-Risk Third Country List, FATF country listings, the Peddling Peril Index, and many other AML indicators via CountryData.io. If you would like to learn more about our AML offering or discuss how our tools can strengthen your risk assessment framework, we would be delighted to speak with you. Feel free to reach out anytime ([email protected]).