3.2.1 Suspicious Transaction Reports (STR)

STRs are central to AML and counter-terrorist financing efforts, enabling LEAs to identify potentially illicit activity. Since the FATF’s first recommendations in 1990, which required countries to enact suspicious transaction reporting (FATF Reference Dolar and Shughart1990), STRs have become standard practice. In 2025, FATF Recommendation 20 mandates that financial institutions report suspected criminal or terrorist-related funds to FIUs (FATF Reference Dorwart, Lu and Tang2012–2025). However, beyond general requirements like identifying transaction originators and beneficiaries (Rec. 16), global STR formats and content are not harmonised.

Legal scholars have examined the broadening scope of reporting duties (Borlini & Montanaro Reference David2017; Ping 2005) and the lack of comparative research on FIUs and STR practices in Europe (Panevski et al. Reference Panevski, Peráček, Rentková, Kryvinska and Poniszewska-Marańda2021). Compliance among Designated Non-Financial Businesses and Professions (DNFBPs), such as lawyers and real estate agents, is often weak (Nduka & Sechap Reference Nduka, Okenyebuno and Sechap2021; Omar & Johari Reference Omar and Johari2015). While, in some jurisdictions, disclosures may be legally constrained by professional secrecy, low STR submissions from these sectors can mislead authorities about the level of risk. Recent work highlights how data-driven systems influence AML professionals’ behaviour in monitoring and red-flagging transactions (Ogbeide et al. 2024).

STR submission processes vary widely, even within the EU. Despite broad use of the goAML software (United Nations n.d.), differences persist in technology, red flags, legal frameworks, and automation. The fourth AML Directive (Directive (EU)2015/849 or ‘4AMLD’) does not standardise format or content, while other countries across the globe allow STRs to be submitted in paper format (European Parliament and Council 2024a; FATF 2019). Although the latest EU AML package aims to harmonise these elements (European Council 2024), earlier explicit ambitions have been scaled back (European Commission Reference Dioquino2021 Article 50).

A key concern in the literature is the exponential growth of STRs, often generating an ‘overflow of useless AML information’ (Dalla Pellegrina & Masciandaro Reference Dearing2009 p. 932). Defensive over-reporting by OEs, driven by fear of penalties and lack of reward for precision, reduces the effectiveness of STRs (Ross & Hannan Reference Ross and Hannan2007 p. 107; Takáts Reference Takáts2007). Though RBA were introduced to curb this trend, STR volumes often keep growing and false positive rates remain high – ranging from 30 per cent to over 95 per cent (Chen et al. Reference De Sanctis2018 p. 276; Jensen & Iosifidis Reference Jensen and Iosifidis2023 p. 8889; Riccardi & Reuter Reference Riccardi and Reuter2024; Richardson et al. Reference Richardson, Williams and Mikkelsen2019).

Scholars emphasise the need for a feedback loop between FIUs and reporting entities to improve STR quality (Ogbeide et al. Reference Ogbeide, Thomson, Gonul, Pollock, Bhowmick and Bello2023 p. 9). Currently, entities often lack insight into outcomes of their reports, hindering refinement of detection systems. A robust feedback mechanism would enhance the utility of STRs and enable greater use of artificial intelligence (AI) and machine learning in AML frameworks.

3.2.2 Geographic Risks in Financial Crime Literature

The RBA became a cornerstone of AML frameworks following the FATF’s 2003 recommendations. With further refinements in 2007 and 2013, it has since become embedded in transnational AML legal frameworks (Financial Action Task Force 2003, 2007, Reference Dorwart, Qu, Brautigam and Gong2013; Ross & Hannan Reference Ross and Hannan2007 p. 107). Regulators continue issuing updated guidance on how OEs and LEAs should address IFF risk (European Banking Authority Reference Dick2021; European Commission 2022; European Union 2023; Financial Action Task Force 2022), and substantial fines have been imposed on OEs when automated red-flagging models failed (Turksen et al. 2024 pp. 373–374).

At the macroeconomic level, the International Monetary Fund (IMF) has employed machine learning and case study analysis to trace abnormal financial flows and assess national vulnerabilities – including around financial secrecy (Jackson et al. Reference El Hajj and Hammoud2023). Regulatory impacts on money laundering routes have been documented empirically (e.g. Aldama-Navarrete Reference Aldama-Navarrete2021), and national risk assessments remain a major theme in AML scholarship (Ferwerda & Kleemans 2019; Grondona et al. Reference Grondona, Meinzer, Monkam, Schultz and Villanueva2025).

At the micro level, scholars have developed numerous models of AML risk assessments. Ross & Hannan (Reference Ross and Hannan2007) defined essential conditions for risk-based decision-making to work effectively: shared definitions of risk, a quantifiable model, and feedback loops from outcomes. These principles remain pivotal in legal, criminological, and supervisory analyses. Although some scholars (Bello & Harvey Reference Davenport and Ronanki2017; de Koker Reference de Koker2009) critique FATF’s vagueness, we align with those building upon its framework. For example, Savona et al. (Reference Savona, Riccardi, Shelton and Kleemans2017 pp. 26–27) specify a function of risk consisting of two elements: the probability of an adverse event occurring, and the impact that would result if it did.

Risk models often consider at least three categories of risk, always inclusive of geographic risk (Alexandre & Balsa Reference Alexandre and Balsa2023 p. 2; AUSTRAC & Australian Government 2020; Sathye & Islam 2011 p. 172). FATF’s guidance highlights geographic, customer, and product/service risk (Financial Action Task Force 2007 pp. 22–23) and the EU’s 2024 AML package further specifies parameters within these categories (European Parliament and Council 2024b, Article 20 and Annex III).

Geographically determined levels of financial secrecy are widely used in both research and administrative practice. For example, Riccardi & Reuter (Reference Riccardi and Reuter2024 pp. 341, 348–349) use financial secrecy in their conceptual framework to explain the level of sophistication of money laundering methods. Similarly, the models proposed by Hopkins and Shelton (Reference Hopkins and Shelton2019, pp. 67–69), Savona et al. (Reference Savona, Riccardi, Shelton and Kleemans2017, p. 162) or the research carried out by the Italian Central Bank (Cassetta et al. Reference De Gregorio and Dunn2014) conceptualise jurisdictional financial secrecy as drivers of IFFs.

In administrative practice, financial secrecy is acknowledged to facilitate tax evasion (ECORYS Reference De Koker2021), money laundering, and the financing of terrorism (European Commission 2022; EUROPOL 2021; Savona et al. Reference Savona, Riccardi, Shelton and Kleemans2017). As the European Commission’s 2022 Supra-National Risk Assessment states: ‘Anonymity remains a critical vulnerability in the international financial system, […] legal entities and arrangements are valued by criminals for their ability to enhance anonymity and conceal the identity of beneficial owners, as well as a means to carry out their illicit activities, for example by facilitating logistics or transport of illicit goods’ (European Commission 2022 p. 10). In the EU, the regulatory environment entering into force in 2027 explicitly requires the new Anti-Money Laundering Authority (AMLA) to issue guidelines defining money laundering (ML) risk factors (Article 32), including ‘third countries identified by credible sources or pursuant to acknowledged processes as enabling financial secrecy’ (European Parliament and Council 2024b, Annex III(3)(f)).

Empirical research on AML is severely constrained by data access limitations due to confidentiality of police files and STRs (Levi et al. Reference Levi, Reuter and Halliday2018; Reuter & Riccardi 2024 p. 331). Data from OEs can be hard to access too, yet a body of research has been developed including by tapping into the ‘pool’ of innocent transactions to which red flagging is applied.

Computer science literature discusses technical innovations in red flagging and STR analysis, including through outlier detection, AI and machine learning models, and visualisation strategies (Jensen & Iosifidis Reference Jensen and Iosifidis2023; Lebid & Veits Reference Lebid and Veits2020; Singh & Best 2019). The features a successful AML data analysis tool for flagging STRs should possess include ‘data quality, detection accuracy, scalability, and reaction time’ (Chen et al. Reference De Sanctis2018 p. 248).

Additionally, the literature discusses two persistent problems with accessible data on risk assessment models. First, criminological and legal literature has warned against racial bias and disproportionate exclusion embedded in AI tools (Turksen et al. 2024). In one documented case, ethnic minorities were systematically excluded from banking services by AI systems (Chen et al. Reference De Sanctis2018 p. 279). These tools can infringe fundamental procedural rights such as the right to a fair trial and the presumption of innocence (Sachoulidou Reference Sachoulidou2023).

A second issue concerns geographic risk indicators themselves. The widespread use of so-called ‘blacklists’ – like FATF grey/blacklists or the EU’s non-cooperative jurisdiction list – often reflects political biases rather than objective data. Research shows that countries with limited geopolitical power, especially from the Global South, are overrepresented on such lists, while powerful nations (e.g. the US) are omitted even though they are essentially displaying the same characteristics as the listed ones (Bello & Harvey Reference Davenport and Ronanki2017; de Koker 2024; Dolar & Shughart Reference Dolar and Shughart2011; Meinzer 2016; Sharman 2010; Unger Reference Unger2023). Even advanced systems struggle with concomitant oversimplification. For example, the risk models of the Spanish notary supervisory authority use binary categories such as domestic/foreign or inclusion in official high-risk country list (García Fresno 2022; Ministerio de Hacienda y Función Pública 2023), thereby missing the nuance of secrecy gradients. The European Parliament has noted that EU tax ‘blacklists’ may be politically motivated rather than being grounded in objective assessments (European Parliament 2023).

Against this background, we argue that a more robust, data-driven alternative is needed. Instead of dichotomous classifications, jurisdictions should be evaluated on a spectrum of financial secrecy, using independent, transparent, and verifiable data. This approach reflects growing consensus across disciplines and aligns with best practices for reducing discriminatory, politically biased, or overly simplistic assessments.

3.2.3 Research Gap and Contribution

Since the publication of the IARM study of Reference Savona, Riccardi, Shelton and Kleemans2017 (Savona et al. Reference Savona, Riccardi, Shelton and Kleemans2017), a consensus is emerging in the literature on the need of more robust geographic risk assessment based on the levels of financial secrecy in AML. Riccardi and Reuter have conceptualised the AML environment money launderers are facing to a large extent in terms of geographically bound levels of financial secrecy. More specifically, they argue that low levels of banking and corporate transparency, coupled with the absence or weakness of cash regulations and asset recovery policies, attract money launderers, hence increasing the risk of ML (Riccardi & Reuter Reference Riccardi and Reuter2024 pp. 348–349). Yet, they remain silent on a data source or operationalisation of these levels of corporate and banking transparency. It is this gap we propose to fill with our approach.

At the level of computer science, we build on Jensen and Iosifidis who argue that ‘banks face two principal data analysis problems in AML: (i) client risk profiling and (ii) suspicious behavior flagging’ (Jensen & Iosifidis Reference Jensen and Iosifidis2023 p. 8890). While our contribution lies in the second of those categories and more specifically at the transaction level, we argue that our model can be applied by both OE and LEAs. The data processing challenges faced by OE and LEAs are similar not least because the number of STRs continue to grow and for many countries surpass the mark of hundreds of thousands of STRs per year (Vedrenne 2023; Xue & Zhang Reference Xue and Zhang2016). The challenges encompass various dimensions, ranging from normative and legal (discrimination) to statistical challenges caused by data features of class imbalance and related challenges (Jensen & Iosifidis Reference Jensen and Iosifidis2023). Both need scalable systems with real time processing capabilities that ensure accuracy while keeping a high detection rate. Our approach can be combined with existing statistical inference methods for the detection of crime, with the potential to ultimately reduce the ratio of false positive alarms while increasing STR effectiveness for OE and LEA alike.

We respond directly to calls for integrating transaction monitoring into dynamic risk assessment (Lannoo & Parlour Reference Erken and Turksen2021 p. 25) and to calls for a model that can operate with parsimonious data input, as opposed to possibly more complex models which have tended to fail to deliver robust results either because of their lack of transparency or because relevant data inputs have not been available consistently enough across time and space (Hopkins & Shelton Reference Hopkins and Shelton2019 pp. 66–67). The proposed method exploits geographic and transaction volume data found in STRs to produce unambiguous and dynamic prioritisation for further investigations or reporting and equips the OE and LEAs with relevant knowledge to inform their decision-making processes on filing an STR or opening further investigations, respectively. Beyond the technical efficiency of this geographic risk approach, a key operational advantage is its capacity to inform compliance officers and supervisors on the underlying risks related to the regulatory framework in place where the parties to a transaction are established. By drawing on an open-source repository of verifiable legal data, relevant information can be made available to investigators as need arises, showing overall scores, broad risk categories, or specific legal analysis. Thus, even without detailed knowledge of the regulatory particularities in each jurisdiction, investigators and OEs should be able to assess geographic risks in any given case and understand the nature of underlying vulnerabilities.

From a behavioural perspective, the proposed methodology hinders strategic manipulation in two ways. First, neither criminals in the case of OEs, nor OEs in the case of LEAs, can anticipate the outcome of their reporting with a view to potentially structure their transactions or filing of STRs with the intention to remain below certain thresholds or alarm levels. As they do not have access to the pool of transactions or STRs in which they are transacting or filing, respectively, they cannot know for certain if a specific transaction would be prioritised as high risk in the dynamic data pool. Second, criminals could decide to transfer activities to jurisdictions with lower Secrecy Scores, yet this would prove self-defeating in the longer term because stronger regulations would greatly increase the risk of detection and prosecution of illicit activity.

In comparison to other risk assessment methods, our approach avoids bias at two different levels. First, the FSI methodology employs a uniform standard across countries to avoid political bias, unlike inconsistent approaches such as the EU Code of Conduct and FATF listings, which often overlook high-risk financial activities in geopolitical allies (e.g. the US and Luxembourg) while disproportionately targeting adversarial jurisdictions (e.g. Iran and North Korea), which are routinely blacklisted (FATF-GAFI 2003). Such biases, including documented discrimination against Global South countries (Dean & Waris Reference Dean and Waris2021), are heavily amplified when the output of risk assessments is a binary classification (high risk vs. low risk). The proposed approach assigns values from 0 (most transparent) to 100 (most secretive), enabling a more nuanced evaluation of secrecy risks (Janský et al. Reference El Mestari, Lenzini and Demirci2022). Second, the model’s orientation toward regulatory context, rather than sender or recipient personal characteristics, ensures that assessments remain non-discriminatory. Scoring systems often used by OEs and LEAs run the risk of embedding bias through profiling, potentially resulting in systemic discrimination (Sciurba Reference Sciurba2018).

Finally, the proposed geographic risk methodology can be considered forward-looking for different reasons. On the one hand, the evaluation of Secrecy Indicators using the ‘weakest link’ approach highlights loopholes available in jurisdictions even if these can be considered dormant, in the sense that there is no indication yet that they have been exploited by criminals. The capacity to account for potential (future) exploitation of regulatory loopholes provides a clear advantage over statistical methods that infer risks only on the basis of past criminal activity (see Lebid & Veits Reference Lebid and Veits2020). On the other hand, many FSI indicators have set early benchmarks that later influenced global standards. Indeed, while FATF recommendations are widely viewed as global AML standards, they emerge from slow-moving institutional consensus, often shaped by self-regulatory ideology and the disproportionate lobbying power of certain member states, raising concerns about neutrality, effectiveness, and the influence of geopolitical interests. The FSI’s ambitious benchmarks ensure that gaps are highlighted, even when media attention or policy priorities have not yet driven the establishment of stronger global regulations. For example, requiring beneficial owners of legal entities to be registered with a public authority – rather than with a private intermediary – has been an FSI standard since its inception in 2009 and only in recent years has been adopted in the EU and beyond (Ates et al. Reference Ates, Knobel, Lorenzo and Meinzer2025b).

The proposed model thus intends to complement existing systems equipping both LEAs and OEs with a dynamic risk-assessment methodology that may serve as a basis for further analysis or be used as a cross-checking tool to make sure no high-risk transaction or STR is disregarded. The following section explains in detail how our assessment works and how it is applied to a dataset of STRs.

3.3.1 Data

3.3.2 Methodology

We develop our risk assessment method on the basis that risk is a combination of the potential impact of an occurrence of financial crime, and the likelihood for that impact to materialise (Savona et al. Reference Savona, Riccardi, Shelton and Kleemans2017 pp. 26–28). Building on the FATF risk assessment framework (FATF 2013), we conceptualise risk as a combination of the probability or likelihood of financial crime (derived from underlying threats and vulnerabilities) with its potential impact (Savona et al. Reference Savona, Riccardi, Shelton and Kleemans2017). As for the likelihood of ML and other financial crimes to occur, we use aggregate data of secrecy features at the jurisdiction level that act as proxies of relative threats and/or vulnerabilities. The following example illustrates this conceptual framework.

Consider a corporate officer approving a transaction as a payment to a company supplier or service provider established in another jurisdiction. If such jurisdiction requires systematic registration, verification and online publication of the beneficial owners of legal entities established therein, the likelihood that the corporate officer is embezzling funds would be low, insofar as it is quite simple for anyone to check whether the corporate officer is a beneficial owner of the recipient company, and criminal activity would thus be easy to detect. If, however, the recipient jurisdiction does not require beneficial ownership (BO) registration, the likelihood that the individual embezzles funds is higher, given that the obfuscation of effective ownership and control can disguise the transaction as a legitimate payment to an independent third party (Cardao-Pito Reference Cardao-Pito2022). In the two situations, the potential impact of illicit activity would be the same transaction amount. Thus, ceteris paribus, combining the likelihood of illicit activity with its impact, the risk of the considered transaction will be higher in the latter situation. As we want to aim for a prioritisation of STRs, rather than for an estimate of expected damage, our numerical representations of risk are not meaningful in absolute terms. Rather, they are useful only insofar as they convey a relative understanding of risks among different occurrences.

Aligned with the two conceptual pillars, we combine two types of measures: (i) a quantitative measure of the economic value at stake in the assessed transaction(s), and (ii) a quantified measure of the opportunities for criminal activity offered by secrecy jurisdictions. Our approach produces a single and clearly defined risk score for each transaction on the basis of the widely established knowledge that IFFs follow weak regulations and secrecy, that is that large transactions between jurisdictions where money can be easily hidden have the highest IFF risk (Aldama-Navarrete Reference Aldama-Navarrete2021; Boyer & Kempf Reference Davenport and Ronanki2020; Cobham et al. Reference Cobham, Janský and Meinzer2015; Houston et al. Reference Houston, Lin and Ma2012; Janský et al. Reference El Mestari, Lenzini and Demirci2022).

From a methodological perspective, optimal STR risk assessment should aim to integrate any relevant indicator and account for as many different types of risk as possible. However, the lack of relevant data across jurisdictions can make STRs difficult to compare on the basis of more complex frameworks. We claim that at a minimum, STR-based risk assessment should take into account the opportunities available in originator and recipient jurisdictions to hide or obfuscate the true nature of underlying economic activity. The present approach minimises STR data preconditions (amount, origin, destination), to then fully develop secrecy risks on the basis of jurisdictions’ regulatory features.

3.3.3 Risk Assessment Model

Based on the determinations outlined above, we start with the following conceptualisation: Risk=Likelihood x Impact

Where:

• Likelihood is a function of threats and vulnerabilities, based on the opportunities of regulatory arbitrage allowed by financial secrecy.

• Impact is a function of the transaction volume recorded for an STR.

The next relevant definitions for our model concern these two functions, that is, the exact specification of Likelihood (Threat & Vulnerabilities) and Impact (transaction volume). We base these definitions on two considerations. First, we do not aim for an actual quantification of the expected damage, but only for an estimate that allows us to prioritise, that is, rank STRs according to the risk inherent in the reported transactions. Therefore, while the relative Likelihood and Impact of an STR should be commensurate across STRs, the resulting risk value does not need to have an economic interpretation. Second, the scaling of Likelihood and Impact needs to be such that both concepts contribute adequately to the overall risk score, without one of them entirely determining an STR’s risk ranking. In this sense, transaction data is known to be highly right-skewed, with the vast majority of transactions being of relatively low value, and only a few transactions take very high values.

As shown in Figure 3.1, this skewing is apparent in the STRs from the FinCEN files. A simple product of our measures of Likelihood and Impact would thus assign disproportional weight to large transactions, rendering the secrecy information irrelevant. To adjust for this pattern, we cube our likelihood measure and take the cube root of the transaction volume. This aggregation form has been reviewed by a study of the European Commission’s Joint Research Center (JRC) (Becker & Saisana Reference Datta, Whitmore and Nwankpa2018). A useful alternative to the cube root function applied to transaction volumes is the logarithm function. For the model presented below, using the suggested cube root or the logarithm of transaction volume does not change the risk assessment of top-ranked transactions.

Figure 3.1

Distribution of transaction volumes in the FinCEN leaks dataset.

$\mathit{R}\mathit{i}\mathit{s}\mathit{k}={\left(\frac{\mathit{S}{\mathit{S}}_{\mathit{A}}+\mathit{S}{\mathit{S}}_{\mathit{B}}}{2}\right)}^3\times \sqrt[3]{\mathit{t}\mathit{r}\mathit{a}\mathit{n}\mathit{s}\mathit{a}\mathit{c}\mathit{t}\mathit{i}\mathit{o}\mathit{n} \mathit{v}\mathit{o}\mathit{l}\mathit{u}\mathit{m}\mathit{e}}$

In order to assess the risk of a transaction from jurisdiction A to jurisdiction B, we determine the likelihood of illicit activity on the basis of the average of Secrecy Scores for the two jurisdictions involved. That average is then transformed through the cube function to derive the likelihood of illicit activity.

In our dataset, most STRs contain multiple transactions. This can be explained by the fact that a pattern of transactions is considered suspicious, rather than a specific unique transaction, and the obliged entity submits an STR to the FIU which includes all transactions considered potentially tainted by illicit activity. In order to adjust our risk model to such situations, we calculate a weighted average of Secrecy Scores.

$\mathit{L}\mathit{i}\mathit{k}\mathit{e}\mathit{l}\mathit{i}\mathit{h}\mathit{o}\mathit{o}\mathit{d}={\left(\frac{{{\displaystyle \sum }}_{\mathit{i}}^{\mathit{n}}\left(\frac{\mathit{S}{\mathit{S}}_{\mathit{S}\mathit{e}\mathit{n}\mathit{d}\mathit{e}\mathit{r}\left(\mathit{i}\right)}+\mathit{S}{\mathit{S}}_{\mathit{R}\mathit{e}\mathit{c}\mathit{i}\mathit{p}\mathit{i}\mathit{e}\mathit{n}\mathit{t}\left(\mathit{i}\right)}}{2}\right)\times {\mathit{V}}_{\mathit{i}}}{{{\displaystyle \sum }}_{\mathit{i}}^{\mathit{n}}{\mathit{V}}_{\mathit{i}}}\right)}^3$

Where:

• $\mathit{n}$ is the total number of transactions included within a STR report

• $\mathit{i}$ designates sequentially each of the transactions in the STR report

• Vi corresponds to the transaction volume of the ${\mathit{i}}^{\mathit{t}\mathit{h}}$ transaction

• SS_Sender(i) reflects the Secrecy Score of the sender jurisdiction as applicable in the ${\mathit{i}}^{\mathit{t}\mathit{h}}$ transaction

• SS_Recipient(i) reflects the Secrecy Score of the recipient jurisdiction as applicable in the ${\mathit{i}}^{\mathit{t}\mathit{h}}$ transaction

Thus, we can formalise a given STR’s geographic risk with the following equation:

$Risk={\left(\frac{{{\displaystyle \sum }}_{\mathit{i}}^{\mathit{n}}\left(\frac{\mathit{S}{\mathit{S}}_{\mathit{S}\mathit{e}\mathit{n}\mathit{d}\mathit{e}\mathit{r}\left(\mathit{i}\right)}+\mathit{S}{\mathit{S}}_{\mathit{R}\mathit{e}\mathit{c}\mathit{i}\mathit{p}\mathit{i}\mathit{e}\mathit{n}\mathit{t}\left(\mathit{i}\right)}}{2}\right)\times {\mathit{V}}_{\mathit{i}}}{{{\displaystyle \sum }}_{\mathit{i}}^{\mathit{n}}{\mathit{V}}_{\mathit{i}}}\right)}^3\times \sqrt[3]{{\displaystyle \sum _{\mathit{i}}^{\mathit{n}}}{\mathit{V}}_{\mathit{i}}}$

In transactions where sender or receiver country information are missing, adjustments could be made to seamlessly include those in the model. For example, country-specific cash regulation scores could be used in case of cash deposits/withdrawals and for crypto-wallet senders and recipients, maximum secrecy could be assumed. This was not needed in the case of the FinCEN data because it lacks cash or cryptocurrency details.

3.3.4 Limitations

Despite the various advantages outlined above, the proposed geographic risk model is affected by several limitations.

First, some of the ML techniques relying on new and disruptive technologies can be effectively assessed with the proposed model of geographic risk assessment to the extent that they make use of front companies or bank accounts at some stage of the laundering process, such as ‘transaction laundering’ (Akartuna et al. Reference Cusack2023 p. 634). However, others prove more elusive to our approach since they lack a clearcut territorial ‘location’ for meaningful geographical risk attribution and necessitate further conceptual exploration and innovation for seamless integration into a baseline risk assessment model. For example, situations when a company established under the laws of country A has an account in country B, and carries on a transaction with such account, both jurisdictions would be relevant for risk assessment. Optimally, standardised STR data would identify both jurisdictions, and risk indicators would account for threats and vulnerabilities alternatively with respect to country A (e.g. ownership registration) or B (e.g. banking-related AML regulations).

Second, our approach does not claim that automated geographic risk assessment methods are sufficient to identify the riskiest transactions, nor that human analysis of the facts and circumstances of each STR is redundant. Instead, the proposed method is conceived as complementary with other risk-assessment methods, notably those that take into account transaction features in relation to relevant parties’ previous behaviour or expected behaviour in the context of transaction patterns across relevant economic sectors. There will always be an important for human agency in the design and evaluation of different risk-assessment outputs and techniques, and expert knowledge will continue to be particularly relevant in situations with potentially far-reaching legal consequences (Ogbeide et al. Reference Ogbeide, Thomson, Gonul, Pollock, Bhowmick and Bello2023 pp. 2–3).

Third, the proposed approach is focused on ML but may not accurately represent risks related to TF activities (Savona et al. Reference Savona, Riccardi, Shelton and Kleemans2017 pp. 26, 168). This is because in our model we approximate the harm or impact based on a quantitative monetary value, which does not capture the harm resulting from terrorist activities or other concrete predicate offences. Yet, in the realm of financial crimes, it is difficult or impossible to assess the underlying impact of a crime beyond the amount involved. Because all sorts of criminal actors use very similar financial secrecy tools, it can be very difficult to assess ‘ex-ante’ whether a given amount of funds results from relatively mild criminal activity (such as tax evasion) or from a particularly heinous type of crime (trafficking in human beings). Provided that standardised STR data can identify suspected predicate offences, FIUs may further develop risk-assessment models assigning different weights to transactions suspected of diverse predicate offences.

Finally, the effectiveness of the proposed method in identifying STRs that are relatively more useful in the investigation and prosecution of financial crimes could not be tested due to a lack of data on STR outcomes. The ultimate goal of any STR-based risk-assessment technique would be to single-out reports that are more likely to initiate a successful investigation or contribute to an existing one. This is what Europol refers as STR ‘conversion’: the fact that an STR filed by an obliged entity is further exploited by relevant authorities in the fight against financial crime (EUROPOL Reference Dixon and Birks2017 pp. 29–31). Without comprehensive analysis of large-scale STR datasets including the information on which reports have led to a criminal conviction, or have otherwise supported (ongoing) investigations, any risk analysis tool is arguably unable to demonstrate its effectiveness. Aiming to increase the historically low rate of STR conversion (EUROPOL Reference Dixon and Birks2017), international cooperation frameworks should ensure that conversion data is closely monitored in cross-border scenarios, and that comprehensive, anonymised, STR datasets are made available for academic research.