Sample Assessments

The risk assessment of any FTZ will depend on the information available to the user, including their organisation’s own experience of operating in the FTZ in question. However, it is likely that at least part of the user’s assessment of any particular FTZ will involve analysis of open-source information. The examples below show how to do use suggested sources to conduct such analysis.

It is important that the risk assessment be done with its overall objective in mind, that is to facilitate a well-informed view of criminal risks related to an FTZ. Some degree of subjectivity is inevitable. Reasonable minds can differ on the reliability and accuracy of certain sources, and in case of doubt the user should use their judgment to decide how best to assess a particular risk factor.

As a first example, suppose you were interested in an FTZ in South Korea. To assess risk factors that form part of the ‘FTZ Risk Profile’, you could use the following reasoning:

Factor Assessment Reasoning


2: Medium risk.

South Korea’s score in the 2020 Corruption Perceptions Index is 61. Scores between 41-74 are defined as 2 (medium risk). Note that countries’ scores are different from their rank (the latter refers to how countries compare to each other based on their score).

Illicit trade levels

2: There are reports of widespread illicit trade in the FTZ concerned but their credibility is difficult to ascertain or there are credible reports of widespread illicit trade in the country concerned but not in the FTZ specifically.

Suggested sources include FATF Mutual Evaluation Reports (MERs) and the US State Department’s International Narcotics Control Strategy Reports (INCSRs). They include the following observations:

Korea is exposed to cross-border ML/TF risks from its large international trade flows and open, export-driven economy which could create an environment vulnerable to ML/TF activities, particularly via international transactions. (FATF MER 2020)

The Republic of Korea’s industrial capabilities and position as a global logistics hub make it attractive to criminals seeking to obtain and transship precursor chemicals. (INSCR 2020)

This suggests that there are at least ‘credible reports of widespread illicit trade in the country concerned’. A higher risk rating would be justified if such information were available specifically about the FTZ in question.

Sanctions evasion vulnerabilities

2: Is not a sanctioned country but is in geographic proximity to a sanctioned country or there are credible reports of widespread sanctions evasion through that country.

South Korea is in geographic proximity to DPRK, a sanctioned country.

Suppose you wanted to assess risk factors related to ‘Business Incentives in the FTZ’ in the Shanghai FTZ in China. You could use the following reasoning (please note that high-risk ratings for these risk factors do not necessarily mean that the FTZ’s overall risk profile will be high):

Factor Assessment Reasoning

Reduced customs scrutiny

2: Goods are either not scrutinised as effectively as elsewhere in the country or there is reputable criticism of the country’s customs capacity.

Suggested sources such as FATF MERs and the US State Department’s INCSRs do not contain information relevant to the FTZ. The following suggested source is the FTZ’s website, which may contain promotional materials that shed light on the state of customs controls in the FTZ.

This FTZ’s website advertises ‘ease of control’ compared to usual customs procedures, which suggests that goods may not be scrutinised as effectively as elsewhere in the country:

The special customs supervision areas in the zone are piloting a mode that allows ease of control on the first line, effective and efficient control on the second line and free trade within the zone.

Although this language may refer to incentives that do not impair the strengths of customs controls in the FTZ, erring on the side of caution and assigning the risk rating of 2 (medium risk) is appropriate.

Reduced taxation

2: Minor tax incentives.

No information on tax incentives is available in any of the suggested sources.

In this case, the user should run an internet search to identify other relevant sources. If any such sources are located, their credibility should be assessed.

For example, a publication by a well-regarded international auditing firm suggests that certain businesses operating in the FTZ benefit from a reduced corporate income tax rate (see here). This points to minor tax incentives being in place in this FTZ.

Whether tax incentive are minor or amount to ‘significant differences in taxation to the rest of the country territory’ is a matter for the user’s judgment.

Suppose you wanted to assess risk factors related to ‘Vulnerabilities’ of the Colon Free Zone in Panama.

Factor Assessment Reasoning

Manufacturing and processing activities

3:  Widespread manufacturing or processing of goods that are often counterfeited or high-value goods.

The FTZ’s website refers to the processing of a wide range of goods (see here). Furthermore, the 2018 GAFILAT review of Panama identifies this FTZ as both ‘the zone with the highest commercial activity of the country’ and ‘high risk in terms of [financial crime]’ (see here, p. 44, para. 150).

Transhipment activities

3: The FTZ is an international transhipment hub.

Colon is the largest transhipment port in Latin America according to the UN Economic Commission for Latin America and the Caribbean (see here).

Physical security

2: FTZ delineated and secured but there are credible reports of goods going in and out illegally.

GAFILAT’s 2018 report indicates that companies in the FTZ are exposed to risks of ‘the commission of crimes of smuggling, customs fraud and copyright crimes’ (see here, p. 83, para. 346).

Finally, suppose you wanted to assess risk factors related to ‘Mitigation Measures’ in the Adani Mundra Port FTZ in India.

Factor Assessment Reasoning

Independent monitoring

3: Such a process is not in place.

There is no information in any of the suggested sources indicating that independent monitoring of the FTZ administrator’s crime prevention and security efforts is in place.

An internet search reveals an Indian court judgment in a dispute concerning the FTZ administrator’s compliance with its environmental obligations, which further speaks to no independent oversight process being in place.

Due diligence on users

3: Users not subject to due diligence or one can sub-rent space in an FTZ without it.

No information on due diligence available in any of the suggested sources or through further open-source research. Default rating of 3 (high risk) is therefore applied.

Publication of law enforcement statistics

3: No enforcement statistics are published.

No enforcement statistics are available in any of the suggested sources of through further open-source research, which suggests they are not published.

AML/CTF regime [only relevant to financial institutions]

2: Medium risk, e.g. the host country is low risk but the FTZ has a discrete regime.

The 2010 FATF MER highlights multiple weaknesses in the country’s AML/CTF system. Open-source research identifies more recent analysis that suggests these weaknesses persist (e.g. here). There is no evidence of any particular mitigation measures being in place in the FTZ.

Beneficial ownership transparency

2: Beneficial ownership information is not publicly available but is verified and made available to competent authorities, including domestic and foreign law enforcement agencies.

The 2010 FATF MER highlights insufficient clarity about the definitions of beneficial ownership information. The 2013 FATF Follow-Up report suggests these deficiencies have been addressed, so that the rating of 2 (medium risk) is appropriate.