Engaging in risk assessment

WHAT TO DO?

The NPO sector should be at the table when the government is determining whether the sector is at risk of being abused for terrorism financing.

Conduct your own shadow risk assessment if either your government has not conducted one or has carried it out without involving the sector.

Make the case for the revision or repeal of legislation in line with the risk assessment, the mitigating measures suggested and the existing self-regulation measures in place.

Make sure the ‘no outreach to NPOs’ = ‘poor rating on Recommendation 8’ message is driven home to the government. 

BEST PRACTICE

• South Africa: The NPO sectoral Risk Assessment was published in 2024. Using the Greenacre methodology, NPOs were part of the working technical group. The inherent risk of NPOs for TF risk was deemed to be medium. The residual risk was assessed, and recommendations made.   
• Kenya: The NPO sectoral Risk Assessment was conducted in two parts: the inherent Risk Assessment (2023) and a follow-on review of mitigating measures (2024) to determine the residual risk. The Risk Assessment Working Group included NPO, including Coalition partner MUHURI.  
• Peru: The NPO sectoral Risk Assessment was published in 2023, conducted in consort with Global NPO Coalition partners. 
• United Kingdom: The 2017 National Risk Assessment assessed the risk of abuse of nonprofits for terrorism financing as ‘low’ . It also flagged the issue and impact of bank derisking on charities. The earlier 2015 National Risk Assessment  had assessed NPO risk to terrorism financing as ‘medium’.
• Tunisia: State institutions (including the FIU, the General Directorate of Associations and Political Parties at the Presidency of the Government, the Anti-Terrorism Commission) and local NPOs collaborated effectively to update the risk assessment of the sector using a methodology provided by a Global Coalition member. The collaboration, and the work done on implementing Recommendation 8 in a way which protects civil society freedoms, has been much valued all round leading to Tunisia  being found Compliant with Recommendation 8 in 2019 – one of only six countries globally to be rated so. Just as importantly, a genuine partnership emerged between government and civil society on issues relating to possible TF risks in the NPO sector and measures to be implemented to mitigate these risks. The FATF has removed Tunisia from its ‘high-risk and other monitored jurisdictions’ list. Unfortunately, the political situation has changed rapidly in Tunisia in the past few years. There is now less space for civil society, and moves are afoot to amend the (excellent) association law. Another sectoral risk assessment is being planned, and it remains to be seen whether there will be the same level of engagement with civil society as there was in 2019, and whether Tunisia will retain its compliant rating going forward. 
• Nigeria: Nigeria published a National Risk Assessment for TF and ML (completed in 2016), which identified Designated Non-Financial Businesses and Institutions (DNFIs), of which NPOs are a subset, as being amongst those sectors most vulnerable to ML/TF. Spaces for Change, a Global NPO Coalition member, challenged (2019) this assessment of risk for the non-profit sector, disputing the official classification of NPOs as DNFIs and teasing out the nuances between vulnerability and threat, among other issues. The report led to increased and constructive engagement with the FIU (SCUML) and other government and NPO stakeholders, including GIABA, the FATF-Style Regional Body for West Africa. NPOs were then involved in the official Risk Assessment process conducted in 2023: for the main inherent risk findings see here. 
• Germany: NPO umbrella body, VENRO, initially conducted a shadow Risk Assessment of the sector ahead of Germany's Mutual Evaluation process in 2020. The government's official sectoral Risk Analysis later that year reflected and drew on VENRO's report. The risk analysis in the official report was differentiated and it did not find a high risk for the sector in general. The risk of misuse of an existing NPO for terrorist financing was rated as medium-low, while the use of a “sham” NPO created solely for the purpose of abuse rated “medium-high”, while stating explicitly that the number of such cases was very low to date. Mitigating measures by NPOs themselves were seen to be effective and important and the report drew on many of the recommendations made by the VENRO report.  

RESOURCES

• The ABCs for Risk Assessment of the Nonprofit Sector in Your Country: A Handout
• Presentation on experiences working with NPOs and Governments on the Risk Assessment Process, including persistent misunderstandings and issues. See here.
• Risk Assessment Scoping Paper: Read an appraisal here of how the risk-based  approach and the Mutual Evaluation form the cornerstone to validating the effectiveness of Recommendation 8.