Pull up your enterprise-wide risk assessment (EWRA). Money laundering: scored, scenario-mapped, board-approved. Terrorist financing: scored, NPO angle covered. Proliferation financing? A line item at best, or a copy-paste paragraph asserting the risk is low. For MLROs at VASPs and PSPs, that is now the weakest page of the document. Mauritius has completed its first PF National Risk Assessment, the FATF is publishing evidence of complex sanctions-evasion schemes, and the question your supervisor will ask ahead of the 2027 evaluation is brutally simple: where is proliferation financing in your EWRA methodology?
PF Is No Longer Optional in Your Risk Assessment
FATF Recommendation 1 does not stop at money laundering and terrorist financing: jurisdictions, and the firms they supervise, are expected to identify, assess and understand proliferation financing risk. The FATF’s 2021 Guidance on Proliferation Financing Risk Assessment and Mitigation extends that expectation to supervisors and self-regulatory bodies, and its report on complex PF schemes found that only 16% of assessed jurisdictions demonstrate high or substantial effectiveness on PF sanctions (Immediate Outcome 11). Mauritius has now scored its own exposure: the first PF NRA, noted by Cabinet on 25 September 2026, rates overall risk Medium, with dual-use procurement, TFS evasion and virtual assets among the named channels. The national benchmark exists. Your EWRA must answer to it.
The Three Gaps That Expose You
Between the national findings and your EWRA, three gaps do most of the damage. Each is visible from the outside, in your trade exposures, your screening logs and your monitoring rules, which is why they are where an evaluation starts.
Gap 1 — Dual-use goods with no lens on trade
The PF NRA names the sourcing and movement of dual-use items as a national threat channel. For PSPs and VASPs the exposure is indirect but real: a corporate client dealing in controlled categories, a payment trail to a trading company in a high-risk jurisdiction, invoices that never mention the end-user. Dual-use goods are legal, until the paperwork goes quiet. If your EWRA has no dual-use lens on customer activity, you cannot score the risk, let alone monitor it.
Gap 2 — TFS screening that has never faced the clock
In Mauritius, the National Sanctions Secretariat must publicise UN designations immediately, without delay and not later than 24 hours. Freezing without delay is the FATF standard, and 24 hours is the rhythm your operation should match from designation to frozen assets.
Ask yourself: when did screening last catch a real designation, and how long did the freeze take? If the answer involves manual list updates or a weekly batch job, your TFS 24h story will not survive an inspection.
Gap 3 — PF red flags that never reach your scenarios
Generic ML monitoring does not catch PF typologies: opaque end-user documentation, dual-use categories inside trade flows, ship-to-ship patterns, virtual-asset movements with no economic logic. The national assessment makes these channels explicit, your CDD triggers, monitoring scenarios and staff training should reflect them line by line.
What a PF-Ready EWRA Actually Contains
A credible PF section has five moving parts: a scoring of inherent PF risk across the six national channels (UN Security Council designations, ship-to-ship transfers, trade with high-risk jurisdictions, dual-use procurement, movement of persons from concern countries, virtual assets); customer and product segmentation showing where PF exposure concentrates; a mapping of controls to each channel, screening coverage, monitoring scenarios, due diligence triggers; residual risk and a risk appetite your Board has actually approved; and refresh triggers tied to new UN designations, NRA updates or regulatory change. Document the method, evidence the inputs, date everything. An EWRA that mentions PF only in the glossary will read, in a 2027 evaluation, exactly like what it is.
How CompFidus Makes It Practical
Our EWRA update service adds a complete PF risk section and controls review: channel-by-channel scoring aligned with the national findings, a TFS screening gap-check against the 24-hour discipline, and PF indicators ready for your monitoring rules and training packs. With 14 years at the Financial Services Commission, as former Head of Surveillance and Head of Global Business, our founder Sarika Subdhan knows how a supervisor reads a risk assessment, because she read them from the other side.
Get the PF-ready EWRA template, contact CompFidus Ltd and close the third risk before your supervisor opens it.
Sources of this article: