bank asks about countries we trade with what is the risk of this for them

Country risk is part of customer due diligence, not of sanctions policy separately

The bank asks about trading countries because it is a mandatory part of customer due diligence under the Money Laundering and Terrorist Financing (Prevention) Act (Wwft). Countries are classified by risk: countries with weak anti-money laundering legislation, countries with elevated corruption, and countries on a sanctions or embargo list carry more weight. The bank is not concerned with your individual trading partners, but with the overall picture: the higher the share of high-risk countries in your turnover, the more extensive the customer due diligence the bank must perform — possibly with additional questions about the source of funds or counterparties.

This is closely linked to the question about sanctions lists, which you often encounter in the same questionnaire: see the company or one of its directors is on a sanctions list. Both questions serve the same purpose — the bank must be able to demonstrate that it knows with whom and where it does business, also under the customer due diligence that a bank is normally expected to perform in a business relationship. If you do not have a ready-made list of trading countries, the answer can often be inferred from your invoice or customs records; if this evidence is lacking, it is better to indicate this than to confirm an estimate as a definite yes.

Where this follows from: the client due diligence under the Wwft

The obligation to perform customer due diligence, including the assessment of country risk, follows from the Money Laundering and Terrorist Financing (Prevention) Act. This law obliges banks to adopt a risk-based approach: the higher the risk of a customer or transaction, the more thorough the investigation must be. Countries designated as high-risk by international organisations count as a risk factor in this. This is separate from the question about the source of funds, which you can find separately under what is the origin of the company's assets — both questions feed into the same risk profile, but are separate parts of the file the bank must build.