why do I need to disclose the countries where I conduct business

Countries of activity are part of customer due diligence

The bank asks this because it is required to assess your company for risks related to money laundering and terrorist financing. Countries are a fixed risk factor in this: conducting business in a country with elevated risk requires further assessment, conducting business in countries with low risk usually does not. This is separate from where your company is registered — the bank wants to know where the turnover, suppliers and customers actually are located, not just the registered address from the commercial register.

In practice, the bank usually asks this together with a few other standard components of customer due diligence: who are the ultimate beneficial owners of the company, and sometimes also where the company's assets come from. Countries of activity is not in itself a risk assessment that you yourself need to make — you are stating factually where you are active, and the bank draws its conclusions from that. If you do not have a fixed list of countries readily available, the turnover per country from the last annual accounts is usually the most practical starting point.

Where this follows from: customer due diligence under the Wwft

The bank's obligation follows from the Anti-Money Laundering and Terrorist Financing Act, which requires institutions to conduct due diligence on their clients before and during the business relationship. Country of activity is a standard component of the risk indicators, alongside, amongst others, the nature of the customer and the type of transactions. The Commercial Register Act 2007 only records the registered address and statutory information — these two are not the same, and a bank that asks beyond what the commercial register contains is therefore not acting outside its authority.