bank wants to know if we do business with high risk sectors what falls under this

High risk is about the client, not just about the sector

The bank asks this question because client due diligence under the Money Laundering and Terrorist Financing Prevention Act is risk-based: the higher the risk, the deeper the investigation. "High-risk sector" is not a fixed list with SBI codes, but a sum of factors: the type of products or services, the countries traded with, payment flows and the complexity of the ownership structure. Sectors often considered to carry elevated risk include cash-intensive trade, precious metals and stones, real estate transactions, crypto services, weapons and dual-use goods, and trade with countries on a sanctions or high-risk country list. A company active in such a sector does not automatically fail — the bank merely asks to better substantiate why the risk is manageable.

In practice, you usually indicate whether you have products, services or counterparties that fall into such a category, and if so: what measures you yourself take to limit that risk. This is often followed by a question about the source of the company's assetsbecause sector and cash flow are connected in the bank's investigation. If you have none of the mentioned activities, then "no" is the factually correct answer here — not something to formulate cautiously around.

Where this follows from: the client due diligence under the Wwft

The obligation to ask this type of question derives from the client due diligence that the Money Laundering and Terrorist Financing Prevention Act imposes on banks: institutions must know the risks of their clients and where necessary conduct enhanced due diligence, which in practice translates into questionnaires about sector, products and counterparties. This investigation also affects the ownership structure; hence why questions about high-risk activities in practice often appear in the same questionnaire as the question who are the ultimate beneficial owners of the company. There is no statutory, exhaustive list of "risk sectors" — banks define this themselves based on their own risk policy, based on the Money Laundering and Terrorist Financing Prevention Act framework.