As someone one the receiving end of requirements to implement such algorithmic rules we were also powerless. Sure we can question it, get forwarded some random official government document and voila it gets put into a spec document.

Best we could do was make it configurable on a database so it could be changed and noted that to them "in case".

But at the end of the day, we essentially had a rule that said:

If birth country in (Afghanistan, Serbia, Russia, ...) then add +20 risk points for flagging.