High-risk third country
Also called high-risk jurisdiction, FATF call for action country
A high-risk third country is a country outside the EU that the European Commission has designated as having strategic deficiencies in its anti-money laundering and counter-terrorist financing regime. Firms must apply enhanced due diligence to customers and transactions linked to it. The UK used the same term until June 2026, based on FATF lists.
How it works
In the EU, the Commission adopts a delegated regulation listing high-risk third countries and updates it as FATF publishes its own lists. When a customer, beneficial owner or counterparty is established in a listed country, banks and other obliged entities must apply set enhanced measures: more information on the customer and its owners, source of funds and wealth, the purpose of transactions, senior management approval and closer monitoring.
The UK left the EU list behind after Brexit. From 23 January 2024 it defined high-risk third countries as those on either FATF list: the call for action list and the increased monitoring list. From 30 June 2026 the mandatory enhanced due diligence trigger covers only FATF call for action countries. Exposure to other weak jurisdictions is assessed under the firm's risk-based approach and customer risk rating.
The rules
Requires enhanced due diligence for business relationships and transactions involving high-risk third countries identified under Article 9(2), including source of funds and wealth, senior management approval and enhanced monitoring.
Obliged entities, including banks, payment firms and crypto-asset service providersSets out the EU list of high-risk third countries. The Commission amends the annex to add and remove countries, usually following FATF list changes.
Obliged entities across the EUDirects the Commission to designate high-risk third countries by delegated act, and requires obliged entities to apply the enhanced due diligence measures in Article 34(4) to relationships and transactions involving persons from them.
Obliged entities, including banks, payment firms and crypto-asset service providersRequires enhanced due diligence for relationships with persons established in a FATF call for action country, and transactions with parties there. This replaced the high-risk third country test, which since 23 January 2024 covered both FATF lists.
UK relevant persons, including banks, payment firms and cryptoasset firmsCommon questions
Is a high-risk third country the same as the FATF grey list?
Not exactly. The EU list is the Commission's own designation, though it largely follows FATF's lists. The UK now ties its mandatory enhanced due diligence to the FATF call for action list, often called the black list, rather than the grey list.
Do firms have to stop dealing with high-risk third countries?
No. The rules require enhanced due diligence, not an exit. Regulators can add countermeasures, such as limits on business with a listed country, but blanket exits without a risk assessment are treated as de-risking.
What changes under the new EU AML Regulation?
From 10 July 2027 the AMLR replaces the directive rules. The Commission keeps designating high-risk third countries by delegated act, and adds lower categories for countries with compliance weaknesses or specific threats.
