High-risk third country
A high-risk third country is a country outside the EU that the European Commission has listed for strategic weaknesses in its anti-money laundering and counter-terrorist financing regime. Banks, EMIs and other obliged entities must apply enhanced due diligence to business relationships and transactions involving these countries.
How a country gets on the list
The Commission adopts the list as a delegated regulation under the EU AML Directive. It updates the list mostly in line with the Financial Action Task Force, which publishes a "black list" (call for action) and a "grey list" (increased monitoring) after each plenary. The Commission can also list countries on its own assessment. From 10 July 2027 the power moves to Article 29 of the AML Regulation, with the same purpose.
The current EU list
The list below applies from 29 January 2026, under Delegated Regulations (EU) 2026/46 and 2026/83 amending Regulation 2016/1675.| Region | Countries |
|---|---|
| Africa | Algeria, Angola, Cameroon, Côte d'Ivoire, Democratic Republic of the Congo, Kenya, Namibia, South Sudan |
| Americas | Bolivia, British Virgin Islands, Haiti, Trinidad and Tobago, Venezuela |
| Asia and Pacific | Afghanistan, Laos, Myanmar, Nepal, North Korea, Vanuatu, Vietnam |
| Europe and Middle East | Iran, Lebanon, Monaco, Russia, Syria, Yemen |
Who has to apply the list
The European Commission adopted the list to protect the proper functioning of the internal market from countries whose anti-money laundering and counter-terrorist financing regimes pose significant threats to the EU financial system.The list binds every obliged entity under EU anti-money laundering rules: credit institutions, financial institutions such as e-money and payment institutions, crypto-asset service providers, and professionals such as accountants, auditors, notaries and estate agents.Enhanced due diligence applies in two situations:- a business relationship with a natural person or legal person established in a high-risk third country, for example a company registered there or one whose ultimate beneficial owner lives there
- a transaction involving a high-risk third country, such as a payment sent to or received from a counterparty established there
What enhanced due diligence means in practice
When a client, its beneficial owners or its payments involve a listed country, the provider has to apply enhanced due diligence, which goes further than standard KYB. Typically that means more information on the business and its owners, evidence of source of funds and source of wealth, the reason for the relationship or transaction, sign-off by senior management and closer transaction monitoring afterwards. Expect more questions and a longer review, not an automatic refusal.EU list vs FATF lists
The EU list follows FATF closely but isn't identical: timing differs, and the Commission sometimes adds countries FATF hasn't listed. Providers in the EU must apply the EU list. Many also screen against the FATF lists and their own jurisdiction risk ratings.The FATF black and grey lists
The Financial Action Task Force (FATF) is the global standard setter for measures to combat money laundering and terrorist financing. It was set up by the G7 in 1989 and assesses countries against its 40 Recommendations. After each plenary meeting, held in February, June and October, it publishes two lists in its FATF public statement:- High-risk jurisdictions subject to a call for action (the black list): countries with serious strategic deficiencies, where FATF asks members to apply enhanced due diligence and, in the most serious cases, countermeasures. In recent years this list has named North Korea (the Democratic People's Republic of Korea), Iran and Myanmar.
- Jurisdictions under increased monitoring (the grey list): countries that have committed to fix identified weaknesses within agreed timeframes and are working with FATF to do so.
High-risk third countries in the UK
The UK left the EU list behind after Brexit and keeps its own list in the Money Laundering Regulations 2017. Regulation 33 requires firms in the UK regulated sector to apply enhanced customer due diligence and enhanced ongoing monitoring to any business relationship with a person established in a high-risk third country, and to any relevant transaction where either party is established in one.The UK's high-risk countries are listed in a schedule to the regulations and follow the FATF lists, so the UK list changes after FATF plenary meetings. HM Treasury publishes an advisory notice after each plenary, and supervisors such as the FCA expect firms to update their risk assessments when it does. A UK business dealing with EU providers may therefore meet both lists, which overlap but aren't identical.What a listing means when you open a business account
If your company, its owners or its main counterparties are connected to a listed country, a provider has to do more work before it can open or keep your account. Regulated businesses use the lists to identify high-risk relationships and transactions involving high-risk countries, and then apply additional measures. You can speed that up by preparing:- an ownership chart down to every beneficial owner, with identity documents and proof of address
- evidence of source of funds and source of wealth for the owners
- contracts or invoices that explain the payments you expect to send to or receive from the listed country
- licences or registrations, if your business is regulated
FAQ
No. The list triggers extra checks, not a ban. Sanctions are a separate regime and can prohibit dealings outright.
Usually a few times a year, after FATF plenaries in February, June and October.
Monaco joined the FATF grey list in 2024 and the EU followed. Listing reflects AML framework weaknesses, not development level.
No. The UK keeps its own list in its money laundering regulations.
The black list names jurisdictions subject to a call for action because of serious deficiencies. The grey list names jurisdictions under increased monitoring that are working to fix weaknesses. Both lead to enhanced due diligence in the EU when the country is on the EU list.
Related terms and sources
Jurisdiction risk · Risk-based approach · Know your business · Source of funds · Debanking · Enhanced due diligence (EDD) · Browse the full glossary
Last reviewed October 29, 2026Disclaimer
This publication is provided for general information purposes and does not constitute legal, tax, or other professional advice from Narvi Payments Oy Ab or its affiliates, and it is not intended as a substitute for obtaining advice from a financial advisor or any other professional.
This publication is provided for general information purposes and does not constitute legal, tax, or other professional advice from Narvi Payments Oy Ab or its affiliates, and it is not intended as a substitute for obtaining advice from a financial advisor or any other professional.
What We Offer
IBAN Accounts For Your Business
Support & Compliance
Narvi Knowledge Center
Alternative Investment Funds [whitepaper]Family Offices [whitepaper]Shipping Industry [whitepaper]How to Open a Business Account in FinlandNarvi vs. Wise, Revolut, N26, and other alternativesNarvi vs. Stable.comNarvi vs. payabl.Narvi vs. ConnectPayNarvi vs. IBAN4UNarvi vs. GenomeNarvi vs. PaxumNarvi vs. BilderlingsNarvi vs. NetellerNarvi vs. KontistPayments BlogPayments Glossary
Narvi Payments Oy Ab is an Authorized Electronic Money Institution (EMI). Narvi’s EMI license is granted by the Finnish Financial Supervisory Authority (FIN FSA) with the registration number 3190214-6. Narvi’s license is passportised to all European Union countries.
Built and regulated in Finland© 2026 Narvi. All Rights Reserved.
v1.331.0