EU List of High-Risk Third Countries (March 2026)
The EU List of High-Risk Third Countries identifies non-EU jurisdictions that have strategic deficiencies in their anti-money laundering (AML), counter-terrorist financing (CFT), and proliferation-financing prevention regimes. These deficiencies may pose significant risks to the integrity of the EU and international financial system and therefore trigger enhanced due diligence obligations for obliged entities.
The list is based on:
- the EU Delegated Regulation (EU) 2016/1675, as amended;
- FATF statements on High-Risk Jurisdictions subject to a Call for Action;
- FATF “Jurisdictions under Increased Monitoring”;
- national supervisory implementation, including BaFin Circular 03/2026 (GW).
Latest Update: March 2026
On 30 March 2026, BaFin published Circular 03/2026 (GW) on high-risk states. The circular reflects the current EU and FATF country-risk framework and replaces BaFin’s previous circulars on EU and FATF country lists.
The circular is particularly important because it confirms the distinction between:
- countries legally listed in the EU Delegated Regulation, which trigger mandatory EDD under German AML law; and
- countries appearing only on the FATF grey list, which must be considered in the risk assessment but do not automatically trigger additional legal obligations.
EU High-Risk Third Countries
The EU high-risk list continues to be governed by Delegated Regulation (EU) 2016/1675, as amended. The regulation identifies third-country jurisdictions with strategic AML/CFT deficiencies that pose significant threats to the EU financial system.
Following the December 2025 amendments, the EU list includes the additional jurisdictions:
- Russia
- Bolivia
- British Virgin Islands
Russia is especially relevant because it is not listed by FATF as a grey-list or call-for-action country, but is included by the EU following an autonomous EU assessment.
FATF High-Risk Jurisdictions subject to a Call for Action
BaFin Circular 03/2026 (GW) refers to the FATF statement of 13 February 2026 concerning:
- Democratic People’s Republic of Korea (North Korea)
- Iran
- Myanmar
For North Korea and Iran, BaFin confirms that enhanced due diligence and additional countermeasures remain required. For Myanmar, enhanced due diligence must be applied in a manner proportionate to the risks, with attention to humanitarian and legitimate non-profit flows.
FATF Jurisdictions under Increased Monitoring
BaFin also refers to the FATF report of 13 February 2026, which lists the following jurisdictions under increased monitoring:
- Algeria
- Angola
- Bolivia
- British Virgin Islands
- Bulgaria
- Democratic Republic of the Congo
- Laos
- Côte d’Ivoire
- Haiti
- Yemen
- Cameroon
- Kenya
- Kuwait
- Lebanon
- Monaco
- Namibia
- Nepal
- Papua New Guinea
- South Sudan
- Syria
- Venezuela
- Vietnam
BaFin clarifies that where countries are mentioned only in the FATF increased-monitoring statement and are not included in the EU Delegated Regulation, there are no direct additional due diligence or organisational obligations. However, their situation must be appropriately considered in the institution’s country-risk assessment.
What Does Listing Mean for Financial Institutions?
Where a country is listed in the EU Delegated Regulation, obliged entities must apply enhanced due diligence under § 15 GwG, in particular where a business relationship or transaction involves a listed high-risk third country or a natural or legal person resident there.
Financial institutions should therefore:
- apply enhanced customer due diligence;
- obtain additional information on customer, beneficial owner, source of funds and purpose of the transaction;
- increase transaction monitoring;
- assess correspondent banking and indirect exposure risks;
- document EDD measures in an audit-proof manner;
- update country-risk matrices, KYC procedures and transaction-monitoring rules.
For countries appearing only on the FATF grey list, institutions should not treat the FATF listing as an automatic legal EDD trigger, but must reflect the risk appropriately in their internal risk assessment.
Legal Basis
The March 2026 country-risk framework is based on:
- Directive (EU) 2015/849;
- Delegated Regulation (EU) 2016/1675, as amended;
- German Anti-Money Laundering Act (GwG), especially § 15 GwG;
- BaFin Circular 03/2026 (GW);
- FATF statements of 13 February 2026.
Key Takeaway
BaFin Circular 03/2026 (GW) confirms that the legally decisive trigger for mandatory enhanced due diligence remains the EU high-risk third-country list, not the FATF grey list alone.
At the same time, the circular strengthens the practical relevance of FATF information for institutional risk assessments and confirms Russia’s special position as an EU-listed high-risk third country based on autonomous EU assessment logic.
Downloads
Sources:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R1675-20260129
www.bafin.de/SharedDocs/Veroeffentlichungen/DE/Rundschreiben/2026/rs_03_26_hochrisikostaaten_gw.html