Published 7 October 2026

EU high-risk third countries: the list that counts, and its date

Once a client is established in a country on the Commission's list, enhanced due diligence stops being a judgement call. The hard part is reading the right list, in its latest version, without mixing it up with the FATF's lists or with the EU's list of non-cooperative tax jurisdictions.

This guide covers European Union law. What each Member State sets for itself (the authority that supervises you, the financial intelligence unit that receives your reports, how you file them) is set out country by country: Ireland, Malta and every other Member State.

High-risk third countries, in EU anti-money laundering law, are non-EU jurisdictions whose AML/CFT regimes have strategic deficiencies that pose significant threats to the Union's financial system. Directive (EU) 2015/849 tells the Commission to identify them (Article 9), and the Commission does so in Delegated Regulation (EU) 2016/1675, whose Annex carries the list.

How to read the Annex

The Annex has four sections. There is no point learning them by heart, since each delegated act moves countries in or out. What stays put is the logic behind them.

As far as your obligations go, the section makes no difference. Every country in the Annex is a "high-risk third country" (Article 1 of the Delegated Regulation), and that status is what brings Article 18a of the Directive into play. The section tells you why a country was listed; it does not create a separate regime.

Then there is the question of the version. The consolidated text on EUR-Lex is upfront about it: its own header calls it a documentation tool with no legal effect, and says that only the acts published in the Official Journal are authentic. It picks up an amendment only once that amendment is in force, which for the last two delegated regulations meant the twentieth day after publication (Article 2 of each). So before you rely on a consolidated version, check whether an amending act has been published since; the regulation's page on EUR-Lex lists them. The Commission's page on the topic gives, country by country, the date each listing took effect. That is the date to set against your file.

Two FATF lists, one EU list

The FATF does not make law for the EU. After each of its plenary meetings it publishes two documents, titled on its website "High-Risk Jurisdictions subject to a Call for Action" and "Jurisdictions under Increased Monitoring", which the FATF itself calls the black and grey lists. At the time of our review, the latest editions of both are dated 19 June 2026.

The Commission takes them into account: the Directive requires it to (Article 9(4)), and every delegated regulation says as much in its recitals. But its list is an EU act, adopted under its own procedure and on its own timetable. A country can therefore be on an FATF list before it reaches the Annex. A Member State, not being a third country, will never be in the Annex at all. And the Commission can list a country the FATF does not name, as section IV shows.

What enhanced due diligence requires today

Article 18a, added to the Directive in 2018, sets the baseline. For business relationships or transactions involving a high-risk third country, Member States must require obliged entities to:

• obtain additional information on the customer and on the beneficial owner or owners;
• obtain additional information on the intended nature of the business relationship;
• obtain information on the source of funds and source of wealth of the customer and of the beneficial owners;
• obtain information on the reasons for the intended or performed transactions;
• get senior management approval to establish or continue the business relationship;
• monitor the relationship more closely, with more controls at shorter intervals, picking out the transaction patterns that need a closer look.

A Member State may also require the first payment to go through an account in the customer's name with a credit institution whose due diligence standards are at least as robust. And it must require, where applicable, further mitigating measures, which can go as far as limiting business relationships with people and entities from those countries (Article 18a(2)).

Two things to keep in mind when reading it. A directive is addressed to Member States, so what actually binds you is the wording of the national law that transposes it, and that law may go further. And the text speaks of relationships "involving" a high-risk third country without spelling out which connections count. A customer established there is one. For a beneficial owner who lives there, or funds that come from there, look at how your supervisor reads the rule, and record in the file both the connection you identified and the measure you applied.

From 10 July 2027: three categories instead of one

On that day the AMLR, Regulation (EU) 2024/1624, starts to apply (Article 90), and Directive (EU) 2015/849 is repealed (Directive (EU) 2024/1640, Article 77). The Regulation no longer works with a single list. The Commission will identify three kinds of third country by delegated acts:

The recitals spell out the FATF connection: the first category answers to countries subject to an FATF call for action (recital 84), the second to those under increased monitoring (recital 85). The Regulation also makes FATF increased monitoring a geographical risk factor in its own right (Annex III, point 3(a)), and asks AMLA to issue guidelines on risks from outside the Union (Article 32).

One question is still open. Delegated Regulation (EU) 2016/1675 supplements the Directive that is being repealed, while the AMLR calls for new delegated acts (Articles 29 to 31). Which act carries the list on 10 July 2027 is something to check on EUR-Lex as that date gets closer.

The EU tax list is a different list

It often comes up in the same breath, and that is where files go wrong. The EU list of non-cooperative jurisdictions for tax purposes is set by the Council, in conclusions published in the C series of the Official Journal. Its latest version, at the time of our review, is Annex I to Council conclusions C/2026/1465, published on 6 March 2026; the two before it date from February and October 2025. Its criteria are about tax: exchange of information, harmful tax regimes, economic substance.

No article of Directive (EU) 2015/849 refers to it, and neither does the AMLR that replaces it on 10 July 2027. A country on the tax list does not, on that ground alone, call for the measures of Article 18a, and a high-risk third country may well be a cooperative partner on tax. The tax list can still inform your view of geographical risk: from 2027, the AMLR counts third countries that enable financial secrecy among its risk factors (Annex III, point 3(f)). It does not stand in for the Commission's list. National lists, tax-related or not, are a matter for each Member State's law and are read country by country.

In the file

1. Map the connections. Where the customer is established, where the beneficial owner lives, where the funds come from, where the transaction takes place.
2. Open the right version. The latest consolidated text on EUR-Lex, then any amending act published since.
3. Write down the reference and the date. "Delegated Regulation (EU) 2016/1675, consolidated version of 29 January 2026, checked on…": that line is what will show, later on, what you knew that day.
4. Apply and record the measures your national law draws from Article 18a, senior management approval included.
5. Check again after every update. A country added to the Annex changes the regime for existing relationships, not only for new ones.

Vigilae checks the country of the transaction and the customer's declared nationality against an indicative, dated reference list drawn from the consolidated Annex and the FATF statements, and flags the factor for you to confirm. Vigilae is AML compliance software: it prepares the due-diligence file, you decide, and you remain solely responsible for your reports. See how it works.

Informative article, current as of 7 October 2026, not constituting legal advice. The list referred to is the consolidated version read on EUR-Lex on the review date; it changes with every Commission delegated act. Check the version applicable on the date of your file, and what your national law adds to it.

Frequently asked questions