01
The list
26 jurisdictions
The Commission’s list names 26 jurisdictions. It last changed on 29 January 2026, when Russia, Bolivia and the British Virgin Islands were added and six countries were removed.
High-risk third countries list: what applies in Germany
The EU high-risk third countries list currently names 26 jurisdictions, and your German branch must apply enhanced due diligence whenever one of them is involved. The list comes from the European Commission and differs from the lists of the Financial Action Task Force (FATF).
Apply the EU list, not your group list. Whenever a listed country or a person resident there is involved, § 15 (3) no. 2 of the German Anti-Money Laundering Act (Geldwäschegesetz, GwG) requires enhanced due diligence, including senior management approval and enhanced monitoring. Check the entry-into-force date of every change.
- Legal position
- List of 29 January 2026
- Applies to
- German branches
- Reading time
- 16 minutes
- Last updated
- 30 October 2026
The essentials in four points
02
The duty
Enhanced due diligence
A relationship or transaction that involves a listed country, or a person resident there, triggers § 15 (3) no. 2 and (5) GwG: additional information, senior management approval and enhanced monitoring.
03
Moving parts
The FATF has moved on
The FATF changed its lists in June 2026, and its plenary met from 28 to 30 October 2026. As far as we could verify, the EU list has not yet followed.
04
From July 2027
A new legal basis
Under the EU Anti-Money Laundering Regulation (AMLR), the Commission names countries by delegated act under Article 29. Article 18 (6) AMLR also limits outsourcing to providers in listed countries.
Who does what: the EU, the FATF and German bodies
The list comes from Brussels, the duty is written in German law, and supervisors in Germany can add to it. This overview helps if your head office is outside Germany and the German structures are new to you.
European Commission
Identifies high-risk third countries by delegated regulation under Article 9 (2) of Directive (EU) 2015/849. The list sits in the Annex to Delegated Regulation (EU) 2016/1675, and § 15 (3) no. 2 GwG refers to it.
FATF
The Financial Action Task Force (FATF) is the international standard setter. Its lists are the baseline for the EU list, but the two are not identical.
BMF
The Federal Ministry of Finance (Bundesministerium der Finanzen, BMF) can set further enhanced due diligence duties for high-risk third countries by ordinance (§ 15 (10) GwG).
BaFin and other supervisors
BaFin (the German Federal Financial Supervisory Authority, Bundesanstalt für Finanzdienstleistungsaufsicht) supervises, among others, credit institutions, financial services institutions, and payment and e-money institutions (§ 50 no. 1 GwG). Supervisors can order additional measures under § 15 (5a) and (8) GwG.
FIU
The Financial Intelligence Unit (Zentralstelle für Finanztransaktionsuntersuchungen) receives suspicious activity reports. A supervisor can also order that certain financial transactions with high-risk third countries are reported to it (§ 15 (5a) no. 1 GwG).
The high-risk third countries list: all 26 jurisdictions
The list sits in the Annex to Delegated Regulation (EU) 2016/1675. The Commission’s page, last updated on 9 January 2026, names 26 jurisdictions. The table groups them by the date on which they entered the list. A consolidated version of the Regulation is available on EUR-Lex.
| In force since | Jurisdictions | Number |
|---|---|---|
| 23 September 2016 | Afghanistan, Democratic People’s Republic of Korea (DPRK), Iran, Syria, Vanuatu, Yemen | 6 |
| 6 March 2018 | Trinidad and Tobago | 1 |
| 1 October 2020 | Myanmar | 1 |
| 13 March 2022 | Haiti, South Sudan | 2 |
| 16 March 2023 | Democratic Republic of the Congo | 1 |
| 18 October 2023 | Cameroon, Vietnam | 2 |
| 5 August 2025 | Algeria, Angola, Côte d’Ivoire, Kenya, Laos, Lebanon, Monaco, Namibia, Nepal, Venezuela | 10 |
| 29 January 2026 | Bolivia, British Virgin Islands, Russian Federation | 3 |
Russia sits in a separate category (point IV of the Annex). It is not on the FATF lists, but its FATF membership is suspended, and the Commission found strategic deficiencies in its regime. As far as we could verify on 30 October 2026, no amendment after 29 January 2026 has been published.
Deadlines and milestones
Chips in red mark steps that are still ahead.
- 5 August 2025
Done. Delegated Regulation (EU) 2025/1184 takes effect. Ten countries are added and eight are removed.
- 29 January 2026
Done. Delegated Regulations (EU) 2026/46 and 2026/83 take effect. Russia, Bolivia and the British Virgin Islands are added, and Burkina Faso, Mali, Mozambique, Nigeria, South Africa and Tanzania are removed.
- June 2026
Done. The Financial Action Task Force removes Algeria and Namibia from its list of jurisdictions under increased monitoring and adds Bosnia and Herzegovina and Iraq.
- 28 to 30 October 2026
Open. The FATF plenary meets, and its outcomes are announced on 30 October 2026. We have not reviewed them. Check whether the Commission follows with a new act.
- 10 July 2027
Open. The AMLR applies. The Commission then names high-risk third countries by delegated act under Article 29.
What German law requires
§ 15 (3) no. 2 GwG treats a business relationship or a transaction as higher risk if a high-risk third country identified by the Commission, or a natural or legal person resident there, is involved. The test reaches transactions, not only customers.
§ 15 (5) GwG sets the minimum. You must obtain additional information on the customer and the beneficial owner, on the intended nature of the relationship, on the source of assets and wealth, on the reasons for the transaction and, where needed to assess terrorist financing, on the intended use of the assets (no. 1 (a) to (f)). The establishment or continuation of the relationship needs the approval of a member of senior management (no. 2). You must also monitor the relationship more closely, with more frequent and more intensive controls and selected transaction patterns (no. 3).
§ 15 (3) no. 2 GwG contains an exception for branches and majority-owned subsidiaries, located in a high-risk third country, of obliged entities established in the EU, provided they follow the group-wide policies and procedures in full. On our reading, it does not cover a German branch of a group headquartered outside the EU.
Supervisors can go further. § 15 (5a) GwG lets them order additional measures, for example the reporting of financial transactions to the FIU, the restriction or prohibition of relationships, or stricter audits. § 15 (8) GwG allows enhanced monitoring beyond the listed cases where evaluations or reports justify it, and § 15 (9) GwG refers to § 10 (9) GwG if you cannot meet the enhanced duties. § 15 (10) GwG lets the BMF set further duties by ordinance.
Duties by function in your German branch
Different people carry different parts of the work. The split below follows the functions that usually sit in a German branch or subsidiary.
Management of the German entity
Approves the establishment or continuation of each relationship that involves a listed country (§ 15 (5) no. 2 GwG) and owns the decision to refuse or end it if the enhanced duties cannot be met.
Compliance function
Keeps the country list current, reflects it in the risk analysis and defines the workflow. The Money Laundering Reporting Officer (MLRO) judges whether a suspicious activity report is needed.
Onboarding and know-your-customer (KYC) operations
Collect the additional information that § 15 (5) no. 1 GwG lists, including the source of assets and wealth of the customer and the beneficial owner.
Transaction monitoring and payments
Screen counterparties and payment countries, because § 15 (3) no. 2 GwG covers transactions as well as relationships, and run the enhanced monitoring.
Group functions in the UK, the US or elsewhere
May use a group list for group purposes, but the German entity must apply the Commission’s list. Differences between the lists need a documented decision.
What stays with your firm
Stays with you
- Senior management approval to establish or continue a relationship (§ 15 (5) no. 2 GwG)
- The decision to refuse or end a relationship if enhanced duties cannot be met (§ 15 (9) with § 10 (9) GwG)
- The suspicious activity report to the FIU (§ 43 (1) GwG)
- Decisions on a sanctions hold
- Approval of country-risk scenarios and thresholds
A provider can prepare and run
- Country and residence screening against the current list
- Collection and checking of the § 15 (5) no. 1 information
- Enhanced monitoring and alert handling under your scenarios
- List maintenance with entry-into-force dates
- Documentation and evidence for your supervisor
You hand over the task, not the control. MaRisk AT 9, the outsourcing module of the Minimum Requirements for Risk Management (MaRisk), expects an institution to remain able to steer and monitor what it outsources.
Typical weak points
These six points recur where a country list is maintained in several places. They do not replace a review of your own set-up.
A group list is used instead of the EU list
The screening tool carries the group’s own country list. § 15 (3) no. 2 GwG refers to the list that the Commission identifies.
§ 15 (3) no. 2 GwG
Changes are applied on the wrong date
The list changes on the entry-into-force date, which is the twentieth day after publication. The 29 January 2026 changes followed publication on 9 January 2026.
Delegated Regulation (EU) 2026/46, Article 2
Only customers are screened
Payment counterparties and transaction countries are not checked. The provision covers a relationship or a transaction in which a listed country or a resident person is involved.
§ 15 (3) no. 2 GwG
Residence and seat are not captured
The data holds nationality but not residence or registered seat. The provision speaks of natural or legal persons resident or established in the listed country.
§ 15 (3) no. 2 GwG
Existing relationships are not revisited
Approval is only given at onboarding. The enhanced duty covers the establishment and the continuation of a relationship.
§ 15 (5) no. 2 GwG
The FATF list is used as a proxy
The two lists differ: Russia is on the EU list only, and Algeria and Namibia left the FATF increased-monitoring list in June 2026 while the Commission’s page still lists them.
Delegated Regulation (EU) 2026/46
Quick check: where does your branch stand?
Select a status for each of the six questions. Nothing is stored or sent. The check is a self-assessment and does not replace legal advice.
No-regret measures
These six steps work whichever way the Commission and the FATF move next. They build the evidence that a supervisor asks for.
01
Build a country table
Keep one table with every listed country, its entry-into-force date and the source act. Use it as the single source for screening.
02
Capture residence and seat
Add residence and registered seat for customers, beneficial owners and counterparties, and use them in the screening rules.
03
Define the approval workflow
Name the senior management approvers, the evidence they see and the time limits for new and continued relationships.
04
Re-rate after each change
Run a dated re-rating of existing relationships after every Commission act and record the result.
05
Calibrate enhanced monitoring
Prepare scenarios and thresholds for relationships that involve listed countries. Your firm approves them.
06
Watch both lists
Check the Commission and the FATF each month and record your decision where the lists differ.
Conclusion: one list, dated and documented
Three key messages remain.
Use the EU list
The German duty follows the Commission’s list, not the group list and not the FATF list.
Duties follow involvement
A relationship or a transaction that involves a listed country or a resident person triggers enhanced due diligence, with senior management approval.
The legal basis will move
From July 2027 the Commission names countries under Article 29 AMLR. Keep your country table flexible.
The high-risk third countries list is a duty of detail. If you keep one dated country table based on the Commission’s list, capture residence and seat, document senior management approval and re-rate after every change, you can show a supervisor which list applied on which day and what you did about it.
Where this sits in the S+P service model
Compliance as a Service
Outsourced officer functions, including the Money Laundering Reporting Officer (MLRO) and Internal Audit, bundled in the S+P Compliance Package.
1st Line Services
Operational work, such as financial crime and customer operations, carried out under your instructions.
RegTech
Tools such as the S+P Compliance Cockpit that support both.
Officer functions and operational services are delivered separately, in organisation and in staffing.
Frequently asked questions
The answers reflect the position on 30 October 2026 and do not replace legal advice in an individual case.
Which countries are on the EU high-risk third countries list?+−
The Commission’s list names 26 jurisdictions. It last changed on 29 January 2026, when Russia, Bolivia and the British Virgin Islands were added. The table in this article shows every country with its entry-into-force date. As far as we could verify on 30 October 2026, no later amendment has been published.
Is the FATF grey list the same as the EU list?+−
No. The EU list takes the FATF lists as a baseline but is not identical. Russia is on the EU list only, in a separate category, because its FATF membership is suspended. In June 2026 the FATF removed Algeria and Namibia from increased monitoring, while the Commission’s page still lists both, and it added Bosnia and Herzegovina and Iraq, which are not on the EU list as far as we could verify. Use the Commission’s list for the German duty.
What must a German branch do when a listed country is involved?+−
§ 15 (5) GwG sets the minimum: additional information on the customer, the beneficial owner, the nature of the relationship, the source of assets and wealth and the reasons for the transaction, senior management approval to establish or continue the relationship, and enhanced monitoring. Supervisors can order more under § 15 (5a) GwG.
Does the rule apply to nationality or to residence?+−
§ 15 (3) no. 2 GwG speaks of a high-risk third country or a natural or legal person resident or established there that is involved in the relationship or transaction. The provision does not mention nationality. Check BaFin’s guidance for your sector before you rely on a narrower data set.
What changes from 10 July 2027?+−
The AMLR applies, and the Commission names high-risk third countries by delegated act under Article 29. Article 34 (4) lists the enhanced due diligence measures and Article 35 the countermeasures. As far as we could verify, no list under Article 29 has been published yet, so the list under Delegated Regulation (EU) 2016/1675 remains the reference for now. Article 18 (6) AMLR also limits outsourcing to providers in such countries.
What does S+P Compliance take over, and what stays with us?+−
S+P Compliance prepares and runs the operational work: country and residence screening, collection of the additional information, enhanced monitoring and documentation. Stays with you: senior management approval under § 15 (5) no. 2 GwG, the decision to refuse or end a relationship, the suspicious activity report to the FIU under § 43 GwG, decisions on a sanctions hold and the approval of scenarios and thresholds. You hand over the task, not the control.
Sources
Only official EU and German bodies are linked. Statements of the FATF are cited in the text but not linked.
European Commission: high-risk third countries. The current list with entry-into-force dates and the history of amendments. finance.ec.europa.eu
Delegated Regulation (EU) 2026/46. Adds Russia and creates the separate category for countries whose FATF membership is suspended. eur-lex.europa.eu
Delegated Regulation (EU) 2026/83. Adds Bolivia and the British Virgin Islands and removes six countries. eur-lex.europa.eu
Delegated Regulation (EU) 2025/1184. Adds ten countries and removes eight in 2025. eur-lex.europa.eu
Consolidated Delegated Regulation (EU) 2016/1675. The list as amended, valid from 29 January 2026. eur-lex.europa.eu
Regulation (EU) 2024/1624 (AMLR). Articles 18, 29, 34 and 35. Application from 10 July 2027 under Article 90. eur-lex.europa.eu
§ 15 Geldwäschegesetz (German). Enhanced due diligence for high-risk third countries (§ 15 (3) no. 2, (5), (5a), (8) to (10)). gesetze-im-internet.de
§ 50 Geldwäschegesetz (German). Competent supervisory authorities. gesetze-im-internet.de
Legal position on 30 October 2026. The list of high-risk third countries changes by delegated regulation. Check the Commission’s page and the consolidated text before you rely on it.
Related services and pages
Country risk touches several workstreams. These pages connect.
S+P KYC Service
KYC and due diligence operations carried out under your procedures, including enhanced information collection. Senior management approval and decisions on reports stay with your firm.
Outsourcing MLRO in Germany
The service view for firms that look for an external Money Laundering Reporting Officer for their German entity. Control, decision authority and final responsibility stay with your firm, and reports to the FIU under § 43 GwG are not handed over.
S+P Compliance Package
Outsourced officer functions for institutions in Germany, bundled in one agreement.
AMLR outsourcing Germany
What Article 18 AMLR changes for outsourcing, including the barrier for providers in high-risk third countries (Article 18 (6)).
Hochrisikoländer-Liste (German)
The German edition explains the list for institutions in Germany, with the national practice and the German wording.
