High risk third countries and AML

Since 30 June 2026, regulation 33(1)(b) of the Money Laundering Regulations 2017 requires enhanced due diligence for any client established in a FATF call for action country, or any transaction where a party is established in one: currently the Democratic People’s Republic of Korea, Iran and Myanmar. Regulation 33(3A) then sets six measures that must be applied, including source of funds and wealth information and senior management approval. Countries on the FATF grey list are no longer an automatic trigger but remain a geographical risk factor the firm must weigh.

Which countries count as high risk for this rule?

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) replaced the term “high risk third country” in regulation 33 with “FATF call for action country”. Regulation 33(3)(a) now defines this as a country named on the list of High Risk Jurisdictions subject to a Call for Action published by the Financial Action Task Force, as that list has effect from time to time. Before 30 June 2026 the mandatory trigger also covered the FATF list of Jurisdictions under Increased Monitoring, often called the grey list.

The list is not written into UK law, so it changes without new legislation. HM Treasury’s advisory notice explains that FATF updates its lists on the final day of each plenary meeting, held every February, June and October. HM Treasury’s June 2026 notice, following the FATF update of 19 June 2026, gave the call for action countries as:

• Democratic People’s Republic of Korea
• Iran
• Myanmar

The same notice listed 22 jurisdictions under increased monitoring, including Bulgaria, the British Virgin Islands, Kenya, Kuwait, Lebanon, Monaco, Syria, Venezuela and Vietnam. Because the October plenary can change both lists, a firm should check the current HM Treasury notice rather than rely on a copy held on file.

When is a client “established in” one of these countries?

Regulation 33(3)(c) gives the test:

• an individual is established in a country if resident there, but not merely because they were born there;
• a legal person is established where it is incorporated or has its principal place of business (for a financial or credit institution, where its principal regulator is).

The trigger has two limbs. It applies to any business relationship with a person established in a call for action country, and to any “relevant transaction” where either party to the transaction is established in one. Regulation 33(3)(b) defines a relevant transaction as one for which customer due diligence is required under regulation 27. So a transaction for which the firm must apply customer due diligence can fall within the rule because the other party is established in a call for action country, even where the client itself is UK based.

HMRC’s supervision guidance at ECSH33336 says supervisors will ask how a business knows which countries are listed, how often its list is updated and by whom, and how it identifies clients established in those countries.

What are the six mandatory measures?

Regulation 33(3A) says the enhanced due diligence for a regulation 33(1)(b) case must include:

1. additional information on the client and on the client’s beneficial owner;
2. additional information on the intended nature of the business relationship;
3. information on the source of funds and source of wealth of the client and of the beneficial owner;
4. information on the reasons for the transactions;
5. senior management approval for establishing or continuing the relationship;
6. enhanced monitoring, by increasing the number and timing of controls and selecting patterns of transactions that need further examination.

These are minimums, not options. In an accountancy practice “senior management” will usually be a partner or director other than the engagement owner, or the MLRO, and the approval should be signed and dated before work starts. Source of wealth information is needed for the beneficial owner as well as the client entity. The general approach to evidencing these steps is covered in enhanced due diligence for accountants.

HM Treasury’s notice says that within the constraints of regulation 33(3A) the intensity of each step, such as the level of detail and type of verification, should be proportionate to the risk, taking account of the specific shortcomings FATF identified and the typologies most relevant to the jurisdiction.

Does this apply to existing clients?

Yes. HM Treasury’s notice states that firms must carry out enhanced due diligence and enhanced ongoing monitoring on all customers, new and existing, established in high risk countries. It allows a risk based approach to existing clients, for example prioritising higher risk groups. When a country is added to the call for action list, existing clients connected with it need to be identified and brought up to the regulation 33(3A) standard; when a country is removed, the mandatory trigger falls away but the firm’s own risk rating may still justify enhanced measures.

Regulation 33(2) disapplies the trigger where the client is a branch or majority owned subsidiary of an entity established in a third country that is subject to and supervised for AML requirements equivalent to the UK’s, the branch or subsidiary fully complies with group policies, and the firm, applying a risk based approach, does not consider enhanced measures necessary. That exemption is narrow and needs to be documented.

What about grey list countries?

They have not stopped being risky. Regulation 33(6)(c) still requires firms to take account of geographical risk factors, including countries identified by credible sources such as FATF evaluations as lacking effective AML systems, countries with significant corruption or criminal activity, and countries subject to sanctions. Regulation 33(1)(g) requires enhanced measures in any other case that by its nature presents a higher risk.

HM Treasury’s notice says firms must continue to take FATF mutual evaluations into account as a geographical risk factor. ICAEW’s summary of the 2026 CCAB guidance says firms’ assessments of high risk jurisdictions are unlikely to change, and points them to the AASG Risk Outlook. In practice a client resident in a grey list country will usually still receive enhanced checks, but the firm chooses them according to the risk rather than having to apply all six listed measures. Country risk should feed into both the firm wide risk assessment and each client risk assessment.

Are there other consequences of a call for action link?

Two are easy to miss:

• Reliance. Regulation 39(4) prohibits relying on a third party established in a FATF call for action country to carry out customer due diligence, subject to a narrow group exception in regulation 39(5). See reliance on third parties.
• Sanctions. HM Treasury’s June 2026 notice notes that the Democratic People’s Republic of Korea, Iran and Myanmar, along with several grey list jurisdictions, were also subject to financial sanctions measures. Enhanced due diligence does not replace sanctions screening; see financial sanctions checks for accountants.

How might this look on a client file?

Illustration only. A practice is asked to prepare accounts and corporation tax returns for a UK trading company. Its sole shareholder and director has moved to Iran and is now resident there. The company itself is UK incorporated with its business in the UK, but the beneficial owner is resident in a call for action country.

• Strictly the client is established in the UK, so regulation 33(1)(b) may not apply to the relationship itself. The engagement partner rates it high risk under regulation 33(1)(g), because the beneficial owner controls the client from Iran, and decides to use the six regulation 33(3A) measures as the benchmark. That judgement is recorded.
• Additional identity evidence and an explanation of the move are obtained; the purpose of continuing the UK company is recorded.
• The director’s source of wealth (previous UK employment and the sale of a UK property) is evidenced with documents, and the source of the company’s funding is traced through bank statements.
• Sanctions screening is run on the director and the company before any work is done.
• The MLRO signs off continuing the relationship.
• Bank transactions are reviewed quarterly rather than annually, with payments to or from Iran flagged for review.

If the director refuses to explain the funding, the firm cannot complete the measures and must consider whether to stop acting and whether suspicion has arisen.

What are the common mistakes?

• Still applying the full mandatory regime to every grey list client, or dropping enhanced checks for them altogether, instead of a documented risk based decision.
• Using a country list saved months ago rather than the current FATF and HM Treasury position.
• Looking only at the client entity and missing beneficial owners or counterparties established in a listed country.
• Recording that “EDD was done” without evidence of each of the six measures, particularly senior management approval and source of wealth.
• Forgetting to revisit existing clients when the list changes; ongoing monitoring should pick this up.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

• Source of funds and source of wealth checks
• Customer due diligence for accountants (AML)
• Simplified due diligence: when it is allowed
• When client due diligence must be completed
• The CCAB AML guidance for the accountancy sector
• Proliferation financing risk assessment

Sources

• legislation.gov.uk: SI 2026/621
• legislation.gov.uk: SI 2017/692, regulation 33
• GOV.UK: Money laundering advisory notice high risk third countries 2
• GOV.UK: Manual page ECSH33336
• GOV.UK: Manual page ECSH31555
• ICAEW: 2026 ccab aml guidance for the accountancy sector
• legislation.gov.uk: SI 2017/692, regulation 39

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.