High-risk third countries

Checked against the official texts on 30 September 2026.

High-risk third countries are non-EU jurisdictions that the European Commission has identified, by delegated act, as having significant strategic deficiencies in their anti-money-laundering and counter-terrorist-financing regimes. Business relationships and transactions involving natural or legal persons from these countries require enhanced due diligence.

Also called: the EU AML high-risk country list. Related but different: the FATF's "black list" (high-risk jurisdictions subject to a call for action) and "grey list" (jurisdictions under increased monitoring).

Why it matters for PSPs and EMIs

A merchant registered in the EU can still be owned, managed or paid from a listed jurisdiction. The list changes several times a year, so a relationship that was standard risk at onboarding can require enhanced measures later without anything changing on the customer's side.

What the law says

Current list. Commission Delegated Regulation (EU) 2016/1675, as amended — for example by Delegated Regulations (EU) 2026/46 and (EU) 2026/83, both published on 9 January 2026. Always use the current consolidated version; this page deliberately does not reproduce the list.
Current law. Directive (EU) 2015/849, Art. 9 (identification) and Art. 18a (enhanced measures, added by Directive (EU) 2018/843).
Under the AMLR, three categories. Art. 29: significant strategic deficiencies ("high-risk third countries"), requiring the enhanced measures of Art. 34(4) and country-specific countermeasures (Art. 35). Art. 30: compliance weaknesses, requiring the specific enhanced measures named in the delegated act. Art. 31: countries posing a specific and serious threat to the Union's financial system.
Wider geographic risk. AMLR Annex III(3) lists further geographical risk factors, such as countries under FATF increased monitoring, with significant corruption, or subject to sanctions or embargoes. EBA Guidelines EBA/GL/2021/02 (definitions in paragraph 12) distinguish these "jurisdictions associated with higher ML/TF risk" from the Commission's high-risk third countries.
International standard. FATF Recommendation 19 (higher-risk countries).

How ProofVolt handles it

When the customer's country of registration, a country it declares it operates in, or a beneficial owner's country of residence or nationality is on the EU list of high-risk third countries, ProofVolt raises the case to high risk and enhanced due diligence, and approval then needs a second approver. This is a statutory floor: a firm's own risk settings in ProofVolt can raise it, but cannot remove or lower it. A listed country is treated as a reason for enhanced due diligence, not as a suspicion in itself, so it does not on its own hold back customer contact.

Sources

Informational only, not legal advice.