# High-risk third countries

**High-risk third countries are non-EU jurisdictions that the European Commission has identified, by delegated act, as having significant strategic deficiencies in their anti-money-laundering and counter-terrorist-financing regimes.** Business relationships and transactions involving natural or legal persons from these countries require enhanced due diligence.

*Also called:* the EU AML high-risk country list. Related but different: the FATF's "black list" (high-risk jurisdictions subject to a call for action) and "grey list" (jurisdictions under increased monitoring).

## Why it matters for PSPs and EMIs

A merchant registered in the EU can still be owned, managed or paid from a listed jurisdiction. The list changes several times a year, so a relationship that was standard risk at onboarding can require enhanced measures later without anything changing on the customer's side.

## What the law says

- **Current list.** Commission Delegated Regulation (EU) 2016/1675, as amended — for example by Delegated Regulations (EU) 2026/46 and (EU) 2026/83, both published on 9 January 2026. Always use the current consolidated version; this page deliberately does not reproduce the list.
- **Current law.** Directive (EU) 2015/849, Art. 9 (identification) and Art. 18a (enhanced measures, added by Directive (EU) 2018/843).
- **Under the AMLR, three categories.** Art. 29: significant strategic deficiencies ("high-risk third countries"), requiring the enhanced measures of Art. 34(4) and country-specific countermeasures (Art. 35). Art. 30: compliance weaknesses, requiring the specific enhanced measures named in the delegated act. Art. 31: countries posing a specific and serious threat to the Union's financial system.
- **Wider geographic risk.** AMLR Annex III(3) lists further geographical risk factors, such as countries under FATF increased monitoring, with significant corruption, or subject to sanctions or embargoes. EBA Guidelines EBA/GL/2021/02 (definitions in paragraph 12) distinguish these "jurisdictions associated with higher ML/TF risk" from the Commission's high-risk third countries.
- **International standard.** FATF Recommendation 19 (higher-risk countries).

## How ProofVolt handles it

When the customer's country of registration, a country it declares it operates in, or a beneficial owner's country of residence or nationality is on the EU list of high-risk third countries, ProofVolt raises the case to high risk and enhanced due diligence, and approval then needs a second approver. This is a statutory floor: a firm's own risk settings in ProofVolt can raise it, but cannot remove or lower it. A listed country is treated as a reason for enhanced due diligence, not as a suspicion in itself, so it does not on its own hold back customer contact.

## Related

- [Enhanced due diligence (EDD)](/glossary/enhanced-due-diligence/)
- [Risk-based approach](/glossary/risk-based-approach/)
- [Sanctions screening](/glossary/sanctions-screening/)

Canonical: https://proofvolt.eu/glossary/high-risk-third-countries/