High-risk third countries under AMLR Regulation (EU) 2024/1624 vs UK MLR2017
[Updated October 2026]
High-risk third countries comparisons for UK law firms with EU offices
The UK and EU increasingly require different approaches to country risk. The UK’s automatic country-based EDD requirement applies to FATF Call for Action countries, while Increased Monitoring status feeds into the wider risk assessment. The EU AMLR uses a tiered framework, requiring full EDD for countries designated as having significant strategic deficiencies and specified measures for those with compliance weaknesses.
The EU can also make additional designations and impose countermeasures. For cross-border firms, a country flag therefore needs to explain which requirements apply, rather than simply marking the country as high risk. Changes to a country’s classification can also affect existing clients, even where their circumstances have not changed.
Ref:
UK: Reg 33(1)–(3A), (5)–(7)
EU: Regulation (EU) 2024/1624, Articles 29–32, 34–35 and Annex III
UK MLRs
EU AMLR
Operational implication
Country classifications
Automatic country-based EDD follows FATF’s Call for Action list.
EU three-tier list: (a) significant strategic deficiencies; (b) compliance weaknesses; (c) specific serious threats - maintained by Commission Delegated Regulation.
Country-risk data will need to capture the classification, its reason and applicable requirements rather than a single high-risk yes/no flag.
FATF Call for Action
Automatically triggers EDD and enhanced ongoing monitoring.
Informs EU designations of countries with significant strategic deficiencies in their AML/CFT regimes, requiring the full EDD package.
Country rules will need separate UK and EU triggers, reflecting FATF status for UK cases and the applicable Commission designation for EU cases.
FATF Increased Monitoring
Does not automatically trigger EDD; informs the wider risk assessment.
Informs EU designations of countries with compliance weaknesses in their AML/CFT regimes, with EDD measures specified for those weaknesses.
EU workflows may need to translate identified weaknesses into specific evidence requests and review steps. UK workflows need to support the wider risk assessment.
Additional designations
Other country risks can trigger EDD through the firm’s assessment.
The Commission can separately designate countries posing a specific and serious threat.
Country-data providers and internal rules may need to support EU designations beyond FATF lists, with effective dates and classification history.
Country connection
EDD is required for business relationships with a person established in a FATF Call for Action country, or relevant transactions where either party is established there.
The applicable EDD measures must be applied to business relationships or occasional transactions involving natural or legal persons from an EU-designated country.
Collection fields may need to distinguish residence, incorporation, principal place of business and transaction-party connections so the relevant jurisdiction’s trigger can be assessed.
Required measures
Call for Action cases require additional client and UBO information, relationship details, SoF/SoW, transaction reasons, senior approval and enhanced monitoring.
Countries with significant strategic deficiencies require additional client and UBO information, relationship details, SoF/SoW, transaction explanations, senior approval, enhanced monitoring and a qualifying first payment. Countries with compliance weaknesses require the measures specified in the Commission’s designation.
Evidence requests, approval routes and monitoring requirements may need to vary by country classification rather than applying one EDD checklist to every flagged country.
First payment
No equivalent requirement in the mandatory country-based EDD package.
For countries designated as having significant strategic deficiencies, the first payment must come through an account in the customer’s name at a credit institution meeting sufficiently robust CDD standards.
Relevant EU workflows may need to capture the originating account and credit institution, with a check that the first payment meets the requirement.
Countermeasures
Reg 33 requires EDD; separate restrictions may also apply.
Can include additional checks, reporting and limits on relationships or transactions.
EU rules may need to trigger reporting or restrictions as well as additional evidence collection, with escalation where a proposed instruction is affected.
Group exceptions
Conditional exception for qualifying branches or majority-owned subsidiaries, including a risk-based assessment.
No automatic EDD for qualifying branches or subsidiaries of EU obliged entities complying with group controls.
Exception workflows may need jurisdiction-specific eligibility checks and evidence of group compliance, with the basis for the decision recorded.
Changes affecting existing clients
Changes to FATF Call for Action status can change mandatory EDD requirements; other country developments inform ongoing risk assessment.
Changes to Commission designations or prescribed measures can change the requirements for an existing relationship.
Systems may need to identify affected clients and trigger review when country rules change. Analysts also need a clear explanation for additional requests, showing that the country’s status has changed without implying that the client’s behaviour has.
Read more about UK MLRs vs EU AMLR
What should we consider before applying the EU’s country-risk requirements across all our offices, including the UK?
A common approach may simplify oversight, but it can also extend evidence requests, approvals and monitoring to UK cases where those measures are not automatically required. Consider where consistency would reduce complexity and where it would add work without addressing the particular risk. A shared client record can support different jurisdictional requirements without every office following an identical workflow.
Where might our existing EDD approach fall short of the EU’s country-specific requirements?
An existing checklist may collect substantial information without addressing the weakness behind a particular EU designation. The useful comparison is between the measures prescribed for that country and what your workflow actually collects, reviews and records. More evidence does not necessarily mean the relevant requirement has been met.
What are the less obvious operational consequences of UK and EU country-risk rules diverging?
The same country connection can produce different evidence requests across offices, leaving analysts and clients wondering why. Country-status changes can also affect existing relationships even when the client’s circumstances are unchanged. Teams need to distinguish the legal trigger from the firm’s own risk judgement and explain what prompted an additional request.
What would a country-risk system need to do well to support both regimes without creating more manual work?
It would need to turn country classifications into specific actions for the relevant office, rather than simply display a warning. That means retaining the reason for designation, applicable measures, effective dates and previous classifications, then connecting them to evidence requests, approvals and reviews. It should also help teams find affected existing relationships and see what evidence they already hold before requesting more.
Additional resources
Bar associations for common jurisdictions
Belgium
- Orde van Vlaamse Balies – witwaspreventie (Flemish bars)
- AVOCATS.BE – anti-blanchiment (French/German-speaking bars, OBFG).
Belgium has no single national bar, so both apply depending on the bar of registration.
France
Conseil National des Barreaux – LBC-FT,
Germany
Italy
Consiglio Nazionale Forense – Antiriciclaggio.
Luxembourg
Ordre des Avocats du Barreau de Luxembourg – LBC-FT.
Netherlands
Nederlandse Orde van Advocaten – Wwft.
Spain
Abogacía Española – Prevención del Blanqueo de Capitales (OPBA).
EU level
- AMLA: regulatory instruments – tracks every guideline and technical standard as it's finalise
- AMLA: draft regulatory technical standards (RTS)
- AMLA: public consultations – draft guidance open for comment
- EUR-Lex: Anti-Money Laundering Regulation (AMLR) – the regulation itself
- EUR-Lex: sixth Anti-Money Laundering Directive (AMLD6) – the directive Member States transpose
Cross-border legal profession
- CCBE: anti-money laundering – guidance written for lawyers specifically, bridging UK and EU frameworks