FATF high-risk countries & EU high-risk third countries

FATF Call for Action (“black list”) HIGH

Jurisdictions with serious strategic deficiencies to counter money laundering, terrorist financing and proliferation financing. The FATF calls on all members to apply enhanced due diligence, and in the most serious cases, counter-measures.

3 jurisdictions · data synchronised 2026-07-14

EU high-risk third countries (Regulation (EU) 2016/1675, as amended) HIGH — binding EDD

Third countries the European Commission has identified as having strategic AML/CFT deficiencies. Enhanced due diligence is mandatory for EU obliged entities.

25 jurisdictions · data synchronised 2026-07-14

FATF Increased Monitoring (“grey list”) MEDIUM

Jurisdictions actively working with the FATF to address strategic deficiencies within agreed timeframes. Listing is a geographic-risk factor an obliged entity's risk assessment must weigh.

22 jurisdictions · data synchronised 2026-07-14

EU list of non-cooperative tax jurisdictions (Annex I) TAX

Jurisdictions that failed to meet EU tax-good-governance criteria and did not commit to reform. EU defensive measures apply; commonly treated as a transparency red flag in AML risk scoring.

10 jurisdictions · data synchronised 2026-07-14

The four lists at a glance

How to apply these lists in a Cyprus / EU compliance file

Under the EU AML directives and Cyprus AML Law 188(I)/2007, geographic risk is one of the factors every business-wide and customer risk assessment must address, and CySEC, ICPAC and Bar Association guidance all expect the current FATF and EU listings to be reflected in it. In practice: record the client's and transaction's country connections (incorporation, residence, source of funds, counterparties); check each against these lists; where the EU high-risk list is touched, apply the Article 18a measures as a matter of law, not discretion; where FATF listings are touched, weigh them in the overall risk score and document the conclusion. Re-check on every periodic review — the lists change up to three times a year.

Frequently asked questions

What is the difference between the FATF black list and the grey list?

The black list (formally 'High-Risk Jurisdictions subject to a Call for Action', currently 3 jurisdictions) names countries with such serious deficiencies that the FATF calls on all members to apply enhanced due diligence and, in the worst cases, counter-measures. The grey list ('Jurisdictions under Increased Monitoring', currently 22) names countries that have committed to a remediation plan with the FATF; business with them is not prohibited, but the deficiency is a risk factor your assessment must weigh.

Is doing business with a grey-listed country prohibited?

No. A grey-list entry is not an embargo and not a sanctions designation. It is a geographic risk factor: your risk assessment should record the exposure, and depending on the overall risk picture you may need enhanced due diligence — but the relationship itself remains lawful.

Is the EU high-risk third-country list the same as the FATF lists?

No — they overlap heavily but are distinct instruments. The EU list (Regulation (EU) 2016/1675, as amended; currently 25 jurisdictions) is adopted by the European Commission and carries direct legal effect: for customers or transactions involving these countries, EU obliged entities must apply the specific enhanced due diligence measures of Article 18a AMLD — this is mandatory, not risk-weighted.

What enhanced due diligence does the EU list trigger?

Article 18a AMLD requires, at minimum: additional information on the customer and beneficial owner, on the intended nature of the relationship, on the source of funds and source of wealth, and on the reasons for the transactions; senior management approval for establishing or continuing the relationship; and enhanced monitoring throughout.

How often do these lists change?

The FATF updates its lists at each plenary — normally February, June and October. The European Commission amends Regulation (EU) 2016/1675 by delegated regulation several times a year, usually tracking FATF outcomes with a lag. This page is generated from FIRMCY's screening data and shows the verification date above.

Does a listing here mean the country is sanctioned?

No. These are AML/CFT deficiency lists, separate from sanctions regimes (UN, EU, OFAC, UK). A country can be grey-listed with no sanctions in force, and sanctioned persons exist in unlisted countries. For designations, see the daily sanctions list updates.

Screen against these lists automatically

Every FIRMCY screening includes a jurisdiction-risk check against the lists above — alongside sanctions, PEP and adverse-media screening — with the geographic findings written into the audit-ready report. New organisations get 100 free credits, no card required.