Guidance

Money Laundering Advisory Notice: High Risk Third Countries

Updated 26 February 2024

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) require the UK regulated sector to apply enhanced customer due diligence in relation to high-risk third countries (HRTCs).

Regulation 33(1)(b) of the MLRs requires regulated businesses (‘relevant persons’) to apply enhanced customer due diligence measures and enhanced ongoing monitoring in any business relationships with a person established in an HRTC or in relation to any relevant transaction where either of the parties to the transaction is established in an HRTC. 

For these purposes, regulation 33(3) explains that:

• a relevant transaction means a transaction in relation to which the relevant person is required to apply customer due diligence measures under regulation 27;
• being established in a country means:
  • in the case of a legal person, being incorporated in or having its principal place of business in that country, or, in the case of a financial institution or a credit institution, having its principal regulatory authority in that country; and
  • in the case of an individual, being resident in that country, but not merely having been born in that country.

A HRTC is defined as:

a country named on either of the following lists published by the Financial Action Task Force as they have effect from time to time—

(i) High-Risk Jurisdictions subject to a Call for Action;

(ii) Jurisdictions under Increased Monitoring

In order to keep abreast of which countries are HRTCs, relevant persons have to refer directly to lists published by the Financial Action Task Force (FATF) of ‘Jurisdictions Under Increased Monitoring’ and ‘High-Risk Jurisdictions subject to a Call for Action’. These lists are updated three times a year, on the final day of each FATF Plenary meeting, held every February, June and October. The dates of these meetings are published several months in advance, in the events calendar on the FATF website. The FATF list of countries are updated and published in full on the FATF website. Please see below a copy of the current jurisdictions on these lists.

Applying Enhanced Due Diligence on new and existing customers established in high-risk third countries

Regulation 33(1)(b) requires businesses to apply enhanced customer due diligence and enhanced ongoing monitoring in any business relationship with a person established in a high-risk third country or in relation to any relevant transaction where either of the parties to the transaction is established in a high-risk third country. This means that relevant persons are obliged to carry out enhanced customer due diligence and enhanced ongoing monitoring on all customers, new and existing, established in high-risk third countries.

While regulation 33(3A) of the MLRs is clear through sub-paragraphs (a)-(f) about what steps must be taken, relevant persons should consider the intensity with which they undertake these steps (i.e., the level of detail, the type of verification) in order to meet their obligations. Within the constraints of regulation 33(3A), relevant persons can take a risk-based approach when applying enhanced due diligence to existing customers. For example, by prioritising higher-risk customer groups, or considering the level of information gathered.  The level of enhanced customer due diligence and enhanced ongoing monitoring undertaken should be proportionate to the level of risk attributed to the customer. This will differ between institutions, and between customers depending on other risk factors present. Relevant persons should consider factors such as the specific shortcomings mentioned by the FATF, and the risk typologies most relevant to the jurisdiction in question. Regulated persons should refer to their sector-specific guidance, approved by HM Treasury, for further advice on meeting their obligations under regulation 33.

Relevant persons should also consider which existing customers have already been subject to enhanced customer due diligence and enhanced ongoing monitoring as a result of increased geographical risk in line with regulation (33)(6)(c), when considering what further action needs to be taken in respect of those customers.

Group wide controls

Regulation 20(3) requires relevant persons to ensure third-country branches and subsidiaries in countries with weaker AML requirements than the UK apply measures equivalent to those in the UK. Regulation 33(1)(b) and 20(3) taken together create a requirement for UK relevant persons to ensure any of their branches or subsidiaries based in countries listed by the FATF apply measures equivalent to the enhanced customer due diligence measures set out in regulation 33(3A) that the branch or subsidiary would be required to implement were they based in the UK.

When considering what measures are necessary to fulfil these obligations, firms should also consider where customers of branches or subsidiaries have already been subject to measures equivalent to enhanced due diligence in accordance with regulation 33(6)(c) as above.

FATF public statement

On 23 February 2024, the FATF published the most recent update to its lists of jurisdictions identified as having strategic deficiencies in their AML/CTF regimes, of ‘Jurisdictions Under Increased Monitoring’ and ‘High-Risk Jurisdictions subject to a Call for Action’.

In response to the latest FATF statements, HM Treasury advises firms to consider at the time of publication the following jurisdictions are considered ‘High-Risk Third Countries’ as defined by Regulation 33 of the MLRs:

• Bulgaria
• Burkina Faso
• Cameroon
• Croatia
• DPRK
• Democratic Republic of the Congo
• Haiti
• Iran
• Jamaica
• Kenya
• Mali
• Mozambique
• Myanmar
• Namibia
• Nigeria
• Philippines
• Senegal
• South Africa
• South Sudan
• Syria
• Tanzania
• Turkey
• Vietnam
• Yemen

The following jurisdictions are subject to financial sanctions measures at the time of publication of this notice, which require firms to take additional measures:

• DPRK
• Democratic Republic of the Congo
• Iran
• Mali
• Myanmar
• South Sudan
• Syria
• Yemen

Details on financial sanctions targets by regime can be found on GOV.UK.

Background Information

1. This advice replaces all previous advisory notices issued by HM Treasury on this subject.

2. The Financial Action Task Force is an inter-governmental body established by the G7 in 1989 and today includes as members 38 jurisdictions and two regional organisations (the European Commission and the Gulf Co-operation Council). It is the global standard setter and monitoring body for anti-money laundering and counter terrorist financing).

3. The government’s strategy is to use financial tools to deter crime and terrorism, detect it when it happens, and disrupt those responsible and hold them to account for their actions. The FATF is central to the UK’s international objectives within this strategy.

4. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 require firms to put in place policies and procedures in order to prevent activities related to money laundering and terrorist financing. Regulated businesses are also required to apply enhanced customer due diligence and enhanced ongoing monitoring on a risk-sensitive basis in certain defined situations and in any other case which by its nature can present a higher risk of money laundering or terrorist financing.

5. Other restrictive measures are applicable in the UK in respect of some of the jurisdictions listed in the content of this advisory notice.

6. Further information about what HM Treasury is doing to combat financial crime and how to subscribe to financial crime alerts.