highriskcountries.eu

The EU list and the FATF lists: how they differ

The EU list of high-risk third countries is EU law that banks and other obliged entities in the EU must apply. The FATF black and grey lists are statements by an international standard-setter, which countries apply through their own rules. 26 countries are on the EU list today and 21 countries on the FATF lists; 17 are on both.

At a glance

EU high-risk third countriesFATF black listFATF grey list
Published byEuropean CommissionFinancial Action Task Force (FATF)Financial Action Task Force (FATF)
Legal formA delegated regulation, binding in every EU member stateA public statement; not law in itselfA public statement; not law in itself
What it asks forEnhanced due diligence by obliged entities in the EUEnhanced due diligence and, in the most serious cases, countermeasuresNo enhanced due diligence; take the listing into account in risk analysis
How it changesBy a Commission regulation amending the listA new statement after each FATF plenary, three times a yearA new statement after each FATF plenary, three times a year
Countries today26 countries3 countries18 countries
Current listDelegated Regulation (EU) 2016/1675, as last amended by 2026/83FATF statement, October 2026FATF statement, October 2026

Who publishes them

The EU list is drawn up by the European Commission under Article 9 of Directive (EU) 2015/849, the EU anti-money laundering directive. It is set out in Delegated Regulation (EU) 2016/1675 and the acts that amend it. When it assesses a country, the Commission takes into account the evaluations and reports of international standard-setters such as the FATF.

The FATF lists are published by the Financial Action Task Force, the intergovernmental body that sets the international standards against money laundering, terrorist financing and proliferation financing. There are two: high-risk jurisdictions subject to a call for action, often called the black list, and jurisdictions under increased monitoring, often called the grey list. They are on the FATF website.

What they require

The EU list is binding. A delegated regulation applies directly in every member state, and the directive requires banks and other obliged entities to apply enhanced due diligence to business relationships and transactions involving a country on the list (Article 18a of Directive (EU) 2015/849). The EU list is a single list: the same rules apply to every country on it.

The FATF lists are not law in themselves. For the black list, the FATF calls on all jurisdictions to apply enhanced due diligence and, in the most serious cases, countermeasures. For the grey list, it does not call for enhanced due diligence, but encourages its members to take the listing into account in their risk analysis. Each country decides how to apply this through its own laws and supervisory guidance.

How they change

The FATF reviews both of its lists at each plenary meeting, held three times a year, and publishes an updated statement for each list at the end of the meeting.

The EU list changes only when the Commission adopts a delegated regulation amending Delegated Regulation (EU) 2016/1675. The European Parliament and the Council can object within a scrutiny period, after which the amendment is published in the Official Journal and enters into force.

Because each list changes through its own procedure, they can differ for a time: a country the FATF adds or removes stays as it is on the EU list until an amending regulation takes effect.

Where the lists differ today

On the EU list and an FATF list (17 countries)

On the EU list only (9 countries)

On an FATF list only (4 countries)

Not being on these lists does not by itself mean a country is low risk; your own risk assessment still applies.

Sources

This page explains the lists and is not legal advice. Check the official sources before you rely on a listing.

Understanding the lists

Email alerts by Juralis

Get an email when the EU or FATF changes a list. Free, provided by Juralis.

One email per update, which may also include information about Juralis features. Confirmation first, unsubscribe any time. See the Juralis privacy policy.