High-Risk Third Countries: FATF Lists and What Accountants Must Do

Some countries are treated as higher risk for money laundering and terrorist financing, and that changes how an accountancy practice must behave towards clients connected to them. This guide explains the two lists published by the Financial Action Task Force (FATF), what each one asks of firms, and how UK law has tied its own high-risk country definition to those lists. For the bigger picture of how FATF works, see our explainer on the FATF 40 Recommendations, the grey list and the black list.

Where this guide comes from

We used FATF's own publications dated 19 June 2026, the FATF statement "High-Risk Jurisdictions subject to a Call for Action" and "Jurisdictions under Increased Monitoring", and two UK statutory instruments on legislation.gov.uk. The lists change at each FATF plenary, so treat the names below as correct for 19 June 2026 and check FATF for any later update, including the one expected after its October 2026 meeting. This is general information, not legal advice.

List one: the call for action

FATF's June 2026 call for action names three jurisdictions, and it is informally known as the black list. For each, FATF asks members to do different things:

• Democratic People's Republic of Korea (DPRK): FATF calls on members to apply countermeasures, including ending correspondent relationships with DPRK banks, closing subsidiaries or branches of DPRK banks, and limiting business relationships and financial transactions with DPRK persons. It also encourages enhanced due diligence.
• Iran: FATF urges all jurisdictions to apply effective countermeasures. These include refusing subsidiaries, branches or representative offices of Iranian financial institutions and virtual asset service providers, limiting business relationships or transactions with Iran or persons there on a risk basis, and prohibiting new correspondent relationships with Iranian institutions.
• Myanmar: FATF calls for enhanced due diligence, not countermeasures, with increased monitoring of business relationships to detect unusual or suspicious activity. The statement warns that if no further progress is made by October 2026, FATF will consider countermeasures.

List two: increased monitoring

As of 19 June 2026, 22 jurisdictions are under increased monitoring, often called the grey list: Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Côte d'Ivoire, the Democratic Republic of the Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK) and Yemen. In that update FATF added Bosnia and Herzegovina and Iraq, and Algeria and Namibia were removed.

FATF says that being on this list means a country has committed to resolve its identified strategic deficiencies swiftly within agreed timeframes. Importantly, FATF does not call for enhanced due diligence on these jurisdictions. It asks members to factor the list into their risk analysis under a risk-based approach, and it says flows for humanitarian aid, legitimate non-profit activity and remittances should not be disrupted. Our guide to the Kuwait AML framework for accountants is one example of a country guide where this status matters.

How UK law uses the lists

The UK has changed its approach three times. The Money Laundering and Terrorist Financing (Amendment) (High-Risk Countries) Regulations 2021, made on 24 March 2021 and in force from 26 March 2021, replaced a definition that pointed to a European Commission regulation with a fixed Schedule 3ZA of 21 countries. A 2024 instrument, made on 22 January 2024 and in force from 23 January 2024, then replaced that fixed list. It amended regulation 33(3)(a) of the Money Laundering Regulations 2017 so that a high-risk third country was one named on either of FATF's two lists, "as they have effect from time to time", and it omitted Schedule 3ZA.

The 2026 change

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026, which came into force on 30 June 2026 according to ACCA and ICAEW, made 15 targeted changes. ACCA's September 2026 summary of the updated CCAB guidance for the accountancy sector says that, for the specific enhanced measures under the regulations, the relevant countries are now those FATF identifies as requiring a call for action. A notice from the Insolvency Practitioners Association describes the same narrowing of the enhanced due diligence duty in regulation 33, and says countries under increased monitoring remain a risk factor under regulation 33(6)(c). Both sources say firms should still consider the client's circumstances when assessing geographic risk.

In plain terms, our reading of those summaries is that the strongest, mandatory enhanced measures now attach to the call-for-action list (currently the DPRK, Iran and Myanmar), while the grey list feeds into your risk assessment instead. Because FATF updates the lists, the UK position still moves with them. A practice should re-screen client files after each plenary, which our guide to KYC and customer due diligence for accountancy practices explains in more general terms.

Practical steps (our suggestions)

• Record each client's and beneficial owner's countries of residence, incorporation and main activity in a form you can search.
• After each FATF plenary, filter your client list against both lists and note the date you did so.
• Decide in advance what extra checks you apply to a client linked to a listed country, and document why.
• Treat the two lists differently in your policy: the call for action is a much stronger signal than increased monitoring.
• Train staff to ask about foreign links at onboarding. Our CPD courses include financial crime topics.

What we could not confirm

We did not read the text of the 2026 amending regulations or the consolidated regulation 33, so our description of the 2026 change relies on ACCA's summary of the CCAB guidance and the Insolvency Practitioners Association notice, and we have not set out the exact enhanced measures. One government page we read described the 2026 aim as aligning the definition with both FATF lists, so the precise legal wording needs checking against the regulations. We also did not check the European Union's separate high-risk list, Ireland's equivalent rules or any other country's list. Confirm against the current legislation and your supervisor's guidance.

Frequently asked questions

Is the grey list the same as the high-risk list in UK law?

Not exactly. FATF itself does not ask for enhanced due diligence on grey-list countries, and, according to ACCA and the Insolvency Practitioners Association, the UK's 2026 changes focus the specific enhanced measures on the call-for-action list, with the grey list treated as a risk factor.

How often do the lists change?

FATF reviews them at its plenary meetings, which are held several times a year.

Which countries are on the call for action?

As of 19 June 2026: the DPRK, Iran and Myanmar.

Do I need to stop acting for clients linked to these countries?

Not automatically. The rules call for risk-based and, in some cases, enhanced measures, and for the DPRK and Iran FATF asks for countermeasures at national level. Take advice if a case arises.

Explore more country guides in our AML and KYC hub.