High-Risk Country Designations – What Has Changed?

The Financial Action Task Force (FATF) concluded its February 2026 plenary meeting with significant adjustments to its high-risk country designations, delivering important implications for law firms operating under the Money Laundering Regulations 2017.

Key Changes: Papua New Guinea and Kuwait Added

FATF has now added the following countries to the “Jurisdictions under Increased Monitoring” or “grey” list:-

• Papua New Guinea
• Kuwait

In terms of the FATF “Call for Action” or “black” list, FATF has updated its statement on Iran, but the list remains unchanged.

Countries under Increased Monitoring as at February 2026:

Algeria, Angola, Bolivia, Bulgaria, Cameroon, Cote d’Ivoire, DR of Congo, Haiti, Kenya, Kuwait, Laos, Lebanon, Monaco, Namibia, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, Virgin Islands (UK), Yemen.

Countries under Call to Action (black list) as at February 2026:

Iran, Myanmar, Democratic People’s Republic of Korea.

What Law Firms Need to Do

• Make all staff aware of the changes, including whether or not, in general, the Firm will act for clients connected with grey or black list countries.
• Advise fee earners that for matters treated as in scope by the Firm, where clients are connected to, originating from, or have funds originating from either of the newly added jurisdictions, they must review their risk assessment, escalate the matter to high risk and request authority from the MLRO to continue to act. Enhanced Due Diligence should be applied on affected clients and matters.
• Firms should maintain individualised risk assessments that consider all relevant factors.
• Firms should update their Firm Wide Risk Assessment to reflect the changes. If you are part of our Core Compliance Service at the Regulation and Compliance Office (RACO), we will update your Firm-Wide Risk Assessment in line with these changes.

Please note that you should not consider the FATF list in isolation when deciding whether or not a jurisdiction represents a high risk to your firm.  In particular, the SRA recently highlighted the importance of considering other factors, such as:

• whether the country is subject to sanctions, embargos or similar measures issued by, for example, the European Union or the United Nations
• whether the country provides funding or support for terrorism
• whether the country has been identified by credible sources as having high levels of corruption or poor AML controls.

Please ensure that you have considered the SRA Guidance on historic high risk countries and associated factors, which you can find here.

Regulatory Framework Under MLRs 2017

Regulation 33(1)(b) of the MLRs establishes clear obligations for all relevant persons when dealing with high-risk third countries (HRTCs). The regulation requires enhanced customer due diligence measures and enhanced ongoing monitoring for any customer relationship or transaction involving a person established in an HRTC. A person is considered “established” in a jurisdiction if they are incorporated there or conduct their principal place of business there (for legal entities) or are resident there (for individuals). This definition captures a broad range of business relationships that may trigger enhanced due diligence requirements.

However, firms should also consider whether the client originated from the country and therefore may still have connections there (and if so, whether this affects the risk assessment) and whether any funds have originated from an affected jurisdiction.

Compliance and Regulation Support

All firms must demonstrate and uphold high standards in their AML systems and processes, as well as in their management and supervision. This also involves outlining how the firm operates, including the conduct of staff in accordance with established policies, controls, and procedures.

At the Regulation & Compliance Office, we can offer a number of outsourced support solutions, including:

Client Due Diligence & Risk Assessment Service

We provide law firms with a seamless, outsourced solution for Client Due Diligence (CDD) and Risk Assessments. Our Due Diligence and Risk Assessment Service has been designed to enable law firms to focus on the provision of the legal services while we collate the necessary documentation for Due Diligence, Enhanced Due Diligence (where needed), and completion of the Client and Matter Risk Assessment, which must be completed on all matters in scope of the Money Laundering Regulations 2017. Find out more about this service: Due Diligence & Risk Assessment Service.

Contact our Compliance or Consultancy Team

To ask any questions about the Regulation and Compliance Office and how we can support your Law Firm, please call us on 0203 985 8550, complete the online enquiry form, or email us at info@regulationandcomplianceoffice.co.uk