Money Laundering Advisory Notice: High Risk Third Countries (2024)

HM Treasury Advisory Notice: Money Laundering and Terrorist Financing Controls in High-Risk Third Countries

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) require the UK regulated sector to apply enhanced customer due diligence in relation to high-risk third countries (HRTCs).

Regulation 33(1)(b) of the MLRs requires regulated businesses (‘relevant persons’) to apply enhanced customer due diligence measures and enhanced ongoing monitoring in any business relationships with a person established in an HRTC or in relation to any relevant transaction where either of the parties to the transaction is established in an HRTC. A HRTC was previously defined for the purposes of the MLRs as a country specified in Schedule 3ZA to the MLRs. Government policy has been that this schedule should align with lists published by the Financial Action Task Force (FATF) of ‘Jurisdictions Under Increased Monitoring’ and ‘High-Risk Jurisdictions subject to a Call for Action’.

For these purposes, regulation 33(3) explains that:

• a relevant transaction means a transaction in relation to which the relevant person is required to apply customer due diligence measures under regulation 27

• being established in a country means:

  • in the case of a legal person, being incorporated in or having its principal place of business in that country, or, in the case of a financial institution or a credit institution, having its principal regulatory authority in that country

  • in the case of an individual, being resident in that country, but not merely having been born in that country

Money Laundering and Terrorist Financing (High-Risk Countries) (Amendment) Regulations 2024

This statutory instrument will come into force on 22 January 2024 and amend the definition of HRTC. It will remove Schedule 3ZA containing the list of HRTCs in the MLRs. Instead of referring to a separate schedule, Regulation 33(3)(a) will now define an HRTC as:

a country named on either of the following lists published by the Financial Action Task Force as they have effect from time to time—

(i) High-Risk Jurisdictions subject to a Call for Action;

(ii) Jurisdictions under Increased Monitoring

In order to keep abreast of which countries are HRTCs, relevant persons will now have to refer directly to lists published by the Financial Action Task Force (‘FATF’) of ‘Jurisdictions Under Increased Monitoring’ and ‘High-Risk Jurisdictions subject to a Call for Action’. These lists are updated three times a year, on the final day of each FATF Plenary meeting, held every February, June and October. The dates of these meetings are published several months in advance, in the events calendar on the FATF website. The FATF list of countries are updated and published in full on the FATF website.

HM Treasury will continue to publish advisory notices following each plenary meeting.

Applying Enhanced Due Diligence on new and existing customers established in high-risk third countries

Through this amendment, no additional or different countries come into scope of enhanced due diligence obligations, as the former Schedule 3ZA, which contained the UK list of HRTCs, mirrored the current FATF lists (see the below for current jurisdictions on these lists).

Regulation 33(1)(b) requires businesses to apply enhanced customer due diligence and enhanced ongoing monitoring in any business relationship with a person established in a high-risk third country or in relation to any relevant transaction where either of the parties to the transaction is established in a high-risk third country. This means that relevant persons are obliged to carry out enhanced customer due diligence and enhanced ongoing monitoring on all customers, new and existing, established in high-risk third countries.

While regulation 33(3A) of the MLRs is clear through sub-paragraphs (a)-(f) about what steps must be taken, relevant persons should consider the intensity with which they undertake these steps (i.e., the level of detail, the type of verification) in order to meet their obligations. Within the constraints of regulation 33(3A), relevant persons can take a risk-based approach when applying enhanced due diligence to existing customers. For example, by prioritising higher-risk customer groups, or considering the level of information gathered. The level of enhanced customer due diligence and enhanced ongoing monitoring undertaken should be proportionate to the level of risk attributed to the customer. This will differ between institutions, and between customers depending on other risk factors present. Relevant persons should consider factors such as the specific shortcomings mentioned by the FATF, and the risk typologies most relevant to the jurisdiction in question. Regulated persons should refer to their sector-specific guidance, approved by HM Treasury, for further advice on meeting their obligations under regulation 33.

Relevant persons should also consider which existing customers have already been subject to enhanced customer due diligence and enhanced ongoing monitoring as a result of increased geographical risk in line with regulation (33)(6)(c), when considering what further action needs to be taken in respect of those customers.

Group wide controls

Regulation 20(3) requires relevant persons to ensure third-country branches and subsidiaries in countries with weaker anti-money laundering (AML) requirements than the UK apply measures equivalent to those in the UK. Regulation 33(1)(b) and 20(3) taken together create a requirement for UK relevant persons to ensure any of their branches or subsidiaries based in countries listed by the FATF apply measures equivalent to the enhanced customer due diligence measures set out in regulation 33(3A) that the branch or subsidiary would be required to implement were they based in the UK.

When considering what measures are necessary to fulfil these obligations, firms should also consider where customers of branches or subsidiaries have already been subject to measures equivalent to enhanced due diligence in accordance with regulation 33(6)(c) as above.

FATF public statement

On 27 October 2023, the FATF published the most recent update to its lists of jurisdictions identified as having strategic deficiencies in their AML/counter-terrorist financing (CTF) regimes, of ‘Jurisdictions Under Increased Monitoring’ and ‘High-Risk Jurisdictions subject to a Call for Action’.

In response to the latest FATF statements, HM Treasury advises firms to consider at the time of publication, the following jurisdictions are considered ‘High-Risk Third Countries’ as defined by Regulation 33 of the MLRs:

• Barbados

• Bulgaria

• Burkina Faso

• Cameroon

• Croatia

• DPRK

• Democratic Republic of the Congo

• Gibraltar

• Haiti

• Iran

• Jamaica

• Mali

• Mozambique

• Myanmar

• Nigeria

• Philippines

• Senegal

• South Africa

• South Sudan

• Syria

• Tanzania

• Turkey

• Uganda

• United Arab Emirates

• Vietnam

• Yemen

The following jurisdictions are subject to financial sanctions measures at the time of publication of this notice, which require firms to take additional measures:

• DPRK

• Democratic Republic of the Congo

• Iran

• Mali

• Myanmar

• South Sudan

• Syria

• Yemen

Details on financial sanctions targets by regime can be found on GOV.UK.

Background Information

1. This advice replaces all previous advisory notices issued by HM Treasury on this subject.

2. The Financial Action Task Force is an inter-governmental body established by the G7 in 1989 and today includes as members 38 jurisdictions and two regional organisations (the European Commission and the Gulf Co-operation Council). It is the global standard setter and monitoring body for anti-money laundering and counter terrorist financing.

3. The government’s strategy is to use financial tools to deter crime and terrorism, detect it when it happens, and disrupt those responsible and hold them to account for their actions. The FATF is central to the UK’s international objectives within this strategy.

4. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 require firms to put in place policies and procedures in order to prevent activities related to money laundering and terrorist financing. Regulated businesses are also required to apply enhanced customer due diligence and enhanced ongoing monitoring on a risk-sensitive basis in certain defined situations and in any other case which by its nature can present a higher risk of money laundering or terrorist financing.

5. Other restrictive measures are applicable in the UK in respect of some of the jurisdictions listed in the content of this advisory notice.

6. Further information about what HM Treasury is doing to combat financial crime and how to subscribe to financial crime alerts.