ENAnti-money laundering · High-risk third countries
Three lists of countries. Only one is binding by law.
When a customer, a shareholder or a company in the chain has its registered office in a country at risk, the question is always the same: which list, and what does it entail. The FATF publishes two, the European Union one. They resemble each other, but they do not say the same thing, and they do not change on the same day. Below, the lists in force, the same ones the platform uses for the risk assessment, and what Italian law requires for each.
The lists in force
Who is on them today, list by list.
Each column says which act it comes from. When the FATF closes a plenary or the Commission publishes a regulation, we update the list, and with it the assessment of the documents produced from that day. Documents already delivered stay fixed to their date.
Unione europea · 26 countries
Paesi terzi ad alto rischio
Afghanistan, Algeria, Angola, Bolivia, Camerun, Corea del Nord, Costa d'Avorio, Haiti, Iran, Isole Vergini britanniche, Kenya, Laos, Libano, Monaco, Myanmar, Namibia, Nepal, Repubblica democratica del Congo, Russia, Siria, Sud Sudan, Trinidad e Tobago, Vanuatu, Venezuela, Vietnam, Yemen.
Source. Reg. delegato (UE) 2016/1675, mod. fino ai Reg. (UE) 2026/46 e 2026/83 (in vigore dal 29 gennaio 2026).
GAFI · 3 countries
Lista nera: call for action
Corea del Nord, Iran, Myanmar.
Source. GAFI — high-risk jurisdictions subject to a call for action, 19 giugno 2026.
GAFI · 22 countries
Lista grigia: increased monitoring
Angola, Bolivia, Bosnia-Erzegovina, Bulgaria, Camerun, Costa d'Avorio, Haiti, Iraq, Isole Vergini britanniche, Kenya, Kuwait, Laos, Libano, Monaco, Nepal, Papua Nuova Guinea, Repubblica democratica del Congo, Siria, Sud Sudan, Venezuela, Vietnam, Yemen.
Source. GAFI — jurisdictions under increased monitoring, 19 giugno 2026.
D.Lgs. 231/2007
What each list entails.
The difference matters in an inspection. The Union list triggers an obligation; the FATF ones weigh in the profile, and how much they weigh is decided by your procedure.
European Union · obligation
Enhanced verification
These are the “high-risk third countries” of article 1, paragraph 2, letter bb. With a relationship or transaction involving them, enhanced verification is always required (article 24, paragraph 5), with the measures of article 25, paragraph 4-bis: more information on the customer and the beneficial owner, on the origin of funds and on the purpose of the relationship, authorisation from senior management, closer ongoing monitoring.
FATF · black list
Countermeasures
The FATF asks member countries to apply enhanced verification and, in the most serious cases, countermeasures. These are the countries a financial intermediary keeps away from. As a rule they are also on the Union list.
FATF · grey list
Risk factor
Countries with deficiencies that have committed to correcting them. For Italian law they are a geographical risk factor (annex 2), not an automatic obligation. Many banks treat them like the Union list: that is legitimate, provided it is written in the procedure and applied to everyone in the same way.
On the platform
Where the lists enter the assessment.
- The country of the registered office or residence of the customer, of the shareholders, of the beneficial owners and of every company in the chain, including foreign ones, and the person's country of birth.
- A country on the Union list or on the black list raises the money laundering risk to high, and the reasoning says which country and which list.
- A country on the grey list alone weighs as an aggravating factor; a non-EU country that is on no list weighs less, but it weighs.
- A Union country that enters the grey list weighs as grey: belonging to the Union does not neutralise it.
- For the weights that your procedure assigns to each list, see the risk profile. Foreign groups are reconstructed by the page on beneficial owner.
Sources. FATF, “High-risk jurisdictions subject to a call for action” and “Jurisdictions under increased monitoring”, 19 June 2026 (fatf-gafi.org); Delegated Regulation (EU) 2016/1675 and its amendments, up to Delegated Regulations (EU) 2026/46 and 2026/83, in force from 29 January 2026 (European Commission, finance.ec.europa.eu); Legislative Decree no. 231 of 21 November 2007, articles 1, 24 and 25 and annex 2 (Normattiva). Checked on 21 October 2026. This page offers orientation; it does not replace the official texts or an opinion on your case.
Frequently asked questions
The questions we are asked on this topic.
What is the difference between the FATF grey list and the European Union list?
The FATF grey list names the countries that have strategic deficiencies in their anti-money laundering safeguards and have committed to correcting them within agreed timeframes; the black list names those against which the FATF calls for countermeasures. These are international indications, not rules. The Union list is a delegated regulation of the Commission (2016/1675, amended several times) and is directly applicable: D.Lgs. 231/2007 calls “high-risk third countries” exactly those (article 1, paragraph 2, letter bb). The two lists resemble each other because the Commission starts from those of the FATF, but they do not coincide and are not updated on the same day.
Does a customer linked to a country on the grey list always go into enhanced verification?
By law, no. Enhanced verification is mandatory when the relationship or transaction involves a high-risk third country on the Union list (article 24, paragraph 5, of D.Lgs. 231/2007), with the measures of article 25, paragraph 4-bis. A country on the FATF grey list alone is a risk factor to be weighed in the profile (annex 2), not an automatic obligation. Many internal procedures treat it more strictly, and that is a legitimate choice: it must be written down.
How often do the lists change?
The FATF reviews them at its three plenary meetings of the year, in February, June and October, and publishes its statements on the last day. The European Commission updates its own list with a delegated regulation, usually a few months after the FATF; it enters into force after scrutiny by the Parliament and the Council. Months can pass between the two, and in those months a country may have left one list and remain on the other.
How does Complify use the lists?
It compares them with the registered office and residence of the customer, of the shareholders, of the beneficial owners and of every company in the chain, and with the person's country of birth. A country on the black list or on the Union list raises the money laundering risk to high; one on the grey list alone weighs as an aggravating factor; a non-EU country that is on no list weighs little, but it weighs. The reasoning in the document says which country and which list. The lists are those published on this page, and are updated after every FATF plenary and every Commission regulation.
Complify Yourself!
Send us ten VAT numbers with shareholders or companies abroad: see which country weighs, on which list, and why.