Germany's Federal Financial Supervisory Authority (BaFin) issued updated guidance for all entities obliged under the German Money Laundering Act (GwG) on dealing with third countries with strategic deficiencies in anti-money laundering, counter-terrorist financing and proliferation financing controls. The circular consolidates the current European Union and Financial Action Task Force (FATF) country lists and sets out the resulting minimum enhanced due diligence expectations and BaFin supervisory measures. The update reflects the FATF’s 24 October 2025 statement on “High-Risk Jurisdictions subject to a Call for Action” covering the Democratic People’s Republic of Korea (North Korea), Iran and Myanmar, and the FATF’s “Jurisdictions under Increased Monitoring” report of the same date, which removed Burkina Faso, Mozambique, Nigeria and South Africa and listed 20 monitored jurisdictions (Algeria, Angola, Bolivia, British Virgin Islands, Bulgaria, Cameroon, Côte d’Ivoire, Democratic Republic of the Congo, Haiti, Kenya, Lao People’s Democratic Republic, Lebanon, Monaco, Namibia, Nepal, South Sudan, Syria, Venezuela, Vietnam and Yemen). For business relationships or transactions involving North Korea or Iran (or persons resident there) that fall within section 15(3) no. 2 GwG, BaFin requires at least the enhanced due diligence measures in section 15(5) GwG and points to its 13 May 2020 general administrative orders requiring notifications to BaFin of business relationships and transactions with a North Korea or Iran nexus. Additional measures are reiterated for North Korea, including heightened beneficial ownership identification standards, correspondent banking controls to detect indirect North Korea access via third-country banks, group-wide application to foreign branches and subsidiaries, and audit-ready documentation. For other high-risk third countries listed in the EU Delegated Regulation (EU) 2016/1675 (as amended), the same minimum enhanced due diligence baseline applies, with specific references to considering the situation in Afghanistan and, for Myanmar, applying enhanced measures in a way that does not interrupt humanitarian aid flows and legitimate non-profit activity. For jurisdictions that appear only on the FATF “increased monitoring” list and are not included in the EU high-risk third-country list, BaFin states there are no immediate additional due diligence or organisational obligations, but the relevant country-risk factors should be reflected in firms’ risk assessments. The circular replaces BaFin’s previous circulars on EU and FATF country lists and also points to sanctions information published by the Deutsche Bundesbank and to Annex 4 of Germany’s National Risk Assessment on cross-border threats.
BaFin 2025-12-01
Germany's Federal Financial Supervisory Authority updates AML high-risk country guidance and reiterates reporting duties for North Korea and Iran
Germany's Federal Financial Supervisory Authority (BaFin) updated guidance under the German Money Laundering Act, consolidating EU and FATF lists and detailing enhanced due diligence. The update reflects FATF's October 2025 statements on high-risk jurisdictions, including North Korea, Iran, and Myanmar, outlining specific measures for dealings with these countries. BaFin emphasizes heightened due diligence for North Korea and Iran and advises firms to incorporate country-risk factors from the FATF's "increased monitoring" list into their assessments.