Germany’s Federal Financial Supervisory Authority (BaFin) published a new circular for all entities supervised under the German Money Laundering Act (GwG) that consolidates the European Union and Financial Action Task Force (FATF) jurisdiction lists for strategic AML/CFT and proliferation-financing deficiencies and sets out the resulting due diligence expectations. For the Democratic People’s Republic of Korea (North Korea) and Iran, any business relationship or transaction involving the country or a person resident there must, at a minimum, apply the enhanced due diligence measures in section 15(5) GwG, and firms must continue to notify BaFin of North Korea- or Iran-related relationships and transactions under BaFin’s general order of 13 May 2020. For North Korea, the circular adds specific expectations around more stringent beneficial ownership identification, checks to prevent circumvention via correspondent banking relationships, group-wide application across foreign branches and subsidiaries and auditable documentation. BaFin also notes that it may take further measures, and that branches and subsidiaries of Iran-based financial institutions remain subject to enhanced supervision. For other high-risk third countries listed in Commission Delegated Regulation (EU) 2016/1675, the same enhanced due diligence baseline applies, with a specific reminder to take Afghanistan’s current situation into account, while Myanmar-related measures should be calibrated to the FATF’s call for enhanced due diligence without disrupting legitimate humanitarian and remittance flows. The circular reproduces the FATF 13 February 2026 list of 22 jurisdictions under increased monitoring, namely Algeria, Angola, Bolivia, the British Virgin Islands, Bulgaria, the Democratic Republic of the Congo, Laos, Côte d’Ivoire, Haiti, Yemen, Cameroon, Kenya, Kuwait, Lebanon, Monaco, Namibia, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela and Vietnam, and clarifies that these do not create direct additional obligations unless also covered by the EU list but should be considered in country risk assessments. It also notes that the Russian Federation is on the EU high-risk list despite not being subject to a FATF call for action or increased monitoring, replaces BaFin’s previous circulars on these lists, and refers firms to the Deutsche Bundesbank’s sanctions information and the National Risk Assessment’s cross-border threat findings.
BaFin 2026-03-30
Germany's Federal Financial Supervisory Authority updates EU and FATF high-risk country guidance and restates enhanced due diligence and reporting for North Korea and Iran
The Federal Financial Supervisory Authority (BaFin) has issued a new circular for all entities subject to the German Money Laundering Act, consolidating EU and Financial Action Task Force jurisdiction lists for strategic AML/CFT and proliferation-financing deficiencies and setting out due diligence expectations. The circular mandates enhanced due diligence and continued notifications to BaFin for relationships and transactions involving the Democratic People’s Republic of Korea and Iran, specifies additional controls for North Korea, and confirms that other listed high-risk third countries and FATF “increased monitoring” jurisdictions must be factored into country risk assessments, without creating new obligations unless also on the EU list.