BaFin circular on high-risk countries

On 14 April 2025, BaFin published Circular 07/2025 (GW), in which it identifies third countries with strategic deficiencies in the anti-money laundering and counter-terrorist financing system - so-called high-risk countries. The selection is based on the Delegated Regulation (EU) 2016/1675 and the FATF grey and black lists, last updated at the plenary meeting on 21 February 2025. This results in the following key obligations for obliged entities.

Adoption of EU and FATF lists

BaFin generally reflects the classifications of the Delegated Regulation and the FATF as "High-Risk Jurisdictions subject to a Call for Action" (so-called black list) and as "Jurisdictions under Increased Monitoring" (so-called grey list).

There have been no changes to the EU Delegated Regulation since the last BaFin circular. The overview of all countries that are considered high-risk countries under the EU Delegated Regulation can be found here: Anti-money laundering and countering the financing of terrorism at international level

The Philippines were removed from the grey list at the FATF plenary meeting on 21 February 2025. However, the Lao People's Democratic Republic and Nepal were newly added. BaFin has adopted these changes in its circular.

Enhanced due diligence obligations (Section 15 (5) GwG)

For all business relationships and transactions with parties from a high-risk country of the EU Delegated Regulation or the FATF blacklist, the enhanced due diligence obligations set out in Section 15 para. 5 AMLA must be applied as a minimum. This includes obtaining comprehensive information on the planned business purpose, the origin of the funds used and the assets (source of funds and source of wealth) and the beneficial owner.

North Korea and Iran: concrete countermeasures

With regard to North Korea and Iran, there are separate measures that obligated parties must also fulfil.

North Korea: Obligated parties must take particular care in identifying the beneficial owner in accordance with Section 11 (4) in conjunction with Section 12 (1) AMLA. German credit institutions are obliged to check their correspondent banks in third countries to see whether they hold accounts for North Korean companies or persons and whether comparable enhanced due diligence obligations apply there. All additional checks must be documented in an audit-proof manner. In addition, all business relationships and transactions with North Korea must be reported in accordance with BaFin's general ruling of 13 May 2020.

Iran: Increased due diligence obligations pursuant to Section 15 (5) GwG must also be applied here. Business relationships and transactions with Iran must also be reported to BaFin in accordance with the general ruling of 13 May 2020. In addition, branches and subsidiaries of Iranian financial institutions are subject to increased supervision.

Other third countries

The same enhanced due diligence obligations pursuant to Section 15 (5) AMLA apply to all other high-risk countries listed in the EU Delegated Regulation. In the case of Afghanistan, the current political situation in particular must be given due consideration. With regard to Myanmar, it should be ensured that the flow of funds for humanitarian aid or legitimate charitable activities is not interrupted during the application of the enhanced due diligence obligations.

Countries under FATF "Increased Monitoring"

Countries that are only on the FATF grey list and not on the EU Delegated Regulation do not entail any direct additional obligations for the obliged entities. However, their situation must be taken into account appropriately as part of the general country risk assessment.

With Circular 07/2025 (GW), BaFin clarifies how obliged entities must systematically treat high-risk countries - from the application of due diligence obligations to documentation and reporting obligations. The circular is available on the BaFin website for a complete description and further information.

Here you will find the Circular 07/2025 (GW) the BaFin.