BaFin circular on high-risk countries

On 14 April 2025, BaFin published Circular 07/2025 (GW), identifying third countries with strategic deficiencies in their systems for combating money laundering and terrorist financing — the so-called high-risk countries. The selection is based on Delegated Regulation (EU) 2016/1675 and the FATF grey and black lists, most recently updated during the FATF plenary session on 21 February 2025. As a result, the following key obligations apply to obliged entities:

Adoption of EU and FATF lists

BaFin generally adopts the classifications of the Delegated Regulation as well as those issued by the FATF as “High-Risk Jurisdictions subject to a Call for Action” (so-called black list) and “Jurisdictions under Increased Monitoring” (so-called grey list).

There have been no changes to the EU Delegated Regulation since the last BaFin circular. The list of all countries classified as high-risk under the EU Delegated Regulation can be found here: Anti-money laundering and countering the financing of terrorism at international level

As part of the FATF plenary session on 21 February 2025, the Philippines were removed from the grey list. Newly added were the Lao People’s Democratic Republic and Nepal. BaFin has adopted these changes in its circular.

Enhanced due diligence obligations (§ 15 (5) GwG)

For all business relationships and transactions involving parties from a high-risk country listed in the EU Delegated Regulation or on the FATF black list, at least the enhanced due diligence obligations set out in § 15 (5) GwG must be applied. These include, among others, obtaining detailed information on the intended purpose of the business, the source of the funds and wealth, and on the beneficial owner.

North Korea and Iran: Specific countermeasures

Separate measures apply to North Korea and Iran that obliged entities must additionally fulfil.

North Korea: Obliged entities must carry out the identification of the beneficial owner pursuant to § 11 (4) in conjunction with § 12 (1) GwG with particular care. German credit institutions are required to examine whether their correspondent banks in third countries hold accounts for North Korean companies or individuals and whether comparable enhanced due diligence obligations apply there. All additional checks must be documented in an audit-proof manner. In addition, all business relationships and transactions with North Korea are subject to a reporting obligation under BaFin’s general ruling of 13 May 2020.

Iran: Here too, enhanced due diligence obligations under § 15 (5) GwG apply. Business relationships and transactions involving Iran must also be reported to BaFin in accordance with the general ruling of 13 May 2020. Moreover, branches and subsidiaries of Iranian financial institutions are subject to enhanced supervision.

Other third countries

For all other countries listed as high-risk in the EU Delegated Regulation, the same enhanced due diligence obligations under § 15 (5) GwG apply. In the case of Afghanistan, the current political situation must be appropriately considered. With regard to Myanmar, it must be ensured that in the course of applying enhanced due diligence obligations, financial flows for humanitarian aid or legitimate charitable activities are not interrupted.

Countries under FATF "Increased Monitoring"

Countries that are only on the FATF grey list and not in the EU Delegated Regulation do not result in any immediate additional obligations for obliged entities. However, their situation must be appropriately taken into account as part of the general country risk assessment.

With Circular 07/2025 (GW), BaFin clarifies how obliged entities must systematically deal with high-risk countries – from the application of due diligence obligations to documentation and reporting duties. A full version of the circular and further guidance is available on the BaFin website.

Here you can find BaFin Circular 07/2025 (GW) .