What the new UK Regulations and HMRC High-Risk Jurisdiction Guidance mean for art market participants

Since 30 June 2026, mandatory enhanced due diligence on geographic grounds has been triggered by only three countries: Iran, North Korea and Myanmar. Until that date, EDD was triggered by 25. If you read that as a relaxation, you have read it the wrong way round. The 20+ jurisdictions that came off the mandatory list did not become low risk. They became your judgement call, and a judgement call is the thing HMRC asks you to evidence.

What changed on 30 June 2026?

The trigger for mandatory enhanced due diligence (EDD) on country grounds narrowed from two Financial Action Task Force (FATF) lists to one.

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force on 30 June 2026. Among roughly fifteen changes, regulation 19 of that instrument rewrote regulation 33 of the Money Laundering Regulations 2017. Wherever regulation 33 said “high-risk third country”, it now says “FATF call for action country” (the black list), defined as a country named on the FATF list of High-Risk Jurisdictions subject to a Call for Action, as that list has effect from time to time.

That definition matters because of what it leaves out. Until 30 June, a high-risk third country meant a country on either the black list or what is known as the grey list (the increased monitoring list). HMRC sets out that history in its own supervision handbook. Both the black and grey lists previously mandated EDD. Now only the black list does.

This sits alongside the other change art market participants (AMPs) have been absorbing since the summer, the move of the customer due diligence trigger from 10,000 euros to £10,000. The two arrived in the same instrument on the same day, and the threshold change has had most of the attention. The EDD change is the one with more judgement in it.

Which countries now trigger mandatory enhanced due diligence?

Three: Iran, the Democratic People’s Republic of Korea (North Korea) and Myanmar. FATF confirmed all three in its call for action statement of 19 June 2026, and the October 2026 plenary left the list unchanged on 30 October.

Sanctions are a separate regime and a separate screen. A country appearing on neither FATF list can still be heavily sanctioned, and a client in a FATF-listed country is not automatically a sanctions match. Screen against both, every time.

What happens to the grey list?

It is still published and still relevant, but it no longer automatically triggers EDD. Grey list membership is now a risk factor you weigh, rather than a rule to follow.

Following the October 2026 plenary, 18 jurisdictions are under increased monitoring: Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK) and Yemen. The October plenary removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco, and added none. The June plenary had added Bosnia and Herzegovina and Iraq, and removed Algeria and Namibia.

Reading that list as an art market participant rather than as a banker, one recent exit and one entry stand out.

Monaco. A jurisdiction with a dense concentration of private collectors, advisers, storage and family offices, and a short drive from several of the fairs your clients attend. Monaco left the grey list on 30 October 2026, after just over two years under increased monitoring. That removes a FATF flag, not the risk: Monaco still appears among the financial secrecy jurisdictions below, so assess a Monaco connection on its own facts rather than downgrading it automatically. 

The Virgin Islands (UK). Not a client location so much as an ownership layer. BVI companies hold art, and the grey listing speaks directly to how easily you can establish who is behind one. If your file only records the company and stops there, the listing is the argument for going further.

Lebanon, Kuwait, Syria and Haiti carry their own well-understood risks. The point is not that every grey-listed connection is a problem. It is that the regulations no longer make the decision for you, so your file has to show that you made it.

The key takeaway is that for all grey list countries, you must consider whether EDD is appropriate, and either apply it or keep a record of why you chose not to. An undocumented decision reads to an inspector as no decision at all, and the 2026 instrument came with no transitional provisions, so the standard has applied since 30 June.

Don’t forget that the grey list is reviewed, and usually changed, three times a year: in February, June and October. 

Does a shorter list mean less work?

No. It means the work moved from the regulations into your risk assessment, where you have to evidence it.

Beyond the FATF black and grey lists: some 20+ jurisdictional risk factors

The FATF lists are focused on jurisdictions’ AML compliance, or lack thereof. However, HMRC’s July guidance points to quite a few other country risks AMPs must consider, such as countries: 

• Adjacent to black list countries, for example China, India or Türkiye 
• Neighbouring countries rated as having high levels of crime or corruption, hosting terrorist groups, or involved in proliferation-related activities 
• With no AML/counter-terrorist financing regime equivalent to the UK’s 
  • such as the US and China 
• With limited corporate registration or beneficial ownership requirements 
  • such as BVI, Cayman Islands, Panama, Belize, Seychelles, Anguilla, Nevis, Marshall Islands, Samoa, Vanuatu, parts of the UAE and US 
• With laws aiding financial secrecy 
  • such as Switzerland, UAE, BVI, Bahamas, Bermuda, Jersey, Guernsey, Isle of Man, Luxembourg, Liechtenstein, Monaco, Singapore, Hong Kong, and the US states of Delaware, Nevada and Wyoming 
• Offering Citizenship by Investment (CBI), a list that changes regularly
• Listed in the National Risk Assessment 2025 
  • such as Russia, China, Hong Kong, Türkiye, UAE and certain US States
• Scoring above 6.08 on the Basel AML Index 

These are just a few of the criteria. 

What does Enhanced Due Diligence require?

Six measures, set out in regulation 33(3A), which HMRC treats as a floor rather than a ceiling.

1. Additional information on the customer and on the beneficial owner, beyond standard CDD under regulation 28
2. The intended nature of the business relationship
3. Source of funds and source of wealth
4. The reasons behind the transaction
5. Senior management approval to establish or continue the relationship
6. Increased monitoring of the relationship afterwards

All six should be written into your policies and procedures under regulation 19(3)(c), not carried in anyone’s head. HMRC’s own guidance describes the list as non-exhaustive, which means a file showing all six and nothing more is defensible, and a file showing three is not.

One definition is worth pinning down before you apply any of this. “Established in” a country, under regulation 33(3)(c), means an individual is resident there, not born there, and a business is incorporated there or has its principal place of business there. A British collector resident in Tehran is caught. An Iranian-born collector resident in London is not, at least not on country grounds. Getting this wrong in either direction is a problem: one is a missed obligation, the other is a client treated as higher risk than the rules allow, in a market where that conversation is hard to have twice.

What you need to do

1. Update your policies and procedures. Any document that still defines high-risk third countries as both FATF lists is now wrong. The mandatory country trigger is the call for action list alone.
2. Rewrite your country risk section; do not just delete it. 
   • Name the three call for action countries as mandatory EDD. 
   • Set out separately how you treat the grey list, and say what that treatment is: a risk factor that raises the client risk rating and prompts a closer look at source of funds and ownership.
   • Acknowledge that you must consider EDD in many other cases and either apply it or justify why you are not. 
3. Check your open files. Clients onboarded before 30 June under the old definition may carry EDD applied for a reason that no longer exists, or a grey-list connection nobody has reassessed.
4. Record and justify any decisions not to apply EDD. Where a grey-listed or other high-risk jurisdiction does not lead to EDD, the reasoning goes on the file at the time, not reconstructed later.
5. Be sure to update the FATF lists. Name the person who checks the FATF lists after each plenary and updates your procedures. The October 2026 plenary removed four jurisdictions from the grey list, so date that change in your country risk matrix and check your screening uses the current list of 18. The next plenary is in February 2027.
6. Retrain on the distinction. Anyone who onboards clients needs to understand that “not on the mandatory list” and “not high risk” are different statements. Training requirements for AMPs sets out the baseline.

How can FCS Compliance help?

The country risk section of a firm-wide risk assessment is one of the places HMRC looks first. If yours still names both FATF lists, we can bring it into line and document the reasoning behind your own high-risk list at the same time.

Our customer due diligence service covers risk rating, source of funds, beneficial ownership and sanctions screening on a pay-as-you-go basis, which suits dealers and galleries who meet a complex structure a few times a year rather than every week. For the underlying documents, our primary services cover risk assessments, policies and procedures and the regulation 21 independent audit.

Call FCS Compliance on 020 7924 7979, or start at the art market hub to talk it through.

Frequently asked questions

Do art market participants still have to apply enhanced due diligence to grey list countries?

Not automatically. Since 30 June 2026, mandatory EDD on country grounds applies only to FATF call for action countries: Iran, North Korea and Myanmar. A grey list connection is a risk factor that should feed your client risk assessment, and will often lead you to apply EDD for your own documented reasons.

Which countries are on the FATF black list in November 2026?

Iran, the Democratic People’s Republic of Korea and Myanmar, as confirmed at the FATF plenary of 17 to 19 June 2026, and unchanged at the plenary that closed on 30 October 2026. FATF asks for counter-measures against Iran and North Korea, and enhanced due diligence proportionate to risk for Myanmar.

How many countries are on the FATF grey list in October 2026?

Eighteen, following the plenary that closed on 30 October 2026. Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco were removed, and none were added. In June, Bosnia and Herzegovina and Iraq were added, and Algeria and Namibia removed. The lists are reviewed at the February, June and October plenaries, with the next outcomes due in February 2027.

Does the UK still publish its own high-risk third country list?

No. Schedule 3ZA of the Money Laundering Regulations 2017 was removed in January 2024, and since 30 June 2026 the regulations point directly at the FATF call for action list as it stands from time to time. Changes made at a FATF plenary therefore take effect in the UK without further legislation.

This article is general guidance and not legal advice. Last reviewed 4 November 2026.

Warning: there are many other factors in addition to high-risk jurisdictions that may trigger Enhanced Due Diligence or the need to consider it. This article does not cover those factors, but you must still consider them.

About the author

Sources

Source	Used for
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026, SI 2026/621	The regulation 33 amendment, the new definition, the 30 June 2026 commencement
HMRC Economic Crime Supervision Handbook, ECSH31555	The history of the high-risk third country definition and the 30 June 2026 change
HMRC Economic Crime Supervision Handbook, ECSH33336	The six regulation 33(3A) EDD measures and the “established in” test
HMRC AMLG2100, art market participant guidance	Confirmation that the sector guidance is still awaiting ministerial sign-off, and that BAMF guidance does not reflect the change
FATF, High-Risk Jurisdictions subject to a Call for Action, 19 June 2026	The three call for action countries and what FATF asks for in each case
FATF, Jurisdictions under Increased Monitoring, 19 June 2026	The June 2026 grey list additions and removals
FATF events calendar	The October plenary dates, 26 to 30 October 2026, Paris
FCS Compliance, FATF plenary October 2026: four exits from the grey list	The October 2026 grey list removals, the 18 current grey list jurisdictions and the unchanged call for action list

More from Rena

• 
  What the new UK Regulations and HMRC High-Risk Jurisdiction Guidance mean for art market participants
• 
  AML rules and HMRC Guidance Have Changed: What The Art Market Needs to Know
• 
  Two thresholds, both now in pounds: what the £10,000 CDD change means for art dealers