Geographic risk for dealers and galleries: the rules as they stand after 30 June 2026
The law on country risk has two parts: a short list that forces enhanced due diligence, and a longer set of factors you weigh for yourself and write into your firm-wide risk assessment. Both moved in 2026. This page sets out each as it stands today, with the instrument and the date, and ends with a checklist you can run buyer by buyer.
In short
- Since 30 June 2026, mandatory enhanced due diligence on country grounds applies only where a party is established in a FATF Call for Action country: at the last HM Treasury notice, the Democratic People’s Republic of Korea, Iran and Myanmar. The grey list no longer triggers it (S.I. 2026/621, regulation 19).
- The same regulations moved the art market threshold from 10,000 euros to £10,000.
- The geographic risk factors in regulation 33(6)(c) are unchanged, and HMRC’s risk assessment for the sector (published July 2026, updated 15 October 2026) adds its own list: countries without equivalent AML measures, neighbours of high-risk states, weak corporate registration, financial secrecy, tax evasion, capital flight, conflict zones, citizenship by investment.
- These belong in your firm-wide risk assessment under regulation 18, applied case by case under regulation 33(6), with the reasons recorded.
- The checklist in section 7 turns a lawyer’s list of categories into questions you can answer on each sale.
1. Two rules, not one
Regulation 33 does two different jobs. Paragraph (1) lists the cases where you must apply enhanced due diligence whatever else you think; one of them is about countries.
in any business relationship ... with a person established in a FATF call for action country or in relation to any relevant transaction where either of the parties to the transaction is established in a FATF call for action country;
Paragraph (6) then lists the factors you must weigh when deciding whether any other case is high risk, and geography is one group of them. The first is a hard rule with a short list. The second is a judgement you make and record. A lawyer’s list of “higher risk countries” almost always mixes the two, so the first thing to do with any such list is to sort it.
2. What changed on 30 June 2026
From 23 January 2024 the UK’s high-risk third countries were simply whatever the FATF named on its two lists. The explanatory note to the 2024 regulations put it this way.
A “high-risk third country” for the purposes of the MLRs will now mean a country named by the Financial Action Task Force from time to time on lists it publishes: on the list of High-Risk Jurisdictions subject to a Call for Action or the list of Jurisdictions under Increased Monitoring. Schedule 3ZA is removed from the MLRs.
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 were made on 9 June 2026 and, apart from provisions on cryptoasset businesses, came into force 21 days later, on 30 June 2026. Regulation 19 rewrote the country rule.
In regulation 33—
- (a) in paragraph (1)(b), for “high-risk third country”, in both places it occurs, substitute “FATF call for action country”;
- (b) in paragraph (1)(f)(i), for “complex or unusually large” substitute “unusually complex or unusually large in each case given the nature of the transaction”;
- (c) in paragraph (3)(a), for the definition of “high-risk third country” substitute— a “FATF call for action country” means a country named on the list of High-Risk Jurisdictions subject to a Call for Action published by the Financial Action Task Force as such list has effect from time to time;
The same instrument made the same substitution in regulation 39 on reliance (regulation 23); changed the threshold for the art market, “In regulation 14, for “10,000 euros”, in each place it occurs, substitute “£10,000”.” (regulation 9), so that regulation 14 now defines a dealer by transactions whose value “amounts to £10,000 or more”; and recast the transaction triggers in regulation 27(7C), adding the word “occasional” and the high value dealer wording on linked operations, which its explanatory note says is “to align the customer due diligence transaction-based triggers for letting agents and art market participants with those for high value dealers”. HM Treasury’s advisory notice of 22 June 2026 explained the effect of the country change in advance.
After the coming into force date, enhanced due diligence and enhanced ongoing monitoring will only be required for business relationships with a person established in a jurisdiction listed by FATF as one of the High-Risk Jurisdictions subject to a Call for Action or in relation to relevant transactions where either of the parties to the transaction is established in a jurisdiction listed by FATF as one of the High-Risk Jurisdictions subject to a Call for Action.
HMRC said the same to the art market on 8 July 2026, while its sector guidance waits for sign-off.
Regulation 33(3) change from High Risk Third Countries to FATF Call for Action (black listed) countries (currently Iran, North Korea (DPRK) and Myanmar) for mandatory EDD.
3. The lists as HM Treasury last published them
The FATF updates its lists three times a year. HM Treasury’s notice explains the rhythm.
These lists are updated three times a year, on the final day of each FATF Plenary meeting, held every February, June and October. The dates of these meetings are published several months in advance, in the events calendar on the FATF website.
The June 2026 notice reproduced the lists as the FATF published them on 19 June 2026. The Call for Action list, which is the one that now triggers mandatory enhanced due diligence, had three names.
High-Risk Jurisdictions subject to a Call for Action
- Democratic People’s Republic of Korea
- Iran
- Myanmar
The Increased Monitoring list had 22: Angola, Bolivia, Bosnia and Herzegovina, the British Virgin Islands, Bulgaria, Cameroon, Côte d’Ivoire, the Democratic Republic of the Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam and Yemen. The notice adds that nine of the countries across both lists were also subject to financial sanctions measures at the time. The FATF’s calendar has an October plenary each year, and HM Treasury’s page still showed the June 2026 lists on 3 November 2026, so check the FATF’s own page and the Treasury notice before you rely on either list.
4. What mandatory enhanced due diligence means
Where a buyer or seller is established in a Call for Action country, regulation 33(3A) fixes six measures. HMRC’s guidance states them for the businesses it supervises.
You must take all of the following measures in any business relationship with a customer or beneficial owner established in a FATF Call for Action country, or in relation to any relevant transaction where either of the parties to the transaction is established in a FATF Call for Action country:
- Obtain additional information on the customer and the customer’s beneficial owner.
- Obtain additional information on the intended nature of the business relationship.
- Obtain information on the source of funds of the customer and of the customer’s beneficial owner which HMRC expect to be supported by evidence.
- Obtain information on the reasons for the transaction.
- Obtain the approval of senior management for establishing or continuing the business relationship.
- Enhance monitoring of the business relationship by increasing the number and timing of controls applied and select patterns of transactions which require further examination.
One difference between HMRC’s wording and the regulation matters: regulation 33(3A)(c) requires information on “the source of funds and source of wealth of the customer and of the customer’s beneficial owner”, so source of wealth is part of the mandatory measures too. “Established in” is defined in the regulation, and for a private buyer it means residence.
in the case of an individual, being resident in that country, but not merely having been born in that country.
5. The factors you weigh yourself
Regulation 33(6) lists what you must take into account when deciding whether a case is high risk. The geographic group reads as follows.
geographical risk factors, including—
- (i) countries identified by credible sources, such as mutual evaluations, detailed assessment reports or published follow-up reports, as not having effective systems to counter money laundering or terrorist financing;
- (ii) countries identified by credible sources as having significant levels of corruption or other criminal activity, such as terrorism (within the meaning of section 1 of the Terrorism Act 2000), money laundering, and the production and supply of illicit drugs;
- (iii) countries subject to sanctions, embargos or similar measures issued by, for example, the European Union or the United Nations;
- (iv) countries providing funding or support for terrorism;
- (v) countries that have organisations operating within their territory which have been designated— (aa) by the government of the United Kingdom as proscribed organisations under Schedule 2 to the Terrorism Act 2000, or (bb) by other countries, international organisations or the European Union as terrorist organisations;
Sub-paragraph (vi) adds countries identified by the FATF, the IMF, the World Bank, the OECD or other bodies as not implementing the FATF recommendations. Two customer factors in the same paragraph are geographic in effect: a customer resident in a high-risk area (33(6)(a)(ii)), and a customer buying residence or citizenship.
the customer is a third country national who is applying for residence rights in or citizenship of a state in exchange for transfers of capital, purchase of a property, government bonds or investment in corporate entities in that state;
And the regulation tells you how to hold all of this.
In making the assessment referred to in paragraph (6), relevant persons must bear in mind that the presence of one or more risk factors may not always indicate that there is a high risk of money laundering or terrorist financing in a particular situation.
HMRC’s risk assessment for the art market, updated on 15 October 2026, goes further than the regulation. It restates the 33(6)(c) factors and then adds its own.
In addition to the geographical risk factors in Regulation 33(6)(c), HMRC considers there may be an increased geographical risk where the overseas jurisdiction:
- Is not subject to anti money laundering or counter terrorist measures equivalent to the UK
- Shares a border with a FATF Call for Action country or a country known to have high levels of crime or corruption, host terrorist groups, or be involved in proliferation-related activities, as money laundering, terrorist financing or proliferation financing often involves the movement of funds across borders
- Has limited corporate registration requirements or limited beneficial ownership information requirements (for example, where there is no requirement to update ownership changes)
- Allows unrestricted bearer share usage
- Has laws aiding financial secrecy
- Has high levels of tax evasion
- Has high levels of capital flight
- Is a conflict zone
On sources, HMRC names the JMLSG guidance, Transparency International, Global Witness, internet and press searches and the Basel AML Index, with a note: “HMRC considers that any country with a score above 6.08 should be treated as high risk but note that not all countries are included on the index”. It adds a line that does much of the lawyer’s work for them: “Whilst you must make your own assessment of all jurisdictions based on the factors already mentioned, HMRC considers the countries listed within the NRA 2025 to be higher risk.” On sanctions it is categorical.
All persons and entities linked to the UK sanctions list, irrespective of which sanctions regime, should be treated as high-risk. You must not deal with those specifically listed – see sanctions section at end.
HMRC’s sanctions section also goes beyond designated persons. It says “There is an increased risk of sanctions evasion or proliferation financing in any transaction or business relationship linked to a sanctioned country. Such transactions and customers should be treated as high risk.” And it gives the art trade a specific example: “there are restrictions in relation to luxury goods (including art) worth over £250 to individuals connected to Russia”.
On citizenship by investment HMRC sets out a specific expectation and a list of countries.
HMRC expects AMPs to treat any customer who has a passport from a country that offers CBI as a higher risk where the place of birth is shown as being in a different jurisdiction to that of the issued passport.
Countries that offer CBI include, but are not limited to:
- Antigua and Barbuda
- Cyprus
- Dominica
- Grenada
- Jordan
- Malta
- Montenegro
- Saint Vincent and the Grenadines
- St. Kitts and Nevis
- St. Lucia
- Turkey
- United Arab Emirates
- Vanuatu
The National Risk Assessment 2025, published on 17 July 2025, is the document behind much of this. For the art market it records a lower score than in 2020 and a specific cross-border point.
The risk rating for money laundering in the sector has decreased from high to medium since the last NRA.
Other leading markets in the world (the USA and China) do not have money laundering supervision for the art market raising the risk of criminal activity. Given the relative ease with which art can be used to move value across borders, firms should exercise the appropriate customer due diligence when dealing with potentially high risk individuals and individuals from high risk jurisdictions.
The NRA names many countries in its typologies, in context: as transit hubs for cash, as destinations for property purchases, as centres for layering. HMRC’s guidance recommends reading the whole document and in particular sections 2, 3 and 4, and treats the countries it lists as higher risk. Your risk assessment should say which of those contexts touch your business and which countries that brings in.
6. A lawyer’s list, sorted
Here is a typical set of categories a compliance adviser sends a dealer, with where each comes from and what it asks of you.
| Category as sent | Where it comes from | Rule or factor? | What to do |
|---|---|---|---|
| Inadequate AML and CTF measures, or not equivalent to the UK (examples given: the US, China) | Reg 33(6)(c)(i) and (vi); HMRC AMLG3100; NRA 2025 paragraph 5.143 | Factor | Weigh with the other facts of the sale; record the reason either way |
| Citizenship by investment countries | Reg 33(6)(a)(viii); HMRC AMLG3100 CBI section and list | Factor, with HMRC’s specific expectation | Compare place of birth with the issuing country on the passport; treat a mismatch as higher risk |
| Countries named in the NRA 2025 | HMRC AMLG3100: higher risk | Factor | Read the NRA’s context for each country you deal with and write it into the risk assessment |
| Limited corporate registration or beneficial ownership requirements | HMRC AMLG3100 additional factors | Factor | For a company buyer, identify and verify the beneficial owner (reg 28(4)); do not rely on a register alone (reg 28(9)) |
| Laws aiding financial secrecy | HMRC AMLG3100 additional factors | Factor | Ask where the funds are held and why that structure; record the answer |
| UK, EU or UN sanctions or embargoes | Reg 33(6)(c)(iii); HMRC AMLG3100 sanctions section | Factor, and a prohibition where a person is designated | Screen every party against the UK Sanctions List; never deal with a designated person |
| Links to a sanctioned country (the lawyer named Russia) | HMRC AMLG3100: any transaction or relationship linked to a sanctioned country is to be treated as high risk; trade sanctions restrict luxury goods including art worth over £250 to individuals connected to Russia | Factor, plus trade restrictions | Treat the case as high risk; check the trade sanctions before any sale to a Russia-connected buyer |
| Funding or support for terrorism; proscribed or designated organisations | Reg 33(6)(c)(iv) and (v) | Factor | Weigh; escalate to your nominated officer where present |
| Neighbours of high-crime, high-corruption or proliferation states | HMRC AMLG3100 additional factors | Factor | Note it where the buyer, seller or funds sit in such a country |
| Basel AML Index: corruption, tax evasion, capital flight, conflict, organised crime | HMRC AMLG3100: one example source among several; where a country is on the index HMRC treats a score above 6.08 as high risk | A source, not a rule | Where you use it, treat a score above 6.08 as high risk; name the sources you used |
| FATF Call for Action country (DPRK, Iran, Myanmar at the last notice) | Reg 33(1)(b) and (3)(a) as amended 30 June 2026 | Rule | All six measures in reg 33(3A), before the relationship or transaction |
7. A client-by-client checklist
Your firm-wide risk assessment under regulation 18 is where the policy lives. Regulation 18(2)(b)(ii) requires it to take account of “the countries or geographic areas in which it operates”, and 18(4) requires “an up-to-date record in writing of all the steps it has taken”. The checklist below is the case-by-case application of that policy on each sale at or above £10,000.
| # | Question on this buyer or seller | If the answer is yes | Source |
|---|---|---|---|
| 1 | Is any party resident, incorporated or principally based in a FATF Call for Action country? | Mandatory enhanced due diligence: the six measures, senior management sign-off, before you proceed | Reg 33(1)(b), 33(3), 33(3A) |
| 2 | Is any party, or anyone who owns or controls them, on the UK Sanctions List, or is the sale linked to a sanctioned country? | A designated person: do not deal. A link to a sanctioned country: treat as high risk and check the trade restrictions (art over £250 to Russia-connected buyers) | HMRC AMLG3100 sanctions section |
| 3 | Does the passport’s issuing country offer citizenship by investment, with a place of birth elsewhere? | Treat as higher risk; ask about the second nationality and the source of wealth | Reg 33(6)(a)(viii); HMRC AMLG3100 |
| 4 | Is the buyer resident in, or is the money coming from or going to, a country on the FATF Increased Monitoring list or named in the NRA 2025? | Weigh as a geographic factor; decide and record whether the case is high risk | Reg 33(6)(c); HMRC AMLG3100 |
| 5 | Is the buyer a company, trust or intermediary in a country with weak corporate or beneficial ownership registration, or secrecy laws? | Identify and verify the beneficial owner; do not rely on a register alone | Reg 28(4), 28(9); HMRC AMLG3100 |
| 6 | Does the country border a Call for Action, high-crime or proliferation state, or appear in a credible source as high risk? | Weigh it; name the source you used | HMRC AMLG3100 |
| 7 | Is the buyer not seen face to face without safeguards, or is payment coming from an unknown or unassociated third party? | These are separate factors in reg 33(6)(b); they compound geography | Reg 33(6)(b)(iii), (iv) |
| 8 | Have you written down the decision and the reasons, whichever way it went? | Always. HMRC asks for the rationale on request | Reg 18(4), 28(16); HMRC AMLG1800 |
HMRC says what it wants when you weigh a factor and decide the case is not high risk after all: ensure “that your rationale is justifiable”, “record the reasons for your decision” and be ready to provide that record on request. It also expects the risk assessment itself to be reviewed “at least annually”, and names “an update to the FATF list of countries subject to a call for action” as a change that calls for a review in between.
How ArtGuard helps, and where it stops
ArtGuard reads the buyer’s nationality and date of birth from the identity document, reads the residential address from an address document, and screens the buyer against the UK Sanctions List, OFAC and UN lists and a worldwide PEP roster, with the list versions on the record. That gives your nominated officer the facts the checklist above needs: where the buyer lives, which country issued the document, and whether any list names them. ArtGuard does not score countries, does not flag FATF or NRA countries, does not read the Basel AML Index and does not decide whether enhanced due diligence applies. Those are your firm-wide risk assessment and your judgement on the sale. What ArtGuard screens and records, and what it does not sets this out in full.
Questions people ask
Did the list of high-risk countries get longer this summer?
Two different lists moved in opposite directions. The list that triggers mandatory enhanced due diligence got shorter on 30 June 2026: it is now the FATF Call for Action list only, three countries at the last HM Treasury notice. The list of things HMRC asks you to weigh in your own risk assessment got longer and more specific when HMRC published its new guidance manual and its risk assessment for the art market in July 2026 and updated the latter on 15 October 2026 (section 5). Both are true, and they are different duties.
Is the United States a high-risk country?
It is not on either FATF list and it is not a FATF Call for Action country, so a US buyer does not trigger mandatory enhanced due diligence by residence alone. The National Risk Assessment 2025 does say that the USA and China “do not have money laundering supervision for the art market”, and HMRC repeats the point in its risk assessment for the sector. That is a risk factor to weigh and record for a US buyer, with the size of the sale, how they came to you and where the money comes from; it is not a rule that every US buyer is high risk.
Does the FATF grey list still matter?
Yes, as a risk factor rather than a trigger. Regulation 33(6)(c)(vi) asks you to weigh countries identified by the FATF and similar bodies as not implementing its recommendations, which is what the Increased Monitoring list records, and HM Treasury’s notice says you “will continue to be required to take FATF mutual evaluations into account as a relevant geographical risk factor”. HMRC names an update to the Call for Action list as a change that calls for a review of your risk assessment; a grey-list change is a reason to look again at the customers it touches.
What does “established in” a country mean for a private buyer?
Residence. Regulation 33(3)(c)(ii) says an individual is established in a country by “being resident in that country, but not merely having been born in that country”. A buyer born in Tehran who lives in London is not established in Iran. Place of birth still matters for the citizenship-by-investment check HMRC asks for.
Do I have to use the Basel AML Index?
No regulation requires it. HMRC lists it as one example of a source for weighing a jurisdiction, alongside the JMLSG guidance, Transparency International, Global Witness and the press, and adds that where a country is on the index it “considers that any country with a score above 6.08 should be treated as high risk”. Use sources you can name and keep, and record which you used.
When must I update my risk assessment for all this?
HMRC expects a review “at least annually”, and sooner when the rules change, naming an update to the FATF Call for Action list as an example. The 30 June 2026 changes and HMRC’s October 2026 risk assessment are both reasons to review now and record the date.
Sources
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 33Revised text as at 30 June 2026 · legislation.gov.uk
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 18Revised text as at 30 June 2026 · legislation.gov.uk
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 14Revised text as at 30 June 2026 · legislation.gov.uk
- The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (S.I. 2026/621)Made 9 June 2026, in force 30 June 2026 · legislation.gov.uk
- The Money Laundering and Terrorist Financing (High-Risk Countries) (Amendment) Regulations 2024 (S.I. 2024/69)In force 23 January 2024 · legislation.gov.uk
- HM Treasury, Money Laundering Advisory Notice: High Risk Third CountriesJune 2026 notice, published 22 June 2026 · GOV.UK
- HMRC, Anti-money laundering guidance for supervised businesses, AMLG2100: Art Market Participant GuidanceUpdated 8 July 2026 · GOV.UK
- HMRC, Anti-money laundering guidance for supervised businesses, AMLG11640: FATF Call for Action CountriesUpdated 8 July 2026 · GOV.UK
- HMRC, Anti-money laundering guidance for supervised businesses, AMLG11600: Enhanced due diligence (EDD)Updated 8 July 2026 · GOV.UK
- HMRC, Anti-money laundering guidance for supervised businesses, AMLG3100: Risk Assessment of Art Market ParticipantsUpdated 15 October 2026 · GOV.UK
- HMRC, Anti-money laundering guidance for supervised businesses, AMLG1800: Risk AssessmentUpdated 8 July 2026 · GOV.UK
- HM Treasury and Home Office, National Risk Assessment of Money Laundering and Terrorist Financing 2025Published 17 July 2025; art market participants at paragraphs 5.135 to 5.149 · GOV.UK
ArtGuard supports your judgement; it never replaces it. This page describes what the Money Laundering Regulations 2017, HM Treasury’s notices and HMRC’s own published guidance say, with the source for each point, so you can read it yourself. It is not legal advice, and nothing here is advice about what HMRC will accept. ArtGuard is not affiliated with or endorsed by HMRC, HM Treasury, the Office for Digital Identities and Attributes or any AML supervisor. Check the current version of each document before you rely on it.
One link. One dated record for the file.
Send your buyer a link. They verify their identity on their phone. You receive the identity result, the sanctions and PEP screening with the list versions it ran against, and a dated evidence file. £39 + VAT a month for 15 checks, £2.50 + VAT for each one after, no minimum term, first month free.
Run one check with usNot a regulator, not a lawyer.
ArtGuard supports your judgement; it never replaces it. Your firm-wide risk assessment, your policies and the decision on each sale remain yours, and HMRC remains your supervisor.
Read the plain notes