Introduction
On 30 June 2026, most of the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force, with a small number of provisions following in 2027. Most of the commentary I have read describes them as a deregulatory package, and in a narrow sense that is accurate. Two of the most discussed changes reduce the number of situations in which enhanced due diligence (EDD) is mandatory. Customers and transactions linked to countries on the Financial Action Task Force (FATF) list of jurisdictions under increased monitoring, often called the grey list, no longer require EDD automatically, and the trigger for complex or large transactions has been reworded so that firms can judge what is unusual in the context of the transaction.
It would be easy to read these changes as a reduction in compliance work. In my view, they move the work rather than remove it. Where the law previously made the decision for the firm, the firm must now make the decision itself, and it must be able to explain that decision to a supervisor, an auditor or, in the worst case, an enforcement team. A mandatory rule is simple to apply and simple to evidence. A risk-based judgment is neither, and many institutions have spent years building controls around the first and very little around the second.
This article looks at what has changed, where I think institutions are most likely to go wrong in implementing the changes, and what a defensible approach looks like in practice.
Regulatory context
The amending instrument, SI 2026/621, was made on 9 June 2026 and makes around fifteen targeted changes to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs). It follows HM Treasury’s review of the UK AML regime and its consultation on draft amendments, published with a policy note in September 2025 (HM Treasury, 2025).
Two changes to regulation 33, which sets out when EDD must be applied, are the focus of this article.
The first concerns high-risk third countries. Before the amendments, EDD was required for business relationships and transactions involving a person established in any country on either of the FATF’s public lists. The amended definition covers only the jurisdictions subject to a FATF call for action, which at the time of HM Treasury’s June 2026 advisory notice were the Democratic People’s Republic of Korea, Iran and Myanmar. The twenty-two jurisdictions under increased monitoring named in the same notice no longer trigger mandatory EDD (HM Treasury, 2026). HM Treasury’s stated reason is that the narrower scope allows firms to direct their resources to the jurisdictions which present the greatest risk to the UK (HM Treasury, 2025).
The second concerns the transaction trigger in regulation 33(1)(f). The previous reference to transactions that are “complex or unusually large” has been replaced with transactions that are “unusually complex or unusually large in each case given the nature of the transaction”. The policy note explains that the old wording led to confusion and, in some sectors, an overly cautious approach, and it states that the change refines the existing requirement rather than introducing a new obligation (HM Treasury, 2025).
Neither change removes the underlying risk-based obligations. Regulation 33(1)(a) still requires EDD in any case identified as presenting a high risk of money laundering or terrorist financing, and regulation 33(6) still requires firms to take geographic risk factors into account, including whether a country has been identified by credible sources, such as FATF mutual evaluations, as lacking effective AML systems. HM Treasury’s advisory notice repeats this point, stating that firms must continue to take FATF mutual evaluations into account and must apply EDD where they identify a high risk (HM Treasury, 2026). The change also brings the UK closer to the FATF’s own position, since the FATF states in each of its increased monitoring statements that it does not call for the application of EDD to these jurisdictions, while encouraging its members and all jurisdictions to take the information into account in their risk analysis (FATF, 2026).
In other words, the law no longer requires EDD for every grey-list connection, but it has not said that such connections are low risk.
Where the judgment now sits
The grey list becomes a risk factor rather than a rule
Under the previous rules, a customer with a significant connection to a grey-list jurisdiction received EDD, and the reason was recorded simply as the country. That reasoning no longer works. A firm that keeps applying EDD to every such customer is entitled to do so, but in my view it would be sensible to be able to explain why, given that the law no longer requires it. A firm that stops applying EDD needs to show that it has considered the geographic risk and concluded that standard measures are sufficient for that customer or segment.
The difficulty is that the grey list was never a single category of risk. Some jurisdictions are on it because of technical deficiencies that are close to being resolved, while others have serious weaknesses in supervision, beneficial ownership transparency or prosecution. A country risk methodology that previously gave every grey-list country the same automatic weighting now has to distinguish between them, and that requires more analysis than many institutions have historically done.
“Unusual” needs a baseline
The new transaction wording asks whether a transaction is unusually complex or unusually large given its nature. That question can only be answered if the firm knows what usual looks like for that kind of transaction, product and customer.
My own background in trade finance makes this point clear to me. A documentary credit involving an applicant, a beneficiary, an issuing bank, an advising or confirming bank, a carrier, an insurer and several sets of documents is complex by any ordinary measure, yet it is entirely normal for a trade finance desk. Under the old wording, it was arguable that a great deal of routine trade activity fell within the complexity trigger. Under the new wording, the complexity of a standard credit should not of itself require EDD. However, a credit with unexplained intermediaries, repeated amendments to the beneficiary or the port of discharge, or a structure that serves no clear commercial purpose may be unusually complex even by trade finance standards. The amendment does not make that judgment any easier. It simply makes clear that the firm is the one who has to make it.
Downgrades are decisions too
When a mandatory requirement falls away, existing customers who received EDD because of it do not automatically become lower risk. Each one has to be considered. In practice, the temptation is to treat the change as a list update, removing the grey-list countries from the high-risk table in the screening and risk rating systems and allowing the ratings to recalculate. That produces a large number of downgrades in a single day with no individual review, and the decision to downgrade is then recorded nowhere except in a change request.
As I discussed in my previous article on customer risk rating drift, a rating that falls without anyone deciding that it should fall is one of the hardest weaknesses to detect afterwards, because the customer then moves to a longer review cycle and the error is not revisited for years.
An illustrative case
Consider a hypothetical UK bank with a mid-sized corporate book that includes a number of import and export businesses. Before 30 June 2026, its country risk table classified all grey-list jurisdictions as high risk, and any customer with a significant counterparty or ownership link to one of them was rated high risk and subject to EDD.
In preparation for the amendments, the second line drafted a revised policy stating that grey-list jurisdictions would in future be assessed on a risk-based approach, taking into account FATF mutual evaluations and other credible sources. The policy was approved by the relevant committee. The technology team was asked to update the country risk table, and grey-list countries were reclassified as medium risk with effect from the commencement date. Around a hundred and twenty customers whose high rating rested on the grey-list connection moved from high to medium risk overnight, their review frequency changed from annual to three-yearly, and several transaction monitoring scenarios that applied tighter thresholds to high-risk customers stopped applying to them.
Nobody intended a blanket downgrade. The policy described a risk-based assessment, but the only assessment that took place was the one made by the system. No customer-level review was carried out, and no record explained why each customer was now considered medium risk. Among the downgraded customers was a commodity trading company whose payments were routed through a grey-list jurisdiction that the FATF had identified as having significant weaknesses in beneficial ownership transparency. Its file had previously recorded EDD measures that addressed exactly that weakness, and those measures stopped.
Some months later, an internal audit review asked the bank to show how it had applied its new risk-based approach to grey-list exposure. The bank could produce the policy, the committee minutes and the change ticket. It could not produce a single customer-level rationale. The policy was sound, and the amended regulation may well have permitted many of those downgrades, but the bank could not show that it had made the judgment the regulation now expected of it.
Why this is likely to be missed
From what I have observed, institutions tend to treat deregulatory changes with less care than new obligations. A new requirement generates a project, a gap analysis and a testing plan. A requirement that falls away is often implemented as a simplification, with fewer reviewers involved and less scrutiny of the consequences.
The evidence of compliance is also built around rules rather than reasoning. Quality assurance programmes typically test whether EDD was applied where it was required. They are much less likely to test whether a decision not to apply EDD was properly considered, because under the previous rules that decision was rarely needed for grey-list customers. Once the decision exists, the testing has to change with it.
Finally, the people who make the change and the people who own the risk are often different. The policy owner writes the risk-based approach, the technology team implements a table change, and the first line inherits a set of customers with new ratings. Each step is reasonable on its own. The gap appears because nobody is responsible for confirming that the outcome matches the intention of the policy.
There is also a regulatory history worth remembering. In 2019 the FCA fined Standard Chartered Bank more than £102 million after finding serious and sustained shortcomings in its AML controls in two areas of its business that the bank itself had identified as higher risk, its UK correspondent banking business and its UAE branches. Among the examples the FCA gave was a failure to review due diligence on a customer despite repeated red flags (FCA, 2019). The bank had recognised the risk, but it could not show that its controls had responded to it. That expectation has not changed with the 2026 amendments.
Practical measures
The amendments give firms a genuine opportunity to focus EDD where it adds value, but only if the judgment they now require is made and recorded properly. In practical terms, institutions should consider the following measures:
- Revisit the country risk methodology before changing the system. Each grey-list jurisdiction should be assessed on its own merits, drawing on FATF mutual evaluations, follow-up reports and the reasons for its listing, rather than moved as a group from one risk category to another.
- Decide the approach for existing customers explicitly. Whether the firm reviews each affected customer individually or applies a segment-level approach, the decision and its reasoning should be documented, and any customer with a specific risk factor linked to the jurisdiction should be reviewed before EDD is removed.
- Record the rationale at customer level. Where a customer with a grey-list connection is placed on standard measures, the file should state why, in terms that someone outside the team could follow.
- Define what “usual” means for each product. Transaction monitoring and EDD procedures should describe the normal complexity and size of transactions for each product and customer type, so that analysts have a baseline against which to judge what is unusual. Trade finance, correspondent banking and private banking will each need their own.
- Test the decision, not only the rule. Quality assurance should sample cases where EDD was not applied and ask whether that conclusion was reasonable and evidenced, as well as cases where it was applied.
- Report the effect of the change. Management information should show how many customers changed rating as a result of the amendments, how many monitoring rules were switched off or amended, and how many grey-list exposures remain on standard measures.
- Keep the methodology current. The FATF lists change after each plenary, and a risk-based approach to grey-list jurisdictions should include a process for reassessing a country when it is added, removed or its circumstances change.
Conclusion
The 2026 amendments are a sensible response to a real problem. Mandatory EDD for every grey-list connection and for every complex transaction produced a great deal of work that did not always reflect the actual risk, and HM Treasury is right that resources should be directed to where the risk is greatest.
The change does, however, place responsibility back with the firm. A mandatory rule protected institutions to a degree, because applying it was sufficient evidence of compliance. A risk-based judgment offers no such protection unless the firm can show how it was made. Institutions that implement the amendments as a table change and a policy update may find that they have reduced their EDD population without being able to explain why each customer left it.
Having worked on both sides of the line, first in trade finance operations and later in risk and compliance, I have come to think that the hardest compliance decisions are the ones the rules no longer make for you. The 2026 amendments create more of those decisions, and the firms that benefit most from them will be the ones that treat each decision as something they may one day need to defend.
References
Financial Action Task Force (FATF) (2026) Jurisdictions under Increased Monitoring – 19 June 2026. Paris: FATF.
Financial Conduct Authority (FCA) (2019) FCA Fines Standard Chartered Bank £102.2 Million for Poor AML Controls. Press release, 9 April. London: FCA.
HM Treasury (2025) The Draft Money Laundering and Terrorist Financing (Amendment and Miscellaneous Provision) Regulations 2025: Policy Note. Published 2 September. London: HM Treasury.
HM Treasury (2026) Money Laundering Advisory Notice: June 2026. Updated 22 June. London: HM Treasury.
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621). London: The Stationery Office.
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692). London: The Stationery Office.
Leave a Reply