Czech FAU High-Risk Third Countries: EU EDD Remains After FATF Exits

On 5 November 2026 the Czech Financial Analytical Office (Finanční analytický úřad, FAU) published an updated FAU high-risk third countries list, the spreadsheet Czech obliged entities use to identify high-risk third countries under § 9(1)(a)(3) of the AML Act, Act No. 253/2008 Sb. At its 28 to 30 October plenary the FATF had removed the Democratic Republic of the Congo, Monaco, Côte d’Ivoire and Bulgaria from its grey list. Monaco, the Democratic Republic of the Congo and Côte d’Ivoire remain on the European Commission’s high-risk-third-country list despite their removal from FATF increased monitoring. Bulgaria was also removed from FATF increased monitoring, but as an EU Member State it does not qualify as a third country under § 4(14) of the Czech AML Act.

The list decides when enhanced identification and client due diligence (zesílená identifikace a kontrola klienta) is mandatory. Under § 9a(2) of the AML Act, a client whose country of origin is a listed country, or a transaction connected with one, triggers it every time, with a statutory minimum set of measures. The European Commission’s current high-risk-third-country list contains 26 jurisdictions. FAU identifies a combined EU/FATF spreadsheet dated 5 November 2026 as its current published list.

Related reading: FATF October 2026 Plenary: Four Grey-List Exits, Black List Unchanged

Dates behind the 5 November 2026 FAU file

• 28 to 30 October 2026: the FATF plenary removes the four jurisdictions from increased monitoring after successful on-site visits.
• 5 November 2026: the FAU publishes the updated list.
• 29 January 2026: date of the current EUR-Lex consolidated text of Delegated Regulation (EU) 2016/1675, including Delegated Regulations (EU) 2026/46 and 2026/83.
• 10 July 2027: general application date of Regulation (EU) 2024/1624 (AMLR), subject to the exceptions in Article 90. The replacement date of the existing Czech AML Act depends on the enactment and commencement of national legislation.

What changed in the FAU high-risk third countries list

FATF removed Monaco, the Democratic Republic of the Congo and Côte d’Ivoire from increased monitoring on 30 October 2026. All three remain in the EU high-risk-third-country Annex. Their FATF status has therefore changed without an equivalent change to their EU high-risk classification.

Bosnia and Herzegovina, Iraq, Kuwait and Papua New Guinea remain on FATF’s increased-monitoring list but are absent from the current EU high-risk-third-country Annex. Their FATF status remains a geographical risk factor for Czech obliged entities. Any additional Czech designation for another reason under § 9(1)(a)(3) must be assessed separately.

Download note: on 9 November 2026 the FAU’s opinions page on high-risk third countries still linked a 22 June 2026 spreadsheet labelled as current. The 5 November file is linked from the news notice and from the FAU’s international-agenda page on high-risk third countries.

How the AML Act defines a high-risk third country

Section 9(1)(a)(3) of the AML Act defines a high-risk third country as a third country that, on the basis of a directly applicable EU regulation or for another reason, must be considered high-risk. Section 4(14) defines a third country as a state outside the EU and the EEA, so Bulgaria could never qualify, whatever its FATF status.

FAU’s general opinion on EU Member States appearing on FATF lists, the version linked on its opinions page, is dated 31 August 2023 (ref. FAU-118942/2023/03). A revised version dated 30 April 2024 (ref. FAU-46687/2024/03) is indexed on fau.gov.cz, but its text could not be retrieved, so the points below follow the 2023 text.

The 2023 opinion explains that a high-risk third country under § 9(1)(a)(3) is a third country that must be treated as high-risk on the basis of a directly applicable EU regulation or for another reason. The directly applicable regulation is Delegated Regulation (EU) 2016/1675. “Another reason” covers the FATF black list and, for example, a Chamber of Deputies resolution or European Parliament declaration designating a state as a sponsor of terrorism, the route the FAU had used for the Russian Federation. EU and EEA states are excluded by the statutory definition of a third country.

A FATF-grey-listed third country absent from the EU Annex is generally treated as a geographical risk factor, but § 9(1)(a)(3) also allows a third country to be treated as high-risk for another reason. An obliged entity checks FAU’s published list and opinions for any such separate classification.

The three black-list jurisdictions, the DPRK, Iran and Myanmar, all sit in the EU Annex too. The current European Commission list contains 26 jurisdictions. Monaco, the Democratic Republic of the Congo and Côte d’Ivoire remain in its Annex despite their FATF exits. Czech law also recognises high-risk-country classifications arising for another reason.

What § 9a requires for a listed country

Section 9a(2) makes enhanced identification and client due diligence mandatory in two country-linked cases: when establishing, and throughout, a business relationship with a person whose country of origin is a high-risk third country, and before a transaction connected with a high-risk third country. Section 9a(4) sets the floor for both: at least the measures in § 9a(3)(a) to (d) and (f).

• (a) further documents or information on the beneficial owner, the intended nature of the relationship, and the source of funds and other assets of the client and beneficial owner;
• (b) verification from several reliable sources;
• (c) regular, enhanced monitoring of the relationship and its transactions;
• (d) consent from a statutory body member, or the person it designated to manage AML/CFT, to enter into or continue the relationship;
• (f) other measures suited to the entity’s nature, activity and own risk assessment.

Measure (e), requiring the first payment from an account in the client’s name at a credit institution subject to requirements equivalent to those of EU law, sits outside that statutory minimum.

Section 4(15) defines country of origin for four categories. For a natural person, it includes every state of nationality, registered permanent or other residence, and residence lasting more than one year. For a self-employed natural person, it also includes the state of the registered place of business. For a legal person, it includes the state of its registered office and every state where it has a branch or establishment. For a trust, it includes the state under whose law it was established and every country of origin of its trustee under the applicable natural-person, self-employed-person or legal-person rules.

A Czech-registered company with an establishment in Côte d’Ivoire therefore has Côte d’Ivoire as a country of origin; registered-address-only screening would miss that connection.

Occasional transactions have a separate hook. Section 9(1)(a) lists when client due diligence (kontrola klienta) is required before a transaction outside a business relationship that meets the identification condition in § 7(1), a transaction value above EUR 1,000. Within that scope, a person whose country of origin is a high-risk third country is its own case (point 3), alongside the EUR 15,000 value case in point 1.

Monaco, the DRC and Côte d’Ivoire: the FATF exit and Czech EDD

The EU high-risk-third-country Annex continues to list Monaco, the Democratic Republic of the Congo and Côte d’Ivoire following their removal from FATF increased monitoring. The Annex is the EU-law trigger for enhanced due diligence under Article 18a(1) of Directive (EU) 2015/849, and the Commission amends it by delegated act under Article 9(2) of that Directive. A FATF statement does not edit it.

Afghanistan, Algeria, Namibia, Trinidad and Tobago and Vanuatu remain on the EU high-risk-third-country list. Their inclusion in that list is sufficient to engage § 9a(2) where a client’s country of origin or a transaction has the relevant statutory connection. The input that does change is any internal country-risk model scoring FATF status as a separate factor: for the three, that factor has gone while the statutory EDD floor stays until the Annex is amended.

Bulgaria and the grey-listed countries outside the EU Annex

The FAU’s general opinion of 31 August 2023 treats a jurisdiction with strategic AML/CFT deficiencies that is not a high-risk third country, such as an EU Member State on the grey list or a grey-listed third country not on the EU list and not separately designated, as a risk factor. It points to the geographical risk factors in Annex 2 of the AML Act and to the optional suspicious-transaction indicator in § 6(1)(h), a client or beneficial owner from a state that applies AML/CFT measures insufficiently or not at all. The opinion states that obliged entities are not required to apply enhanced identification and client due diligence for these countries as such.

That statement has a limit. Under § 9a(1), enhanced measures become mandatory wherever the entity’s own risk assessment under § 21a shows increased risk in a client, transaction or business relationship, and the 2023 opinion applies this to grey-listed jurisdictions. “Not a high-risk third country” removes the statutory trigger and leaves risk-assessment-driven EDD in place.

Bulgaria’s removal takes away the FATF-based risk factor the FAU had flagged. On my reading, Bulgaria-linked clients return to ordinary risk scoring unless other factors in the entity’s assessment point higher. Our MONEYVAL Bulgaria follow-up analysis covers the evaluation history behind the exit. Bosnia and Herzegovina, Iraq, Kuwait and Papua New Guinea remain on FATF’s increased-monitoring list, so their FATF status remains a geographical risk factor.

From 10 July 2027: AMLR Articles 29 and 30 take over

The AMLR generally applies directly from 10 July 2027. Article 90 provides a later application date of 10 July 2029 for the football-related obliged entities specified in Article 3(3)(n) and (o). Under Article 29 the Commission identifies high-risk third countries with significant strategic deficiencies, and obliged entities apply the Article 34(4) enhanced due diligence measures to business relationships and occasional transactions involving natural or legal persons from them. Under Article 34(8), those measures are not invoked automatically for branches or subsidiaries of EU-established obliged entities located in such third countries where they fully comply with the group-wide policies, procedures and controls required under Article 17. Article 30 covers third countries with compliance weaknesses: the Commission takes information on jurisdictions under increased monitoring as a baseline, and its delegated act names the specific Article 34(4) measures.

My reading is that the current Czech split, where grey-list status is only a risk factor, belongs to the AML Act; under Article 30 a grey-listed third country can carry country-specific EDD set by Commission delegated act. Nationally, the proposed Act on the Economic Protection of the State (ZEOS) remains subject to the Czech legislative process. Its supervisory information-sharing provisions must be assessed against the final adopted text before being treated as operative requirements. Our Czech AML package guide to obliged entities and supervisors covers the draft legislation, and the EU AML package guide sets out the 10 July 2027 timetable.

Frequently Asked Questions

Why is Russia on the Czech list when it is on neither FATF list?

Delegated Regulation (EU) 2026/46 inserted Section IV into the Annex to Regulation 2016/1675 for countries outside FATF calls for action and increased monitoring whose FATF membership is suspended. The Russian Federation is its only entry. FAU’s general opinion of 31 August 2023 cites the Russian Federation as an example of the “another reason” limb and refers to a separate opinion of 16 March 2023. Because Russia now appears in Section IV of the EU Annex, FAU’s news notice of 6 May 2026 records that its opinion on how to treat Russia as a high-risk third country was withdrawn as redundant.

Does § 9a(2) apply when a client with no foreign link pays a counterparty in a listed country?

Point (b) attaches to a transaction connected with a high-risk third country, separately from point (a), which turns on the client’s country of origin. On my reading, a Czech-resident client paying a counterparty in Laos brings that payment within point (b), and § 9a(4) applies the same minimum measures.

If the Commission removes Monaco from the Annex, when does the mandatory EDD end?

An EU-listing trigger would cease on the application date of a delegated amendment removing Monaco from the Annex. However, § 9(1)(a)(3) also recognises high-risk status arising for another reason, so any separate Czech designation must be checked before statutory EDD controls are removed. The institution must also continue to apply EDD wherever its risk assessment or another applicable mandatory rule requires it. Existing relationships still pass through the entity’s § 21a risk assessment, and § 9a(1) applies wherever that shows increased risk.

Related Articles

• FATF October 2026 Plenary: Four Grey-List Exits, Black List Unchanged: the FATF decisions and their EU, UK and US effects.
• Czech AML Package: Who Is Obliged and Who Supervises From 2027: obliged entities and supervisors under the draft ZEOS.
• The EU AML Package: The Countdown to 10 July 2027: the AMLR, AMLD6 and AMLA timetable.
• MONEYVAL Bulgaria AML Follow-Up: The Correspondent Banking Read: Bulgaria’s MONEYVAL follow-up and correspondent banking reviews.

Key Takeaways

• Screening tables: keep Monaco, the DRC and Côte d’Ivoire flagged for § 9a(2) EDD and clear only their FATF field.
• Client-base re-screen: assess all four categories of country of origin under § 4(15), including self-employed persons and trusts. Institutions subject to CNB Decree No. 67/2018 Sb. must also assess the countries of origin of persons authorised to act for clients and of beneficial owners. Under § 9(3)(a) of that Decree, a qualifying high-risk-third-country connection requires a higher client risk profile and the associated enhanced due diligence under § 9(1).
• Bulgaria: remove the FATF grey-list factor from country-risk scoring. Bulgaria is not a high-risk third country under § 4(14), but EDD must still be applied where the entity’s § 21a assessment establishes increased risk, where the independent politically exposed person trigger in § 9a(2)(c) applies, or where another applicable mandatory requirement requires enhanced measures.
• Change triggers: monitor applicable Commission delegated amendments to Regulation (EU) 2016/1675 and Czech high-risk-third-country classifications arising for another reason under § 9(1)(a)(3), as shown on FAU’s published list and opinions page. A change in FATF status does not itself amend the EU Annex.

Sources and References

• CNB Decree No. 67/2018 Sb., as amended by Decree No. 403/2024, §§ 2, 9 and 11: CNB official consolidated text
• FAU, news notice of 5 November 2026 on the updated list: fau.gov.cz
• FAU, list of high-risk third countries under § 9(1)(a)(3) AML Act, 5 November 2026 (XLSX): fau.gov.cz
• FAU, previous version of the list (XLSX): fau.gov.cz
• FAU, international-agenda page on high-risk third countries: fau.gov.cz
• FAU, opinions page on high-risk third countries: fau.gov.cz
• FAU, news notice of 6 May 2026 on the updated list, recording the withdrawal of the Russia opinion: fau.gov.cz
• FAU, general opinion of 31 August 2023, ref. FAU-118942/2023/03 (PDF): fau.gov.cz
• FAU, “Prameny práva v oblasti AML/CFT od 10. 7. 2027” (17 September 2026, PDF): fau.gov.cz
• Act No. 253/2008 Sb. (AML Act), §§ 4, 6, 7, 9, 9a and 21a and Annex 2: e-Sbírka (official); consolidated text
• Commission Delegated Regulation (EU) 2016/1675, consolidated text of 29 January 2026: EUR-Lex
• Commission Delegated Regulation (EU) 2026/46 of 3 December 2025, inserting Section IV into the Annex to Delegated Regulation (EU) 2016/1675: EUR-Lex
• Directive (EU) 2015/849, Article 9: EUR-Lex
• Directive (EU) 2018/843, inserting Article 18a into Directive (EU) 2015/849: EUR-Lex
• Regulation (EU) 2024/1624 (AMLR), Articles 29, 30 and 34: EUR-Lex
• FATF, Outcomes FATF Plenary, 28-30 October 2026: fatf-gafi.org

Next change point for the Czech list

Load the FAU file of 5 November 2026, reconcile its country entries against the applicable EU Annex and any separate Czech high-risk designations, and re-run the client-base screen across all four country-of-origin categories. Repeat the screen when an applicable delegated amendment changes the EU Annex or when a Czech high-risk designation under the ‘other reason’ limb changes. Continue risk-based monitoring between formal changes to statutory high-risk-country classifications.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.