The European Commission has formally added Russia to the EU’s list of high-risk third countries with strategic deficiencies in anti-money laundering and counter-terrorist financing (AML/CFT). The designation, finalised in December 2025, marks one of the most consequential updates to the EU’s AML framework in recent years. It carries significant implications for financial institutions, regulated professional service firms, and compliance teams across all Member States.
Once the designated scrutiny period by the European Parliament and the Council concludes, the listing becomes directly applicable across the EU. From that point, firms must apply mandatory Enhanced Due Diligence (EDD) measures for any customers, transactions, beneficial owners, or counterparties with Russian links.
The decision represents a major shift in the global AML regulatory landscape—particularly notable because neither the Financial Action Task Force (FATF) nor the United Kingdom has issued an equivalent designation. For multinational groups and cross-border institutions, this divergence introduces a new layer of operational and regulatory complexity.
VinciWorks have released an updated guide to all high risk jurisdictions which now includes Russia. Download the updated guide here.
Why has the EU listed Russia now?
The listing stems from commitments made under Delegated Regulation (EU) 2025/1393, which entered into force in July 2025. The Regulation requires the European Commission to proactively assess countries whose FATF membership has been suspended, regardless of whether FATF has chosen to place them on its grey or black lists.
Russia has been suspended from FATF since 2022, following its invasion of Ukraine. The suspension triggered an obligation for the European Commission to conduct a comprehensive review of Russia’s AML/CFT regime and determine whether the jurisdiction poses systemic risks to the EU financial system.
The European Commission carried out its assessment of Russia under the EU’s established AML/CFT identification methodology, which treats FATF lists as a starting point and explicitly uses Member-State inputs, EEAS/Europol information and public-source material as part of a multi-factor, transparent process. The Commission’s approach to prioritising jurisdictions also includes pre-assessment steps that identify countries for closer analysis on the basis of their systemic impact on the EU financial system and information from EU external-action and law-enforcement partners.
Following that methodology, and based on a technical review reflected in Commission communications and recent reporting, the Commission concluded that Russia meets the criteria for a jurisdiction with strategic AML/CFT deficiencies. Press coverage of the delegated act further indicates that the assessment drew on inputs from Member State authorities, the EEAS, and a range of public-source material. Russia’s suspension from FATF in 2022 provides additional context for that review, as the Commission’s exercise explicitly covers countries whose FATF membership has been suspended.
These findings align with increasing concerns among Member States that Russia is employing illicit finance channels to mitigate the impact of EU sanctions and support geopolitical objectives. AMLA Chair Bruna Szego recently reinforced this view, describing Russia as “at the heart of global organised crime”, with the Kremlin’s financial networks expanding in scope and sophistication.
A significant regulatory divergence
The EU’s listing of Russia creates a significant gap between EU requirements and those applied by FATF and the UK.
EU position
- Russia is designated a High-Risk Third Country.
- EDD is mandatory for all Russia-linked activities.
- Obligations apply across all AML-regulated sectors, including financial institutions, law firms, auditors, accountants, real-estate professionals, and trust and company service providers.
FATF position
- Russia is not included on FATF’s grey or black lists.
- FATF has taken no action equivalent to a “high-risk” designation.
UK position
- The UK continues to mirror FATF’s listings.
- Russia is not listed as a high-risk jurisdiction under the UK’s Money Laundering Regulations.
This divergence matters because multinational firms must now choose between applying EU-level standards across their entire organisation or adopting jurisdiction-specific controls that apply higher requirements only within EU operations. For many organisations, aligning upwards to the EU standard will be the most straightforward and risk-consistent approach.
What the listing means in practice
The listing has immediate operational implications. EU-regulated firms must review and update their AML frameworks to ensure alignment with the new requirements.
Country risk assessments
Firms must update their jurisdiction risk assessments to reflect Russia’s new designation as a high-risk third country. This will affect:
- risk matrices and scoring models,
- client and counterparty onboarding processes,
- supplier and third-party risk classifications
- any automated systems using country-risk data feeds
Compliance teams should document the rationale for all updates within their firm-wide AML business risk assessment.
Enhanced Due Diligence requirements
Mandatory EDD now applies to:
- Russian customers (individuals or entities)
- beneficial owners with Russian nationality or residency
- counterparties or intermediaries with direct or indirect Russian links
- transactions involving funds or structures connected to Russia
EDD measures typically include:
- obtaining additional information on source of funds and source of wealth,
- enhanced scrutiny of ownership structures,
- senior management approval for onboarding or continuing the business relationship
- more frequent and detailed monitoring of customer activity
- independent verification of documents where reliability may be compromised.
Given Russia’s prevalence in offshore structuring, firms should confirm their systems can identify multi-layered ownership arrangements, including those involving jurisdictions with secrecy laws.
KYC and onboarding controls
Onboarding workflows will need to be updated to ensure:
- Russian involvement triggers automatic EDD escalation
- screening tools correctly identify Russia-linked beneficial owners
- staff are trained to identify indirect Russian connections, such as intermediaries acting on behalf of Russian principals.
Firms should validate that digital onboarding tools and KYC vendors have incorporated the updated EU list.
Transaction monitoring
Transaction monitoring frameworks should be reviewed to reflect Russia-specific typologies. Areas of focus may include:
- unusual or circular trade-finance routes,
- payments involving high-risk intermediaries in third countries
- use of complex asset-transfer structures to avoid sanctions
- transactions inconsistent with the customer’s expected behaviour or stated business activities.
Regulated firms may also need to introduce new monitoring rules targeting known sanctions-evasion patterns.
Internal communication and reporting
Clear, timely internal communication is essential. Compliance teams should ensure that:
- frontline, onboarding, and operations teams receive updated guidance
- risk and legal teams understand the regulatory rationale
- senior management and Board committees are briefed through established governance channels.
Documenting these updates will be important for supervisory reviews and regulatory engagement.
Governance and risk appetite
The designation may require firms to revisit their risk appetite, particularly regarding:
- onboarding new Russia-linked clients
- maintaining existing relationships
- exposure to Russia-linked third parties or supply chains.
Senior management approval and Board-level oversight may be necessary where the firm’s exposure is material or where a shift in risk appetite is required.
Why this matters
The Commission’s decision reflects a broader evolution in global AML policy: the growing integration of geopolitics, sanctions enforcement, and state-enabled criminal activity into financial-crime risk assessments. The EU has signalled that a jurisdiction’s geopolitical behaviour—and its response to international sanctions—may be as relevant to AML risk as its legal or supervisory framework.
Commissioner Maria Luís Albuquerque summarised the EU’s position directly:
“Following our detailed assessment, we are now taking the necessary steps to add Russia to our list of high-risk jurisdictions. This demonstrates our firm determination to safeguard the integrity of the EU financial system.”
For firms, Russia now functions as a high-risk AML/CFT jurisdiction within the EU framework. This requires enhanced scrutiny, increased documentation, and stronger oversight across all relevant business lines.
Next steps for firms
Regulated entities should now:
- Update AML policies, procedures, and jurisdiction-risk models
- Apply mandatory EDD for all Russia-linked relationships and transactions
- Review onboarding and monitoring controls for Russia-specific typologies
- Ensure sanctions and AML frameworks are aligned
- Update firm-wide AML business risk assessments
- Brief senior management, risk committees, and Board committees as appropriate
- Document all decisions, updates, and risk assessments for regulatory scrutiny
