1. The Update

On 27 October 2025, HM Treasury (UK) released a revised Money Laundering Advisory Notice instructing all firms to apply Enhanced Due Diligence (EDD) whenever a customer, ownership entity, or transactional connection is established in a High-Risk Third Country, as defined by the latest FATF update. Source: gov.uk (HM Treasury)

This advisory reinforces that geography is no longer a simple attribute—it’s a risk driver that must be continuously updated.

2. Why This Matters for KYC & AML Teams

This notice has some deep implications:

• EDD now depends on establishment, not nationality — Even if the customer lives in London, if their business is incorporated in a high-risk jurisdiction, EDD is mandatory.
• Group structures matter — A parent company in a safe country doesn’t eliminate risk if a subsidiary is based in a high-risk jurisdiction.
• Firms must update their risk-scoring models — Many institutions treat country risk as static; this update makes it dynamic and enforceable.
• Regulators will check if firms updated their systems post-advisory — Geography risk failures will become audit red flags in 2026.

3. What KYC Analysts Should Do Immediately

Here’s what this advisory means on the ground:

✔ Refresh your High-Risk Country List Most banks rely on outdated lists. Update your internal geography risk matrix to align with the October 2025 changes.

✔ Re-evaluate “Country of Establishment” During onboarding, ensure you capture:

• Country of incorporation
• Country of operations
• Country of management control

EDD must trigger even if only one part of the structure sits in a high-risk country.

✔ Identify group-level exposure If any subsidiary, branch, or holding company is based in a FATF high-risk country, the whole customer relationship becomes higher risk.

✔ Conduct out-of-cycle reviews Revisit clients whose geography risk was determined before the advisory. Many medium-risk clients will now fall under mandatory EDD.

✔ Update your adverse media logic Search for mentions of high-risk jurisdictions in:

• Incorporation documents
• UBO structures
• Supply chain relationships
• Counterparties

Geography should be treated with the same seriousness as PEP or sanctions exposure.

4. What This Signals About Future AML Trends

This update is more than administrative it points to a clear global direction:

• Geography risk is no longer passive It must be tied to onboarding, monitoring, and periodic review.
• EDD will be triggered more frequently Even legitimate businesses with minor links to high-risk jurisdictions will face enhanced scrutiny.
• AML programs must include dynamic list-updating mechanisms Static spreadsheets or outdated vendor lists won’t pass future audits.
• Intermediary & ecosystem risk will become mainstream Customers may have clean documentation, but their advisers, partners, or subsidiaries might not.

5. Final Takeaway

For KYC desks, the message is simple:

Geography is no longer a “profile detail” — it’s a risk multiplier.

The right question now is:

“Is any part of this customer’s structure established in a high-risk country?”

If the answer is yes, EDD is not optional. Regulators will expect firms to demonstrate real-time geographic risk awareness, not outdated classifications or manual exceptions.

This update should change how onboarding teams, risk owners, and compliance officers approach corporate KYC, complex group structures, and cross-border risk.