AML/CFT Country lists update – Immediate Action Required

Published on: 01 July 2022

The Authority wishes to draw your attention to a number of amendments to the various country lists following the June 2022 FATF Plenary and the most recent publication of the FATF’s consolidated table of 4^th round assessment ratings. The country lists have been amended by the Cabinet Office and can be viewed on the DHA’s website.

If not already undertaken, regulated or supervised entities must carry out their own evaluation for any potential impact on their risk assessments and procedures arising from the changes. The Authority reminds regulated and supervised entities that paragraph 15(7) of the AML/CFT Code lists matters which may pose a higher risk of ML/FT and includes “a business relationship or occasional transaction with a customer resident or located in a jurisdiction in List B” (paragraph 15(7)(b)) and “activity in a jurisdiction in List A or B” (paragraph 15(7)(c)). Regulated or supervised entities must review the country lists and make any necessary changes to business and customer risk assessments.

In particular, the Authority would like to highlight that Gibraltar has been removed from List C (“Equivalent Jurisdiction list”) and placed on List B (“Jurisdictions that may pose a higher risk”) due to the FATF determining that they have not made sufficient progress on their action plan.

This means that, from the date of the list change, regulated or supervised entities can no longer use, or continue to rely on, simplified measures from the AML/CFT Code, such as the “Acceptable applicants” or “Eligible introducers” paragraphs, for new or existing customers or occasional transactions, where the “trusted person” or “external regulated person” is regulated or supervised in Gibraltar.

It is requested that where simplified measures have been utilised for business relationships/customers connected to Gibraltar, regulated or supervised entities should provide the Authority with the following details of those business relationships/customers:

the number of business relationships; and
which simplified measures were used (including a breakdown of the number of business relationships each simplified measure was used for).

Additionally, regulated and supervised persons should provide the Authority with details of the action they have taken, and confirm they have obtained full customer due diligence on effected business relationships/customers, or confirm that they have taken action commensurate with paragraphs 8(5), 11(7) and 15(8) of the AML/CFT Code if full CDD has not been obtained. These details should be provided to aml@iomfsa.im by the end 29^th July 2022.