On 30 June 2026 the UK cut its country trigger for enhanced due diligence from two FATF lists to one. Regulation 33(1)(b) now names only a "FATF call for action country": Iran, North Korea and Myanmar (Burma) after the October 2026 plenary, as FinCEN reported on 30 October. Until June it also covered FATF's increased monitoring list.
So a customer from a jurisdiction on that list alone is no longer high risk by UK law. Your firm can still rate it high in its own risk assessment, and regulation 33(1)(a) then applies enhanced due diligence on the firm's finding. That split between rule and firm runs through all the customers a compliance team onboards.
Who are high risk customers?
A high risk customer, or high risk client, is one a firm watches more closely than the rest of its book. The label has two sources. Rules name a few groups. Everything else comes out of the firm's own customer risk assessment, which weighs who the customer is, where it operates, what it buys and how it pays. UK regulation 33(1)(a) covers cases the firm itself identified as high risk, and India's Reserve Bank has banks sort customers into low, medium and high "based on its assessment and risk perception".
The same customer can therefore sit in different tiers at two firms. Picture an importer of used machinery that pays suppliers in cash: one bank weighs cash heavily and rates it high, another caps cash on its products and rates it medium. Both ratings hold if each bank can show the factors behind its own. A high risk bank account is the account of a customer rated high. At complead, formerly Sanction Scanner, every rating in the customer risk rating and KYC software carries a stamp of the model version behind it, so the file still shows why a customer sat in its tier after the model has moved on.
Which customers are high risk by rule?
UK regulation 33(1) requires enhanced measures for customers established in a FATF call for action country, correspondent relationships with banks and other financial institutions, PEPs with their family members and known close associates, customers who gave false or stolen identity documents and whom the firm keeps, and transactions that are unusually complex or unusually large for their nature. The Financial Action Task Force (FATF) sets the global PEP baseline in Recommendation 12: foreign PEPs always get enhanced measures, domestic ones when the relationship is higher risk.
US rules work differently. Banks identify every owner of 25 percent or more of most company customers (31 CFR 1010.230), update customer data on a risk basis and build each customer's risk profile themselves (31 CFR 1020.210).
Why does it matter to identify high risk accounts early?
Monzo shows what happens when a firm cannot say who its high risk customers are. In December 2017 the FCA's feedback letter found no provision for enhanced due diligence on high risk customers other than PEPs and customers with high risk third party links. From 5 August 2020, at the FCA's request, a voluntary requirement (VREQ) barred Monzo from accepting account applications from high risk customers. Because Monzo had no clear definition of its own, the VREQ spelled one out in 19 conditions.
The controls built to apply them leaked. Between 5 August 2020 and 30 June 2022, Monzo opened 33,039 accounts in breach of the requirement, 26,325 of them for high risk customers, according to the FCA's Final Notice of 7 July 2025. The causes it lists include applications already in progress when the requirement began, addresses the VREQ itself classed as high risk, devices already linked to at least two other customers, and business accounts opened without assessing industry risk. The penalty was £21,091,300.
Write your definition before the first account opens, and run it inside the onboarding flow. Money laundering through a new account can start with its first payment, while a label added at the first periodic review arrives months later.
What are the types of high risk customers?
Table 1. Eight types of high risk customer, the rule or factor behind each, and the evidence the file holds (as of November 2026)
| Type | Why the risk is higher | Rule or factor that names it | First extra check | Evidence on file |
|---|---|---|---|---|
| PEPs, family members and close associates | Public office can give access to public money and influence | UK reg 33(1)(d) and 35; FATF R12 for foreign PEPs | Senior management approval | Approver and date; source of wealth account |
| Customers linked to high risk countries | Weak AML regimes or a FATF call for action | UK reg 33(1)(b); the EU list of high risk third countries | Why the customer deals with the country | Country questionnaire; source of funds |
| Offshore account holders and non residents | Money held or managed far from the firm | FATF note to R10 (non resident customers) | Why the customer banks here | Address abroad; stated reason |
| Shell companies | Few or no operations, so the owner can stay hidden | Firm's assessment; UK reg 33(6)(a)(iii) | Register check and proof of trading | Register extract; evidence of activity |
| Complex ownership structures | Layers can hide who owns or controls | UK reg 33(6)(a)(iv) and (vi); FATF note to R10 | Chart to natural persons | Chart; every owner of 25% or more |
| Cash intensive and high risk businesses | Cash takings leave no payer on record | UK reg 33(6)(a)(v); FATF note to R10 | Source of cash takings | Takings set against declared turnover |
| Crypto users | Value moves fast between wallets and borders | Firm's assessment | Wallet exposure check | Wallet addresses and screening result |
| Correspondent banks | The firm carries payments for customers it never sees | UK reg 33(1)(c); FATF R13 | Respondent's AML controls | Due diligence on the respondent; approval |
In the UK three of these rows rest on a rule: PEPs, customers linked to a call for action country and correspondent banks. For the other five, a risk factor named by FATF or regulation 33(6) feeds the firm's own judgment. Product and channel count as well. FATF's examples of higher risk include private banking, anonymous transactions that may involve cash, relationships opened without meeting the customer where no risk mitigation is in place, and payments from unknown third parties.
Non resident customers appear in FATF's list of higher risk customer factors in the interpretive note to Recommendation 10, but no rule makes every one of them high risk. Cash intensive businesses sit on both the UK and the FATF factor lists, and takings in cash leave no payer behind them. Crypto users carry the risk of the wallets they deal with, so ask where their coins came from. If you are drawing up a list of high risk businesses, start from the sectors FATF brings under AML rules beyond banking: real estate agents, casinos, dealers in precious metals and stones, and virtual asset service providers among them.
What makes a corporate customer high risk?
Corporate customer risk sits in the structure. UK regulation 33(6)(a) lists a legal person used to hold personal assets, a company with nominee shareholders or bearer shares, and a corporate structure that is unusual or excessively complex for its business. The test is whether the chart ends in named people who own or control the company. Before the chart, confirm that the company exists and trades.
How do you identify a high risk customer?
Table 2. Eight signs of a high risk customer and the threshold a rule sets, where it sets one
| Sign | What it looks like in the file or account | Threshold a rule sets | Note |
|---|---|---|---|
| Cash kept just under the report line | Repeated deposits of, say, $9,900 | US: report above $10,000 (31 CFR 1010.311) | Splitting to avoid the report is structuring (1010.314) |
| Evasive answers on source of funds | Vague, changing or undocumented explanations | None; EDD asks for source of funds or wealth | Ask once in writing and keep the reply |
| Ownership that cannot be traced | Chart stops at a nominee, trust or foreign register | US: owners of 25% or more and one control person | Record where the chain stops |
| Link to a call for action country | Customer or transaction party established in Iran, North Korea or Myanmar | UK: enhanced due diligence by law (reg 33(1)(b)) | List as of 30 October 2026 |
| PEP match | Screening hit on the customer, an owner or a relative | UK and FATF: senior management approval | UK domestic PEPs start lower than foreign PEPs; EDD still applies |
| Unusually complex or large transactions | Payments with no clear purpose for this customer | UK reg 33(1)(f) | Judged given the nature of the transaction |
| False or stolen documents | Identity papers fail checks, yet the firm continues | UK reg 33(1)(e) | Applies when the firm keeps the customer |
| Shared address or device | One address or device behind several unrelated applicants | None in rules; the Monzo requirement covered listed addresses and shared devices | FCA Final Notice, 7 July 2025 |
Two signs need care. Repeated cash deposits just under the US reporting line of more than $10,000 (31 CFR 1010.311) point to structuring: splitting cash to dodge the report, which the rules prohibit whether or not the money is clean. The old shorthand "smurfing" fits only when several people make the deposits.
The second is shared data. Monzo's requirement treated an address on its list, or a device already used by at least two other customers, as a high risk marker. In a high risk account the same pattern shows up as repeated changes to address, phone number or listed directors with no business reason, and each change deserves an alert.
Four rows carry a UK rule by themselves: the call for action link, the PEP match, the unusual transaction and the false documents. The other four build a rating together. Record each with the date it appeared, so a reviewer can see when the picture changed.
What EDD steps does each type of high risk customer need?
Enhanced due diligence adds questions and evidence, chosen for the risk at hand, to the firm's standard KYC procedures. A high risk rating leads to more checks, not to an automatic refusal: a firm turns the customer away when the money or the ownership cannot be explained, and records why.
How does a risk based approach set the level of customer due diligence?
The rating sets the depth. Low risk customers get standard Customer Due Diligence (CDD) or, where the law allows it, simplified checks. Medium risk adds documents and closer monitoring. High risk adds enhanced due diligence: more evidence, a named approver and tighter monitoring. For PEPs the law names senior management as the approver, and UK law does the same for customers from a call for action country (regulation 33(3A)) and for correspondent banks (regulation 34). For other high risk customers FATF gives senior management approval only as one example of an enhanced measure, so your policy names the approver.
What extra checks do PEPs, their family and close associates need?
Picture a new private banking customer whose parent is a deputy minister abroad. Under UK regulation 35 and FATF Recommendation 12, the firm needs a senior manager to approve starting or continuing the relationship, enhanced ongoing monitoring, and both the source of funds and the source of wealth. The file holds the approver's name and date and a wealth account backed by documents. Domestic PEPs in the UK start from a lower level of risk than foreign PEPs, though enhanced due diligence still applies.
What extra checks do customers linked to high risk countries need?
Say a trading company buys rice from a supplier in Myanmar, where FATF calls for enhanced due diligence but not countermeasures. Ask what ties the customer to the country, why the trade runs through it and where the money for it comes from, then keep the answers in a country questionnaire. Grey list links are a judgment call. Check them against FATF's latest list before you rate the customer.
What extra checks do shell companies and complex ownership structures need?
Take a holding company owned through two other companies in two jurisdictions. The file needs a chart down to natural persons, each owner of 25 percent or more, one person with control, and the stated reason for the layers. The EU AML Regulation draws the same 25 percent line from 10 July 2027. Under FinCEN's order of 13 February 2026, US banks may limit owner checks to the first account, to times when facts cast doubt on the data and to what risk based procedures require; otherwise they can rely on the customer's confirmation, kept on record.
What extra checks do crypto users, cash intensive businesses and non residents need?
Suppose a customer sells crypto on an exchange. The proceeds go into a new account. The file then needs the wallet addresses and their exposure result. For a cash intensive business, the file holds takings records set against declared turnover. For a non resident, FATF's example measure fits: the first payment comes from the customer's own account at a bank that applies similar due diligence.
How do tools and technologies help detect high risk customers?
On complead, a customer's rating, screening and evidence sit on one engine:
- One score for each customer. Onboarding, screening, monitoring, fraud and investigation feed the same engine, so a customer carries a single score across all of them. In the customer risk assessment and KYC product your firm sets its own factors, weights and thresholds, and a change in behavior, exposure or screening results scores the customer again, on event or on schedule. Once the score reaches the level you chose, EDD starts automatically and the case lists the factors that took it there.
- Screening and a search record. Names go through client screening and ongoing monitoring, fed by 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. Whoever runs a search, the terms, the time and the outcome all stay on record, so a no match result is evidence too.
- Monitoring that follows the list. Your team starts or stops ongoing monitoring per name through API triggers, so names you have exited stop being screened.
- The network around a customer. The connections graph looks for a route to a sanctioned, PEP or adverse media entity across up to six hops by default, configurable, and keeps every hop as case evidence.
- Owners to the end of the chain. KYB and UBO verification follows parents, owners and controlling entities until natural persons are reached; layers it cannot close show as unresolved.
- Alerts with reasons. An alert lists its firing rule and each matched signal; the analyst decides whether the customer stays high risk, and the record shows who did.
How often should high risk customers be reviewed?
The interval depends on the rulebook. India sets fixed numbers: under the 2025 KYC Directions the RBI issued for commercial banks, a bank reviews risk categories at least every six months and updates KYC for high risk customers at least once every two years. In the EU, from 10 July 2027, the AML Regulation allows at most one year between updates for higher risk customers and five for the rest.
The UK and the US set no fixed interval. UK regulation 27(8) asks for reviews on a risk based approach and whenever circumstances relevant to the customer's risk assessment change, and US rules ask for updates on a risk basis. Your firm writes its own cycle into policy, with one interval for each KYC risk rating tier.
Which rules on high risk customers changed in 2026?
- 29 January. Russia joined the EU's list of high risk third countries under Delegated Regulation (EU) 2026/46.
- 13 February. FinCEN let US banks verify a company's owners at its first account instead of at every new one.
- 30 June. S.I. 2026/621 tied the UK's mandatory country checks to the FATF call for action list alone and rewrote the UK test for unusual transactions.
- 1 October. India's central bank issued an updated version of its 2025 KYC Directions for commercial banks.
- 30 October. FATF left Iran, North Korea and Myanmar on its call for action list and took Côte d'Ivoire, Monaco, Bulgaria and the Democratic Republic of the Congo off increased monitoring, leaving 18.
Take the customer from the first paragraph again, established in one of the 18 jurisdictions still under FATF's increased monitoring. Before 30 June a UK firm applied enhanced due diligence because regulation 33 covered FATF's increased monitoring list. Now the rating comes from your own risk assessment, and if it stays high, the file should name the factors that kept it there: the country link, the ownership, the source of funds, each with the date it was last checked.
Method and sources. Sinan Tekin, Regional Sales Manager, built this page on primary texts read on 9 November 2026: UK regulations 27, 33, 34 and 35 in their current text, with regulation 33 as amended by S.I. 2026/621, the FATF Recommendations in their October 2025 text, 31 CFR 1010.230, 1010.311, 1010.314 and 1020.210, FinCEN's order of 13 February 2026 and its notice of 30 October 2026, the FCA's Final Notice to Monzo, the RBI's 2025 KYC Directions, the EU AML Regulation and Delegated Regulation (EU) 2026/46. Fact checked by Ufuk Gürdaş, Compliance Specialist; reviewed on 10 November 2026.
