Only Bulgaria exits high-risk set as FATF delists four

Reporting entities under the anti-money-laundering framework must update their country risk lists: the Financial Action Task Force (FATF) revised its list of listed high-risk countriesFinanstilsynet with effect from 30 October 2026Finanstilsynet, and Finanstilsynet announced the change for Norwegian rapporteringspliktige, who must know the countries carrying higher money-laundering and terrorist-financing risk. FATF removed Bulgaria, Elfenbenskysten, Den demokratiske republikken Kongo and Monaco from its listFinanstilsynet.

Only one of the four leaves the listed set. Two lists operate side by side: the EU list of high-risk third countries applies in Norway through hvitvaskingsforskriften § 4-10Revisorforeningen, while countries listed by FATF also count as high-risk according to FinanstilsynetRevisorforeningen. The June 2026 overview of listed countries still carries Elfenbenskysten, Den demokratiske republikken Kongo and Monaco on the EU list, with Bulgaria appearing only on the FATF listRevisorforeningen. The established practice for such cases is that countries removed from the FATF list but still on the EU list must still be treated as high-risk countriesRevisorforeningen — so only Bulgaria exits, while the other three keep their high-risk status.

For relationships and transactions involving listed states, hvitvaskingsforskriften § 4-10 requires minimum enhanced customer measures as a floor: additional information on the customer and beneficial owners, on the purpose and intended nature of the relationship or transaction, on the origin of funds and on the background of the transaction, plus enhanced ongoing monitoring, more numerous and broader controls, enhanced transaction monitoring, and management approval when the relationship is established or comes under the provisionLovdata. Finanstilsynet applies the same duty where the customer is established in, or has beneficial owners in, a high-risk country, and also where the customer has a large share of its business in such a country or large or frequent transactions go to or from it. Geographic risk moments beyond listed status sit in § 4-9, including countries identified as lacking satisfactory measures against money laundering and terrorist financing.

Supervisors may in addition issue single decisions on business with listed-state ties, including bans on establishing subsidiaries, branches or representative offices and orders to change or wind down correspondent relations, and customer measures performed by a third party established in a listed state cannot be relied upon. Geographic risk is covered in rundskriv 4/2022, the guide to the hvitvaskingsloven, and the current overview of listed countries sits on the geographic-risk theme page. The operative duties sit in hvitvaskingsforskriften § 4-9 on high-risk indicators and § 4-10 on special measures for listed high-risk states.