GLOSSARY: 4AMLD Directive (EU) 2015/849 – the 4th Anti-Money Laundering Directive 5 AMLD Directive (EU) 2018/843 – the 5th Anti-Money Laundering Directive AML/CFT Anti-money laundering and counter-terrorist financing AWF SOC Europol’s Analysis Work File on Serious and Organised Crime Basel AML Index Basel Anti-Money Laundering (AML) Index developed by the Basel Institute on Governance BO Beneficial Owner CDD Customer Due Diligence CTC The European Council’s Counter-terrorist Coordinator DNFBP Designated Non-Financial Business or Profession EDD Enhanced Due Diligence EEA European Economic Area EEAS The European External Action Service EGMLTF Expert Group on Anti-Money Laundering and Countering Terrorist Financing ESA European Supervisory Authority, namely: the European Banking Authority (EBA) the European Securities and Markets Authority (ESMA) the European Insurance and Occupational Pensions Authority (EIOPA) FATF Financial Action Task Force Financial Secrecy Index The Financial Secrecy Index developed by the Tax Justice Network FIU Financial Intelligence Unit FSAP Financial Sector Assessment Program jointly developed by the IMF and the World Bank FSRB Financial Action Task Force-Style Regional Body ICRG The FATF’s International Cooperation Review Group IMF The International Monetary Fund MER Mutual Evaluation Report by the FATF/FSRBs ML/TF Money laundering and terrorist financing OECD The Organisation for Economic Cooperation and Development SOCTA Europol’s Serious Organised Crime Threat Assessment TE-SAT Europol’s EU terrorism situation and trend report TEU Treaty on the European Union TFEU Treaty on the Functioning of the European Union TFS Targeted Financial Sanctions TI Index The Corruption Perception Index developed by Transparency International





Table of Contents 1 Objectives and scope 1.1Objectives 1.2Scope 2 Roles and Responsibilities 2.1Role of the Commission and its services 2.2Role of the Expert Group on Anti-Money Laundering and Countering Terrorist Financing (EGMLTF) 2.3Role of the European Parliament and Council 3 Methodological approach for identifying high-risk third countries 3.1Countries publicly identified by the Financial Action Task Force (FATF) 3.1.1 Consequences of a listing by the FATF 3.1.2 Consequences of a delisting by the FATF 3.1.3 Synergies between the EU autonomous assessment and the FATF listing process 3.1.4 Approach with regard to third countries within the EU scope that were reviewed but not listed by FATF 3.2Countries assessed autonomously by the EU 4 Process description for the EU autonomous assessment 4.1Step 1 - Scoping phase 4.2Step 2 - Definition of priorities 4.3Step 3 - Assessment phase

4.3.1 Risk profile and level of threat (“Country profile”) 4.3.2 Criteria to be considered for the assessment (vulnerability of the AML/CFT regime considering the level of deficiencies) 4.3.3 Level of deficiencies and threshold for being considered as having strategic deficiencies 4.3.4 Availability of information sources 4.4Step 4 – Engagement with third countries prior to the conclusion of the Commission’s assessment 4.4.1 Fact-finding and information of preliminary findings by the Commission 4.4.2 Definition of mitigating measures and high-level political commitment 4.5Step 5 – Reaching conclusion for listing a third country 4.5.1 Countries not expressing a high-level political commitment (“non-cooperative jurisdictions”) 4.5.2 Countries representing an overriding level of risk 4.5.3 Countries expressing a high level political commitment to address serious concerns 4.5.4 Emergency situations 4.6Step 6 - Adoption of Delegated act 4.7Step 7: Review of the assessment of the Priority 1 third countries 4.8Step 8: Assessment– Follow up of countries listed under step 6 (high-risk third countries) 4.8.1 Follow up of high risk third countries 4.8.2 Delisting criteria 5 Consultation during the decision-making process 5.1Consultation of Member States experts 5.2Reporting to the European Parliament and Council

5.3Handling of information 6 Provision of technical assistance 7 Timing and planning of the adoption of delegated acts 7.1Overall planning 7.2Delegated act following a FATF listing 7.3Delegated act not following a FATF listing 7.4Frequency of updating the list 8 Consequences of the EU listing Annexes



Executive Summary Under the Anti-Money Laundering Directive (AMLD), the Commission has a legal obligation to identify high-risk third countries having strategic deficiencies in their regime on anti-money laundering and countering terrorist financing. The objective of the EU list of high-risk third countries is to protect the Union internal market, through application of enhanced due diligence measures by obliged entities. Listing of countries will be used as a last resort. The Commission aims to have a dialogue with the countries subject to listing, in view of helping to ensure that the jurisdictions concerned remove identified deficiencies before an eventual listing. Countries subject to listing, as well as listed countries will be encouraged to rapidly remove their identified strategic deficiencies and the Commission is committed to support them where appropriate. The Commission is ready to specifically explore supporting third countries to assist them in rapidly addressing the identified strategic deficiencies. In such situations, technical assistance will be focused in areas presenting strategic deficiencies in those listed countries. The Commission will take steps to ensure that there are no undue consequences in relation to financial inclusion and activities related to non-profit organisations (NPO) in this exercise. The Commission has developed a methodology for identifying high-risk third countries published in June 2018 in order to ensure a fair and transparent process vis-a-vis the third countries. This methodology has been refined to include more clarity. Hence, this document supersedes and replaces the Staff Working Document of June 2018. The main elements of the methodology are: (i) The interaction between the EU and the Financial Action Task Force (FATF) Third countries listed by the FATF will, in principle, also be listed by the EU. For countries de-listed by the FATF, the Commission services will assess whether the FATF Action Plans for a delisting are sufficiently comprehensive also in view of an EU delisting. Where necessary, specific EU requirements will “top up” the existing FATF Action Plan, by referring to additional EU specific criteria, for example the level of threat that the third country presents to the EU or requirements on beneficial ownership transparency. Third countries that may present a risk and are not (yet) subject to the FATF procedure should be flagged by the Commission/Member States in the FATF before considering an autonomous listing by the EU.

(ii) Autonomous assessment by the EU The criteria used for assessing third countries’ AML-CFT regimes are defined in Article 9 of AMLD. In this context, the Commission services will assess the level of threat and the vulnerability of the country’s AML/CFT regime. The AML/CFT regime of a third country will be assessed according to the following eight building blocks: 1) criminalisation of money laundering and terrorist financing; 2) measures relating to customer due diligence, record keeping and reporting of suspicious transactions in the financial sector; 3) the same measures in the non-financial sector; 4) the powers and procedures of competent authorities; 5) the existence of dissuasive, proportionate and effective sanctions; 6) the practice of competent authorities in international cooperation; 7) the availability and exchange of information on beneficial ownership of legal persons and legal arrangements; 8) implementation of targeted financial sanctions. When carrying out such assessments, the Commission will consider the legal and institutional AML/CFT framework, as well as the effectiveness in applying those AML/CFT measures. For the purpose of this exercise, a staged approach will be undertaken. The Commission services will carry out the following steps: 1) consulting the countries on preliminary findings of the Commission; 2) drafting country-specific “EU benchmarks” to address each country’s concerns (identified on a preliminary basis) in relation to the criteria set by the Anti-Money Laundering Directive; 3) seeking third countries’ commitment to implementing those country-specific “EU benchmarks”. A deadline of 12 months would be given to third countries to address concerns. A listing would only occur if the country does not implement in full the benchmarks / commitments. In addition, in case countries are not cooperative (i.e. refusing to undertake commitments) or countries fail to implement the agreed benchmarks within the agreed period, the Commission would proceed with a listing. Similarly, in case there is “an overriding level of risk” that needs to be mitigated while there is no ability for the country to implement EU benchmarks, the Commission would also reserve the possibility to proceed immediately with formally identifying strategic deficiencies on the basis of the Anti-Money Laundering Directive and thus with listing the country. Finally, an emergency procedure is provided in case the Commission needs to urgently take mitigating measures in exceptional circumstances. (iii) Consultation of Member States experts and reporting Member State experts will be consulted at every stage of the process regarding the assessments of third countries’ regime, the definition of mitigating measures, third countries' implementation of “EU Benchmarks” and the preparation of the Delegated Regulation. This consultation will include specific Member States competent authorities (law enforcement, intelligence services, Financial Intelligence Units). Similarly, the Commission will keep the European Parliament and the Council informed on the progress in applying the present methodology and the preparation of delegated acts. The Commission is committed to ensure appropriate reporting to the European Parliament and the Council. Both the European Parliament and the Council will have access to all relevant information at the different stages of procedures, subject to appropriate handling requirements.

1Objectives and scope According to Article 9 of Directive (EU) 2015/849 (4th Anti-Money Laundering Directive), the Commission shall identify third country jurisdictions which have strategic deficiencies in their anti-money laundering and countering financing of terrorism (AML/CFT) regimes (“high risk third countries”) through the adoption of delegated acts. The 4th Anti-Money Laundering Directive - as amended by Directive (EU) 2018/843 (the 5th Anti-Money Laundering Directive) - establishes the scope and the legal requirements to be fulfilled and which are applied in this methodology (see Annex 1 on the Directive's provisions). 1.1Objectives This document supersedes and replaces the Staff Working Document of June 2018.The purpose of this document is to present a methodological approach for identifying high-risk third countries. This identification will contribute to understanding, managing and mitigating the risks associated with money laundering and terrorist financing in the EU, thus protecting the proper functioning of the Union's financial system and of the internal market from money laundering and terrorist financing risks. It will complement and reinforce international efforts in dealing with high-risk countries and put further pressure on them to correct their strategic deficiencies. Finally, it will support EU efforts to promote a global approach towards high-risk third countries. The methodology also aims at establishing a mechanism based on evidence and facts in line with general Union law. It is built upon an engagement approach aiming at involving closely third countries in order to improve measures to fight against money laundering and terrorist financing. As outlined in the Action plan for strengthening the fight against terrorist financing, the Commission is committed to assisting third countries and to exploring the provision of technical assistance to support implementation of EU requirements, Financial Action Task Force (FATF) recommendations and relevant United Nations Security Council Resolutions. 1.2Scope This methodology is applicable to any third-country jurisdiction. This definition of "third-country jurisdiction" covers overseas countries and territories listed in Annex II to the Treaty of the Functioning of the EU, which have their own legal system and jurisprudence which is separate from the legal order in force in a Member State. This definition also covers third countries which have concluded Monetary Agreements with the EU. This methodology does not apply to EU Member States. It does also not apply to countries which are subject to the requirements of Directive (EU) 2015/849 through the agreement on the European Economic Area countries of 3 January 1994. Alternative procedures are used to ensure that the interpretation and application of the Union law ensuring the integrity and proper functioning of the internal market is observed, both for Member States of the EU and the European Economic Area. Through this methodology, only third countries having strategic deficiencies in their national AML/CFT regimes and posing significant threats to the financial system of the Union will be identified. Such identification does not exempt in any way obliged entities from the obligation to fulfil their customer due diligence requirements when conducting business relationships or carrying out occasional transactions with third countries other than those which are identified as being "high risk third countries" under Article 9 of 4th Anti-Money Laundering Directive. 2Roles and Responsibilities

1. 2.1Role of the Commission and its services Following the mandate given by Article 9 of the Anti-Money Laundering Directive, the Commission is empowered to adopt delegated acts in accordance with Article 64 of that Directive. The general requirements for the preparation and adoption of delegated acts apply to this process. Hence, the Commission is responsible for the definition of the methodology and the preparatory analysis. The Commission is responsible for the adoption of the delegated act and has ultimate responsibility over the process under the terms of the empowerment given by the legislator. 2.2Role of the Expert Group on Anti-Money Laundering and Countering Terrorist Financing (EGMLTF) The Expert Group on Anti-Money Laundering and Countering Terrorist Financing (EGMLTF) advises the Commission on Anti-Money Laundering and Terrorist Financing issues, which includes the task of assisting the Commission services in the preparation of delegated acts. The Commission services will involve the EGMLTF in the preparatory work carried out under this methodology. Full transparency with Member States will be ensured by involving the EGMLTF throughout the process of identifying high-risk third countries. In particular, the EGMLTF will be consulted and, where appropriate, requested to provide input in relation to: 1) establishing, implementing and reviewing the methodology for the identification of high-risk third countries (including providing feedback on Commission services' analyses), and 2) adopting the delegated regulations identifying high-risk third countries. When the EGMLTF is consulted on these matters, the European External Action Service (EEAS) will be invited to attend the meetings as observer and will receive copies of any relevant document sent to the EGMLTF. Beyond the formal consultation of the EGMLTF, EGMLTF members may provide contributions to the Commission services on an ad-hoc basis in the context of the assessment of a specific third country, where their resources and expertise allow. In this regard, Member States may share their experience on financial/commercial/economic flows as well as international cooperation with third countries related to criminal and/or money laundering and terrorism financing (ML/TF) activities. 2.3Role of the European Parliament and Council The European Parliament and Council empower the Commission to adopt delegated acts and can revoke this empowerment. As foreseen under the Common Understanding on Delegated Acts, the Commission will keep the European Parliament and the Council informed of the preparation of a delegated act. This includes the progress concerning the preparatory stages covered by this methodology. The designated contact points in the European Parliament and Council will receive copies of any document sent to the EGMLTF. The transmitted information will be subject to applicable handling restrictions (see section 5.3). The European Parliament and the Council may ask for feedback from the Commission and a further exchange of views on the preparation of delegated acts and on the progress in implementing this methodology.



3Methodological approach for identifying high-risk third countries The methodology for identifying "high-risk third countries" lays down two main ways which could lead to a country's identification as a "high-risk third country": (1) countries publicly identified by the FATF and (2) countries assessed autonomously by the EU. 2.

3.1Countries publicly identified by the Financial Action Task Force (FATF) 3.1.1Consequences of a listing by the FATF Considering the high level of integration of the international financial system, the close connection of market operators, the high volume of cross border transactions to or from the Union, as well as the high degree of market opening, the Commission considers in principle that any AML/CFT threat posed to the international financial system also represents a threat to the Union financial system. In this context, any third country representing a risk to the international financial system, as identified by the FATF, is presumed to represent a risk to the EU internal market. This concerns any country publicly identified in the FATF documents "Public Statement" and the "Improving Global AML/CFT Compliance: On-going Process" or in any future similar FATF document having the same purpose. It should be stressed that both the Commission and 14 Member States are members of the FATF and are actively involved in the assessment by the FATF of countries presenting strategic deficiencies – having access to relevant information sources. Hence, this approach reinforces international efforts in dealing with high-risk countries and puts further pressure on countries to correct their strategic deficiencies. It also supports EU efforts to promote a global approach towards high-risk countries. In line with the provisions of the Treaty on the European Union (TEU) and the Treaty on the Functioning of the European Union (TFEU), the Commission shall aim to foster coordination with EU Member States in the FATF in order to ensure coherence of external representation of EU policies in this regard. The Commission endorsed the Ministerial Declaration of the FATF as well as the revised FATF Mandate on 12 April 2019 on behalf of the European Union. Listings by the FATF follow a due process based on clear criteria. The basis for the review process is information on threats, vulnerabilities, or particular risks arising from a country. This information may be derived from mutual evaluation reports, from FATF members, or from the fact that the country is not participating in the work of any of the FATF-Style Regional Bodies (FSRB) and consequently not committing to implementing the FATF standards. A jurisdiction that enters the ICRG review process as a result of its mutual evaluation results has a one-year Observation Period to work with the FATF or its FATF-style regional body (FSRB) to address deficiencies before possible public identification and formal review by the FATF. The FATF then prioritises the review of those countries with more significant financial sectors – e.g. USD 5 billion or more in financial sector assets. During the review process, the FATF determines the most serious AML/CFT weaknesses (‘strategic AML/CFT deficiencies’) for each country and develops an action plan with the country to address these deficiencies. The FATF also requests a high-level political commitment that the country will implement the legal, regulatory, and operational reforms required by the action plan. Each jurisdiction under review has the opportunity to participate in a face-to-face meeting to discuss the findings with the competent joint group reporting to the International Cooperation Review Group (ICRG). On the basis of the results of its reviews, the FATF publishes two statements at each Plenary meeting which reflect the seriousness of the risks posed by the country – and the level of political commitment to address them. Similarly, the removal from the FATF statements follows a due process to ensure that a country has substantially addressed all the components of this action plan and that implementation is underway and sustained in the future. Overall, this process shows that the FATF lists constitute a valid baseline for the EU list since the FATF criteria, their weighing and the specific thresholds for being listed permit identification of countries presenting very material and profound strategic deficiencies. In conducting its autonomous assessment, the Commission services will analyse available information from the FATF and, where appropriate, other sources of information (including consultation of EGMLTF) before concluding that a country listed by FATF shall be added to the EU list on high risk third countries. If the Commission services' analysis confirms the assessment of the FATF, it will be concluded that there are justified grounds to consider that the FATF listed countries are "high-risk third countries" for the purpose of article 9 of 4th Anti-Money Laundering Directive. In such cases, the Commission services will not carry out a further assessment based on the review of other information sources as described under section 4. The listing decision is justified since the country has strategic deficiencies in its AML/CFT regime that pose a threat to the international financial system – and consequently to the EU. The Commission will immediately initiate the necessary steps in order to achieve inclusion of such countries on the EU list of high risk third countries. The EGMLTF will be consulted prior to the adoption of the delegated act. It may be consulted at short notice via written procedure for a period of 2 working days with regard to proposals to list/delist third countries following FATF decisions. This approach would be followed in respect of any third country listed by the FATF, thereby ensuring that the EU further promotes international efforts in fighting money laundering and terrorist financing. With respect to candidate countries, the Commission services, in their assessment, may consider mitigating measures included in the accession negotiations that address the identified strategic deficiencies. The Commission will inform jurisdictions entering the ICRG review at the beginning of the Observation Period (or as early as possible if they are already within that period) that a listing by FATF would also lead to a listing by the EU. This will include information about the legal impact of the EU listing (in particular the consequences as per the Financial Regulation and the EFSD Regulation). 3.1.2Consequences of a delisting by the FATF

In order to ensure transparency towards third countries, the Commission will communicate to third countries at an early stage which measures are necessary to address their strategic deficiencies. In order to ensure equal treatment between countries in a similar position, the Commission will review the extent to which third countries may have a systemic impact on the integrity of the EU financial system. Hence the question whether the third country is inside or outside the scope of the EU assessment (as described in point 4.1. Step 1 - Scoping phase) has to be considered. As part of the EU autonomous assessment process, the Commission will identify first of all which countries are particularly relevant to the financial system of the Union in line with the risk-based approach. This first step is referred to as ‘scoping phase’ (see section 4.1 below). As regards the delisting by the EU of countries which were included in the FATF list, the following two scenarios could take place, depending on whether such countries had been identified as relevant to the financial system of the Union (i.e., are part of the ‘EU scope’). Scenario 1: Third country delisted by the FATF and falling outside the EU scope according to the methodology A country may be listed by the FATF and thus by the EU (see 3.1.1. above), but not included in the initial scoping by the Commission services (as described in point 4.1. Step 1 - Scoping phase). Once the country is not considered by the FATF as presenting strategic deficiencies that pose a risk to the international financial system anymore (i.e., once the country is delisted by the FATF), there is no longer a basis to consider that this country presents a risk to the EU financial system. In this situation, the Commission services will review available information from the FATF and if confirmed, the country will be de-listed from the EU list through the adoption of a delegated act. Consequently, the country would be removed from the EU list without the need for additional verification on other elements not covered by the FATF action plan. Similarly, there is no need for extra requirements to be fulfilled on top of the completion of the FATF Action Plan. Scenario 2: Third country delisted by the FATF and falling within the EU scope according to the methodology Countries listed by the FATF (and thus by the EU - see 3.1.1. above), and also included in the EU scope will be subject to the EU delisting requirements (see 4.8.2. – Delisting criteria). In such a case, once the country is delisted by the FATF, the country will be retained on the EU list until it has been established that this country meets the EU criteria for removal. Since the country was initially identified as presenting strategic deficiencies in its AML/CFT regime that pose a risk to the international financial system, the Commission services will check whether the country has corrected the deficiencies in order to ensure that it no longer poses a risk to the EU financial system. In order to ensure equal treatment between third countries in a similar situation (i.e. part of the EU scoping), any country presenting strategic deficiencies should be able to demonstrate that it fulfils the EU criteria before being de-listed. Since those EU delisting requirements are different from the FATF ones, the Commission services will assess in an early stage whether the Action Plans agreed with the FATF are sufficiently comprehensive in view of the EU delisting. To this end, for countries listed by the FATF and included in the EU scope, the Commission will focus its efforts in participating in the development of the Action Plan within the FATF. Accordingly, the Commission will reinforce its engagement in the FATF to monitor the progress made by listed countries towards increasing the level of effectiveness of their AML/CFT regimes. Once the FATF Action Plan is approved, the Commission services will assess whether it is sufficiently comprehensive in view of the EU delisting criteria and specific EU requirements, in particular on ensuring transparency of beneficial ownership information. Only when this is not the case, further mitigating measures ("EU Benchmarks") would be developed to “top-up” the existing FATF Action Plan (see 4.8.1. Exit criteria). This requirement will apply only in justified cases where the FATF Action Plan cannot be deemed sufficient in view of the EU delisting criteria. When preparing the "top-up" EU Benchmarks, the Commission will consult the EGMLTF. The Commission would ensure appropriate engagement with third countries in that case, by informing them about the “top-up” EU Benchmarks at the moment the country is listed by the EU. This would allow the third country to implement the “top-up” EU benchmarks, if any, in parallel with the FATF Action Plan. With regard to countries already listed by the FATF, the Commission will review whether the existing action plans are sufficiently comprehensive and, where necessary, inform third countries regarding the need for "top up" EU Benchmarks. The following graph illustrates the workflow for determining requirements FATF listed countries should fulfil in order to address their strategic deficiencies. Third Country NOT in the EU scope Third Country WITHIN the EU scope

NO YES Implementation of the FATF Action Plan Implementation of the FATF Action Plan YES NO Implementation of the “Top-up” EU benchmarks 3.1.3Synergies between the EU autonomous assessment and the FATF listing process The Commission will work towards increased synergies between the EU listing process and the FATF International Cooperation and Review Group (ICRG) process. There are cases of third countries within the scope of the EU’s assessment that are subject to the FATF ICRG process but that are not listed by the FATF, either because they are still in the so-called Observation Period (scenario 3) or because they do not meet the prioritisation criteria for ICRG review (scenario 4). Scenario 3: Third country is within the EU scope and is in the “FATF Observation Period” Countries that are in the FATF Observation Period (i) have been relatively recently assessed by the FATF and (ii) will be reviewed at the end of such Observation Period by the FATF to assess whether positive and tangible progress has been achieved in addressing deficiencies - or whether a listing and the related imposition of an Action Plan is required. In such cases, the Commission will apply the procedure applicable for the EU autonomous assessment and the engagement with the concerned third countries will follow the general rules for the EU autonomous assessment (see below, point 3.2. The EU autonomous assessment of countries posing significant threats to the Union’s financial system). The Commission will engage with third countries as soon as a FATF/FSRB mutual evaluation report about them, that gives reason for concern, is published. As under the procedure applicable to the EU autonomous assessment, the Commission services – in collaboration with the EEAS – would engage with the third country in order to discuss preliminary findings where concerns in the country’s AML/CFT regime have been found. If after this exchange there are grounds for concerns, the Commission would communicate the EU Benchmarks to the concerned third country and seek to receive from the third country concerned a high-level political commitment in order to implement them. The EU benchmark would be communicated as early as possible, and in principle no later than the beginning of the ICRG Observation Period. In this way, the third country would know at an early stage (i.e., at the start of the FATF Observation Period) what is considered as necessary to avoid listing by the EU and would have a chance to address the relevant deficiencies during its FATF Observation Period alongside with the deficiencies that it needs to address to avoid listing by the FATF. When drafting the EU Benchmarks, the Commission would also take into account priority and recommended actions in the country’s FATF/FSRB mutual evaluation report. In particular, the Commission would assess whether these priority and recommended actions cover all concerns identified by the Commission. If they are not comprehensive, "top up" EU Benchmarks may already be indicated. The Commission, with a view to avoiding duplication of the work already done within the FATF, would participate in the assessment of the third country at the end of the Observation Period, as well as in the possible development of the FATF Action Plan. This approach would promote international efforts, foster consistency with the review carried out under the ICRG process and, at the same time, it would ensure that third countries focus their attention on priority measures. Such synergies between the FATF and the EU process will be facilitated by the fact that the timing of the FATF ICRG Observation Period – and the EU observation period for implementing EU Benchmarks will coincide in terms of duration (i.e., 12 months period – as described below under point 4.4.2). These synergies should also alleviate possible concerns about capacity constraints that some third countries may have. In that context, the Commission will not conclude its assessment for the implementation of the EU Benchmarks before the FATF listing review is concluded (i.e., not before the Plenary meeting concludes whether a country shall implement an Action Plan to address its strategic deficiencies), unless exceptional situations apply as provided in this methodology. At the end of the FATF Observation Period, there are two possible outcomes:

(i) The third country is listed by the FATF because the progress achieved during the Observation Period is not sufficient. In this case, the country would also be listed by the EU. The Commission would need to assess whether the Action Plan that the country agrees with the FATF is sufficiently comprehensive or whether “top-up” EU Benchmarks are needed (see above “scenario 2”). Possible “top-up” EU Benchmarks would be established according to the latest available information provided during the observation period. Subsequently the Commission services will assess the completion of any possible “top-up” EU benchmark in parallel to the FATF monitoring of progress. (ii) The third country is not listed by the FATF at the end of the Observation Period. In this case, the procedure for to the EU autonomous assessment applies (see below 3.2), and the Commission would assess whether the third country addressed the EU benchmarks and whether the reforms or other efforts have had a tangible and positive impact on the country’s effectiveness, allowing the Commission to conclude that there are no strategic deficiencies that threaten the financial system of the Union. If the EU Benchmarks are not implemented to a sufficient extent and positive and tangible progress is not ensured, the Commission would conclude on the existence of strategic deficiencies, inform the third country accordingly and include the jurisdiction on the EU list of countries having strategic deficiencies. The Commission will aim at limiting such cases of "top up" EU Benchmarks to exceptional situations where the concerns expressed by the Commission could not be taken into account by the FATF Action Plans. The Commission will apply transitional arrangements with regard to countries, which are already in FATF Observation period and where this observation period is already advanced. In such cases, the FATF observation period will end before the standard 12 months to be granted by the Commission. Countries in that situation will be informed as soon as possible regarding the need to apply EU benchmarks, if necessary. Since the FATF observation period would soon be concluded, countries in that situation will be handled in a similar way as countries listed by the FATF which are in the EU scope (see scenario 2) in case they are listed by the FATF. Scenario 4: Third Country is within the EU scope and meets the ICRG referral criteria but not the ICRG’s prioritisation criteria In those situations, third countries do meet the ICRG referral criteria, but FATF only prioritises the review of those countries with more significant financial sectors – e.g. USD 5 billion or more in financial sector assets. Countries which do not meet the prioritisation criteria are therefore placed in a “pool”. This means that for these countries, there is no current ICRG review and subsequent possible FATF listing in the near future. The Commission will then apply the procedure applicable for the EU autonomous review, while seeking synergies with the ICRG process. In particular, the Commission and the Member States represented in the FATF should aim first at ensuring that the FATF gives sufficient attention to the risk factors of a given third country in the pool to ensure prioritisation of its review. Therefore, the Commission, together with the Member States represented in the FATF, should foster synergies with the FATF ICRG review and promote, as far as possible, a timely review in FATF in line with the EU priority setting. As a consequence, third countries in this situation would ultimately either be subject to a listing review by FATF (in which case Scenario 2 applies), or be subject to an autonomous assessment review made by the Commission (see below, point 3.2.).

3.1.4Approach with regard to third countries within the EU scope that were reviewed but not listed by FATF There are cases in which a third country is within the EU scope, was reviewed by an international organisation competent in the AML/CFT field and the results of its mutual evaluation report do not meet the referral criteria for applying the ICRG procedure (i.e. there is no ongoing or future listing review to be made by the FATF). In such event, the Commission services will assess the third countries’ regime by applying the procedure for the EU autonomous assessment. This is necessary since some third countries may still have strategic deficiencies that pose a significant threat to the EU financial system. 3.2Countries assessed autonomously by the EU As explained above, the FATF lists constitute the baseline for the EU list and this methodology builds on the listing process followed by FATF. At the same time, as the threats to the financial system of the Union are more specifically defined than those to the global financial system, the Commission must also conduct an autonomous assessment of third countries' AML/CFT regime. The assessment draws on all relevant information enabling the Commission to reach its conclusions. The Commission services will follow a staged approach in carrying out this analysis. -At a first stage, the Commission services will determine the countries to be assessed, and identify the level of priority for the assessment of those countries. This “scoping phase” will allow the Commission to focus its efforts where these are most needed. -At a second stage, the Commission services will assess these third countries’ AML/CFT regime, starting with countries of the highest priority. -At a third stage, the Commission services will carry out their assessment for the remaining countries gradually and over time when new information sources become available. In addition, the Commission services will also follow up on countries already listed and re-assess countries once new information becomes available.

The assessment criteria will be based on the criteria listed in Article 9 of the 4th Anti-Money Laundering Directive which provides for a non-exhaustive list of criteria to be considered. The Commission shall identify high-risk third countries presenting strategic deficiencies, in particular taking into account those listed in the 4th Anti-Money Laundering Directive in relation to: (a) the legal and institutional AML/CFT framework of the third country, in particular: (i) the criminalisation of money laundering and terrorist financing; (ii) measures relating to customer due diligence; (iii) requirements relating to record-keeping; (iv) requirements to report suspicious transactions; (v) the availability of accurate and timely information of the beneficial ownership of legal persons and arrangements to competent authorities; (b) the powers and procedures of the third country's competent authorities for the purposes of combating money laundering and terrorist financing including appropriately dissuasive, proportionate and effective sanctions, as well as the third country's practice in cooperation and exchange of information with Member States' competent authorities; (c) the effectiveness of the AML/CFT system in addressing money laundering or terrorist financing risks of the third country.” This assessment will be carried based on the following workflow that is further described in section 4.



Initial review Workflow overview Country added on the EU list of high risk third countries 1 or more Benchmarks not implemented after 12 months High level political commitment taken within 1 month Non cooperative jurisdictions Overriding level of risks ALL Benchmarks effectively implemented after 12 months

No listing COM sharing updated preliminary findings Finalising of assessment Serious concerns Third country comments within 1 month No serious concerns COM sharing draft preliminary findings Bilateral dialogues if minor/non-strategic issues persist Review of progress after 12 months

4Process description for the EU autonomous assessment

This description applies to countries assessed autonomously by the EU (section 3.2). The process includes several steps such as the scoping phase, the definition of priorities, the assessment, the engagement with third countries prior to the conclusions of the Commission’s assessment, the conclusion to list a third country and the adoption of a delegated act, the monitoring of priority 1 countries, and the follow up of the countries listed by the EU. 3. 4.1Step 1 - Scoping phase This step aims at identifying countries which, if they were found to have strategic AML/CFT deficiencies, would have a systemic impact on the integrity of the EU financial system and the proper functioning of the internal market. This phase will result in a list of third countries that are particularly relevant to the financial system of the Union in line with the risk-based approach. Inclusion of a jurisdiction in the scoping list only means that the Commission services will assess that jurisdiction further and does not in any way prejudge the final outcome of the assessment. In particular, inclusion in the scoping list cannot, in any way, be taken as an a priori indication of deficiencies in that country. The scoping will cover the following countries: → Countries identified by the Commission services, the EEAS or Europol as having a systemic impact on the integrity of the EU financial system due to the level of threat. The analysis from the Commission services, the EEAS or Europol will identify those third countries which present a significant level of threat from a money laundering and terrorist financing perspective (e.g. exposure to Money laundering/Terrorist financing, exposure to predicate offences, volume of money flows). This input will be based on the findings coming, among other, from the Serious Organised Crime Threat Assessment (SOCTA) methodology which includes outcomes of detailed analysis of information gathered as part of the largest data collection on serious and organised crime. It will also, as applicable, include the elements stemming from the Analysis Work File on Serious and Organised Crime (AWF SOC) which provides a thorough and extensive analysis of the criminal threats facing the European Union. Other sources of information will come i.a. from the EU terrorism situation and trend report (TE-SAT) methodology with information supplied by EU Member States, some third-countries and partner organisations of Eurojust, as well as information gained from open sources. It includes in particular qualitative and quantitative data on terrorist offences in the EU, data on arrests of people suspected of involvement on those offences, provided or confirmed by Member States. When available, it includes information on offences in which EU interests were affected outside the EU. → International offshore financial centres. The Commission will include in its scope jurisdictions included in the amended list used by the OECD (2019) of International Financial Centres (IFCs) based on the IMF offshore financial centre (OFC) definition. → Economic relevance considering the magnitude of the financial centres and the strength of economic ties with the EU. The Commission will use statistical indicators used for the Scoreboard prepared in the context of the Common EU list of non-cooperative jurisdictions for tax purposes and other relevant sources, including: -Strength of economic ties with the EU: To see how strong the economic ties are between the third country and the EU, indicators such as trade data, affiliates controlled by EU residents and bilateral FDI stocks are examined. -Financial activity: To determine if a jurisdiction had a disproportionately high level of financial services exports, or a disconnection between their financial activity and the real economy, indicators such as total FDI stocks compared to GDP, specific financial income flows (royalties, dividends, interests) compared to GDP and statistics on foreign EU affiliates are used. -Development level: to determine if a jurisdiction is identified as a least developed country by the UN. The Commission will use the same methodology as for the Scoreboard in order to identify countries having strong economic ties with the EU and a material financial sector. The least developed countries (LDC) identified by the United Nations are not selected in recognition of the particular constraints they face ("Third Country Jurisdictions that are listed by the United Nations as Least Developed Countries") unless those LDC are identified as presenting a threat for the EU financial system (criteria 1 above) – or are identified as an offshore financial centre (criteria 2 above). The scoping will remain an ongoing exercise. At any time, the Commission may extend the scope to cover an additional third country as a result of the submission of new information presenting this third country as relevant for the analysis (e.g. update from the Commisison services, the EEAS or Europol). In such event, the list of countries included in the scope would be updated. Similarly the scope can be reduced in case new information indicates that a country does not meet anymore any of the above mentioned criteria. The methodological approach described for countries publicly identified by the FATF, as detailed above under 3.1., remains applicable regardless of whether a third country falls or not within the list of countries identified during the scoping phase. In fact, any third country representing a risk to the international financial system, as identified by the FATF, is presumed to represent a risk to the EU internal market. 4.2Step 2 - Definition of priorities The objective of this step is to determine the level of priority for the assessment of the countries identified in the scoping phase. ·Priority 1 countries The Commission services will consider as "high priority" (priority 1) the countries which: -are identified by Europol/EEAS as being exposed to money laundering or terrorist financing threats considering ML/TF risk factors, having a systemic impact on the integrity of the EU financial system,

-are listed in Annex I of the EU list of non-cooperative jurisdictions for tax purposes adopted by the Council of the EU as of 13 February 2019. In order to take into account future updates of the list of non-cooperative jurisdictions for tax purposes, countries that will be added to the Annex I of the Council Conclusions, will be subject to an accelerated review in the future. -are still listed in Regulation (EU) 2016/1675 while they have been de-listed by the FATF between 14 July 2016 and 19 October 2019, -have been subject to Mutual evaluation processes against the FATF recommendations issued in 2012 carried out by FATF / a Financial Style Regional Body (FSRB) – where the evaluation report is finalised by June 2018 and the country has been identified by Europol as having a systemic impact on the integrity of the EU financial system. Third countries which fulfil these criteria will be assessed as a matter of priority ("Priority 1"). Other third countries will be considered as "Priority 2" countries (to be assessed at a later stage). In case FATF is reviewing a “Priority 1 country” as part of the FATF listing process, the Commission will apply the procedure applicable for countries publicly identified by FATF and ensure appropriate synergies with the FATF listing process (see 3.1.3 Synergies between the EU autonomous assessment and the FATF listing process). The Commission will take appropriate steps to inform third countries which are subject to a forthcoming review. The list of countries subject to a review will be published on the Commission's website. The Commission services and the EEAS will formally inform each concerned third country when the Commission starts its work of reviewing the third country’s AML/CFT regime. The third country will also be informed about the possibility of requesting technical assistance to address possible concerns with its AML/CFT regime. This is without prejudice to the "emergency procedure" as laid down under point 4.4. (see p. 19). • Priority 2 countries Countries which are included in the scope but do not fulfil the criteria to be considered as “high priority”, as detailed above, are “Priority 2” countries. Priority 2 third countries will be subject to an assessment by the Commission when relevant information sources become available. Since mutual evaluation reports against the FATF recommendations issued in 2012 will become available for all countries by 2023-2025, all countries would be reviewed gradually by end 2025. The planning of future reviews will depend on various elements such as review of risk factors, availability of new information and high threats identified by Europol / EEAS and information provided by Member States. The Commission will prioritise the review of jurisdictions added to "Annex I" of the EU list of non-cooperative jurisdictions for tax purposes. Hence it will review as a matter of priority third countries which fail to meet their commitments taken towards the Code of Conduct – and consequently added on "Annex I" in the future, as well as new jurisdictions added to the Annex I. This approach is justified by the fact that those jurisdictions are potentially attractive for tax crimes and exposed potentially to a higher threat of money laundering linked to tax crime as a predicate offence. The "emergency" procedure remains available, as required, throughout this stage. 4.3Step 3 - Assessment phase For each country identified during the scoping phase above as being able to pose a significant threat to the Union’s financial system, the Commission services will prepare a comprehensive assessment analysing 1) the risk profile and level of threat; 2) the vulnerability of the country’s AML/CFT regime considering the level of deficiencies; 3) a conclusion on the risk assessment. The Commission will ensure that the institutional stakeholders are involved at each step in order to reach a joint ownership and a mutual understanding of the assessment. The Commission will make its assessment based on various information sources (a non-exhaustive list of information sources is presented in Annex 3). 4.3.1Risk profile and level of threat (“Country profile”) For each assessed country, the Commission services will prepare a country profile describing threats and risks. Pursuant to Article 9(1) of Directive (EU) 2015/849, this assessment aims at identifying the threat exposure emanating from third-country jurisdictions from a EU perspective, in a view to ensure the protection of the proper functioning of the Union financial system and the internal market from money laundering and terrorist financing risks posed by these countries. The country profile will provide an overview of political, social and economic information, as well as threat assessment based on law enforcement information. In order to identify the specific security threat to the Union, this information will include an assessment of the security situation in the third country and its possible impact on the EU, which may be impacted by several factors (e.g., economic ties with the Union, geographical situation vis-à-vis the Union, security risks for the Union, information on inward and outward illicit financial flows).

Preventing the use of the financial system for the purposes of money laundering and terrorist financing is an essential element of addressing this security threat. Thus, the threat assessment will also examine the level of threat – deriving from the third country – for the Union financial system being misused for the purposes of money laundering and terrorist financing. In this context, several factors may be considered, such as the level of predicate offences in the third country, the terrorism threat, the threat of money laundering/terrorist financing, the relevance of the country as country of origin/transit/destination of money laundering / terrorist financing, the level of organised crime and the nexus between the criminals and terrorist groups. This assessment will draw upon a number of information sources: information received from Commission services, the EEAS and Europol; information received from Member States competent authorities (e.g. Law Enforcement Agencies, Financial Intelligence Units, Intelligence Services) following consultations on threat assessment; publicly available information including relevant international rating (e.g. Basel AML Index, TI Corruption Perceptions Index, Financial Secrecy Index, and FATF public Mutual evaluation reports). 4.3.2Criteria to be considered for the assessment (vulnerability of the AML/CFT regime considering the level of deficiencies) For each country, the Commission services will aim at defining the level of vulnerability of the third countries' regime on AML/CFT. The criteria set in Article 9 of Directive (EU) 2015/849 (as described under point 3.2) are the basis for the assessment. The AML/CFT regime of a third country will be assessed by the Commission services according to eight building blocks. The assessment will cover both the legal framework and the effectiveness of the AML/CFT regime of the third country in addressing money laundering and terrorist financing risks for each of these eight building blocks. When assessing compliance or effectiveness, the Commission will take into account risk, materiality, and structural or contextual factors (such as the threat assessment from an EU perspective) in line with international best practices. Hence, the assessment will take into account the level of exposure to criminal activity or terrorist threat as identified by Europol/EEAS/the Commission. When assessing the eight building blocks, the Commission will take into account international standards on anti-money laundering and terrorist financing, notably the International Standards on combatting money laundering and the financing of terrorism from the Financial Action Task Force ("the FATF Recommendations"), the FATF Methodology, FATF guidance as well as best practices identified by FATF. Hence, the Commission services will use as a point of reference those information sources issued by the FATF when determining the level of deficiencies for each building block. Since the FATF is the global standard-setter on anti-money laundering and terrorist financing, it is expected that third countries comply with those internationally agreed standards. The 8 building blocks that will be assessed are the following:



1. Criminalisation of money laundering and terrorist financing: Countries should criminalise money laundering and terrorist financing on the basis of the relevant international instruments (e.g. Vienna Convention, Palermo Convention, Terrorist Financing Conventions). Countries should apply the crime of money laundering to all serious offences with a view to include the widest range of predicate offences. Countries should ensure effective investigation, prosecution, conviction and confiscation relating to money laundering or terrorist financing crimes. 2. Measures relating to customer due diligence, record-keeping and reporting of suspicious transactions by financial institutions: Financial institutions should be prohibited from keeping anonymous accounts or accounts in fictitious names. Financial institutions should be required to apply customer due diligence measures when establishing a business relationship or when carrying out financial transactions. These measures should include the identification of the customer and the beneficial owner (in particular in case of legal persons and legal arrangements). Financial institutions should also be required to conduct ongoing monitoring of the business relationship and scrutiny of transactions undertaken throughout the course of that relationship. Financial institutions should be required to maintain all necessary records on transactions. If a financial institution suspects or has reasonable grounds to suspect that funds are the proceeds of a criminal activity, or are related to terrorist financing, it should be required by law to report promptly its suspicions to the Financial Intelligence Unit (FIU) as part of the preventative measures. 3. Measures relating to customer due diligence, record-keeping and reporting of suspicious transactions by Designated Non-Financial Business and Professions (DNFBPs):

When they are in charge of the management of bank, savings or securities accounts on behalf of and for their clients, DNFBPs should be prohibited from keeping anonymous accounts or accounts in fictitious names. DNFBPs should be required to undertake customer due diligence requirements in conducting their business relationship or carrying out financial transactions. These measures should include the identification of the customer and the beneficial owner (in particular in case of legal persons and legal arrangements). DNFBPs should also be required to conduct ongoing monitoring of the business relationship and scrutiny of transactions undertaken throughout the course of that relationship. DNFBPs should be required to maintain all necessary records on transactions. If a DNFBP suspects or has reasonable grounds to suspect that funds are the proceeds of a criminal activity, or are related to terrorist financing, it should be required by law to report promptly its suspicions to the Financial Intelligence Unit (FIU) as part of the preventative measures. 4. Powers and procedures of the third country's competent authorities for the purposes of combating money laundering and terrorist financing: Competent authorities should have adequate powers, capacity and responsibilities for the purposes of combating money laundering and terrorist financing. It includes powers of competent authorities in regulating and supervising financial institutions, in regulating and supervising DNFBPs, in carrying out financial analysis, in carrying out operational and law enforcement tasks (including financial intelligence units, law enforcement and investigative authorities and authorities in charge of identification, tracing and confiscation of assets). In particular, countries should ensure that an effective supervision of the above-mentioned obligations towards financial institutions and DNFBPs is in place. 5. Existence of dissuasive, proportionate and effective sanctions: Countries should ensure that there is a range of effective, proportionate and dissuasive sanctions, whether criminal, civil or administrative, available to deal with natural or legal persons that fail to comply with AML/CFT requirements. 6. Third country's practice in cooperation and exchange of information with Member States' competent authorities: Countries should ensure that their competent authorities can rapidly and constructively provide the widest range of international cooperation in relation to money laundering, associated predicate offences and terrorist financing. 7. Availability of accurate and timely information of the beneficial ownership of legal persons and arrangements to competent authorities: Countries should ensure that information on beneficial owners of legal persons and legal arrangements are available, up to date and accurate. This information on beneficial ownership should be accessible to competent authorities which should be able to exchange this information with their international counterparts. Availability of accurate and timely information of the beneficial ownership of legal persons and arrangements to competent authorities shall be ensured in line with the relevant FATF requirements on Beneficial Ownership transparency as well as the G20 high-level principles on transparency of beneficial ownership. 8. Implementation of targeted financial sanctions (TFS) related to terrorism and terrorist financing: Countries should implement targeted financial sanctions regimes to comply with their obligations under United Nations Security Council resolutions relating to the prevention and suppression of terrorism and terrorist financing (i.e. UNSCR 1267(1299) and its successor resolutions and UNSCR 1373(2001)). 4.3.3Level of deficiencies and threshold for being considered as having strategic deficiencies Following this analysis, the Commission services will assess 1) the level of threats from an EU perspective as well as 2) the level of deficiency, if any, in the different building blocks. Both such factors will determine the risk level for a given third country. Since the level of threat represents an EU specific assessment, this level of threat may differ from the threat level considered by international organisations. Therefore, the risk level is determined taking into account the Union's perspective and EU needs in terms of risk management. This EU level of risk may differ from international organisations having a different assessment considering risk, context and materiality - or a different risk appetite from international organisations in applying mitigating measures. The Commission will ensure that the institutional stakeholders are involved at each step in order to reach a joint ownership and a mutual understanding of the assessment.

Each building block will be subject to an analysis in order to assess whether the control framework is adequate to address the money laundering and terrorist financing risks. The level of adequacy will be assessed taking into account the risk profile of the country. This risk profile takes into account political, social and economic information, as well as threat assessment based on law enforcement information (e.g. the level of predicate offences, the terrorist threat, the threat of money laundering/terrorist financing, the relevance of the country as country of origin/transit/destination of money laundering/terrorist financing). The analysis of the adequacy of the control framework will consider both technical compliance with the expected requirements as well as the effectiveness in applying those requirements. Following this analysis, the "level of deficiency" for each building block will be assessed according to the following scale of deficiency: 1) Low significance level of deficiency: there is a robust control framework in place meeting the requirements which is commensurate to address the identified threat 2) Moderately significant level of deficiency: there are moderate deficiencies in the control framework to address the identified threat 3) Significant level of deficiency: there are significant deficiencies in the control framework to address the identified threat 4) Very significant level of deficiency: there are very significant deficiencies in the control framework to address the identified threat The assessment for each building block will consider both the conformity of adopted legislation and its effective implementation in practice to assess whether it is appropriate considering the level of threat. On the basis of this analysis, the Commission services will make an overall assessment of the level of deficiency of the third country concerned. Level of deficiency Scale of deficiency Description low Low significance level The country presents a robust overall AML/CFT control framework or minor deficiencies. medium Moderately significant level The country presents moderately to significant deficiencies in its AML/CFT regime high Very significant level The country presents major deficiencies in its AML/CFT regime If a country presents major deficiencies (very significant level of deficiencies), the Commission will initiate the appropriate steps in order to engage with third countries which may ultimately lead to the identification of strategic deficiencies as defined under Article 9 of the 4th Anti-Money Laundering Directive. For countries presenting, overall, moderate to significant deficiencies (moderately significant level of deficiencies), the Commission services will consider the country's risk profile to conclude whether it will initiate the appropriate steps in order to engage with third countries which may ultimately lead to the identification of strategic deficiencies as defined under Article 9 of the 4th Anti-Money Laundering Directive 4.3.4Availability of information sources

The Commission services will consider reliable information sources (e.g. FATF, FSRB, Egmont Group Support and Compliance Process, EEAS/Europol, open source, complaints, etc.) in making this assessment – as illustrated in Annex 3. The Commission services will consider in particular information obtained from mutual evaluation reports, follow-up reports and other reliable sources of information as provided for in Article 9(4) of 4th Anti-money Laundering Directive (i.e. desk-based review of existing analysis). Hence, the assessment will use the most recent available information – ideally evaluations against the FATF Recommendations as adopted in 2012 ("new evaluation round") carried out by international organisations and standard setters with competence in this field. The Commission will use available information to assess whether the information contained in these MERs are still up to date. When there is no Mutual Evaluation Report (MER) or equivalent report or where the third country does not participate in a FSRB, the third country will be presumed as raising serious concerns, due to serious uncertainty regarding the compliance with AML/CFT standards. In effect, non-participation in FATF or in an FSRB indicates a lack of political commitment to comply with the AML/CFT international standards. In addition, this third country would therefore also not be subject to a mutual evaluation and a detailed follow-up process that could trigger appropriate escalation mechanisms. The lack of a mutual evaluation process creates a situation where there is no public information on the AML/CFT regime available, potentially enabling the country concerned to escape assessment efforts by the EU – therefore enabling those countries not to be on a par with countries accepting such evaluation process. Specific engagement will be carried out with countries in this situation. In case where the third country has been subject to the 3rd round of mutual evaluation process only, the same assessment as the one applied for those which have been already subject to 4th round of MER process will be carried out. However, it should be noted that assessing a country based on a 3rd round MER has some limitations: those reports are based on the old FATF standards which set lower requirements; they do not assess the effectiveness of the AML/CFT regimes; they may be outdated. Therefore the Commission will aim at reviewing additional information sources with regard to the effective application of AML/CFT measures. In particular, the Commission will consider information received from Europol to assess whether the country still represents a high level of ML/TF threat leading to uncertainty on its compliance with AML/CFT standards. When consulted by the Commission, Europol should pay particular attention to the terrorist financing risk emanating from those jurisdictions. It should consider in particular geographical risk factors described in the FATF report on terrorist financing risk indicators (Annex 2). 4.4Step 4 – Engagement with third countries prior to the conclusion of the Commission’s assessment Engagement with third countries aims at encouraging them to effectively address concerns identified on a preliminary basis in order to avoid being listed by the EU. In order to reach this goal, the Commission services – working closely with the EEAS - will in a coordinated manner engage with third countries in order to carry out a fact-finding exercise and to discuss the Commission's preliminary assessment where it identifies concerns in the AML/CFT regime of these countries (see 4.4.1). Where serious concerns still exist after this exchange, the Commission will identify, in coordination with the third country concerned, the necessary mitigating measures on the basis of the listing criteria (“EU Benchmarks”) and seek a commitment of the third country to implement the EU Benchmarks within a 12-months period. (see 4.4.2.). Listing should only occur in case (1) the third country is uncooperative (i.e. lack of commitments), (2) the third country does not implement all EU Benchmarks within the agreed time-frame, or (3) there is an overriding level of risk to the integrity of the financial system of the Union, so to justify immediate steps in view of including the jurisdiction on the list of countries having strategic deficiencies (see 4.5.). As a general rule, any Delegated Regulation adopted by the Commission will state the grounds for the decision and publicly identify strategic deficiencies leading to the third countries inclusion on the EU list of high risk third countries. A workflow overview is presented in Annex 4.



4.4.1Fact-finding and information of preliminary findings by the Commission The Commission will start its review by analysing the third country's AML/CFT regime based on various information sources. Following its initial review, the Commission services and EEAS will share formally the comprehensive draft preliminary findings with each concerned third country where areas of concerns are identified. As from this transmission, the concerned third country will have a period of 4 weeks to submit their comments to the Commission together with supporting documents and evidence to demonstrate effectiveness, where relevant. This early engagement with third countries will help to ensure that preliminary findings of the Commission are based on complete information on the concerned AML/CFT regimes and give the third country the possibility to respond to such concerns. In addition, the concerned third countries will be clearly informed about the legal consequences of a possible listing, stemming both from the AML Directive and from the Financial Regulation (and other relevant legislation, such as the EFSD Regulation) as regards the implementation of the EU’s external financial instruments and budgetary guarantees. Countries will also be informed about the possibility of requesting technical assistance to address possible deficiencies. Following this exchange, a meeting can be organised with jurisdictions expressing such wish, or when the information submitted requests further clarifications. In case of need identified by the Commission services, an on-site visit may be organised in agreement with the concerned jurisdictions and in coordination with the EEAS, in order for the Commission to collect further information regarding the effectiveness of the AML/CFT regime. Following this exchange, the Commission will review information submitted by third countries and update its preliminary findings. The Commission, in coordination with the EEAS, will submit the updated preliminary findings to the concerned jurisdiction, aiming at sharing formally this document within 9 weeks, i.e. after having received the necessary information from third countries and input from the EGMLTF. This deadline may be extended depending of the amount of information to be analysed, in which case it will be communicated to the third country.

Based on this review, the updated preliminary findings may indicate: - that the concerns raised initially are solved, or that the deficiencies are considered minor and non-strategic in nature. In such event, the Commission will conclude its assessment and consider that the country does not have strategic deficiencies in its AML/CFT regime at this stage. Countries are still encouraged to address remaining deficiencies, which are considered minor and non-strategic. Further dialogue may take place as part of the existing dialogue between the Union and third countries concerned; or - that serious concerns are still present with regard to the AML/CFT regime. In this event, those concerns will generally be considered as sufficiently serious to require the adoption of mitigating measures. Typically, a country which presents “major” concerns will be considered as requiring the preparation of EU Benchmarks which, if not implemented, would lead the Commission to conclude that the country has "strategic deficiencies" as defined under Article 9 of the Anti-Money Laundering Directive (see above). For countries presenting, overall, “moderate to significant” deficiencies (medium level of deficiencies), the Commission services will consider the country's risk profile to conclude whether it is required to prepare EU Benchmarks which, if not implemented, would lead the Commission to conclude that the country has "strategic deficiencies". The Commission will engage with third countries in order to explain the country specific preliminary deficiencies – as well as proposed mitigating measures (EU Benchmarks) in order to address those preliminary deficiencies. Therefore, countries will know in advance the preliminary deficiencies and will be consulted on the best appropriate means in order to address them. 4.4.2Definition of mitigating measures and high-level political commitment ·Drafting of EU Benchmarks Following the consultation process, the Commission may still identify serious concerns. In such event, the Commission will prepare a series of proposed mitigating measures that, once implemented, would address the identified concerns. The Commission will hear the third country concerned and then autonomously establish the necessary mitigating measures (EU Benchmarks). Like for international organisations active in the AML/CFT field, the Commission will aim at identifying specific measures in order to most effectively mitigate the risks the country faces, considering the circumstances and context of the country. The EU Benchmarks will take into consideration the delisting criteria defined in this methodology (see 4.8.2. “Delisting criteria”). When drafting the Benchmarks, the Commission will take into account existing recommended actions issued by international organisations competent in the AML/CFT field (if any). This will ensure that third countries focus their attention on priority measures, promote international efforts and (where applicable) ensure consistency with the review to be carried out by the International Review Group (ICRG). At the same time, in justified cases where further actions are needed to address the EU concerns, the Commission may propose additional EU Benchmarks. The Commission, in coordination with the EEAS, will formally share with the concerned jurisdiction: 1) its updated preliminary findings stating the areas/issues of concern; 2) proposed EU Benchmarks. Third countries shall send their comments on the proposed EU Benchmarks, if any, within 4 weeks. On the basis of the comments received, the Commission may then adjust the EU Benchmarks before receiving the third country's high-level political commitment to implement them. ·Receipt of high-level political commitments Once finalised, the country shall express in writing a "high level political commitment" to implement the EU Benchmarks as proposed by the Commission within a period of 12 months. This observation period will be calculated as from the end of the deadline given by the Commission to the country concerned for expressing the high level political commitment. The high level political commitment will need to be expressed by a senior representative of the competent State authority . After the receipt of the high-level political commitment, the Commission will, in coordination with the EEAS, share formally with the third country concerned the final EU Benchmarks also indicating the deadline to implement those EU Benchmarks, as well as an indication as to the listing that would follow if the country would fail in addressing the EU Benchmarks. It will also include information regarding a point of contact and how to report to the Commission on the EU Benchmarks' implementation by the end of the observation period. Third countries shall send their high-level political commitment to implement the EU Benchmarks within 4 weeks after being informed by the Commission. Where a third country agrees with the EU to implement the EU Benchmarks, the Commission will apply the procedure set under 4.5.3 (i.e. granting of an observation period). 4.5Step 5 – Reaching conclusion for listing a third country 4.5.1Countries not expressing a high-level political commitment (“non-cooperative jurisdictions”) When a country does not express a high-level political commitment to implement all the Benchmarks, the Commission will have sufficient reasons to immediately finalise its assessment and in principle conclude on the existence of strategic deficiencies. This would essentially be based on the fact that no further developments are expected for addressing the specific concerns identified within the timeframe set by the Commission, or that there is a lack of political willingness to implement measures within the given timeframe. In such event, the Commission will initiate the appropriate steps to include the jurisdiction on the list of countries having strategic deficiencies in line with the deadline set in Article 9 of Directive (EU) 2015/849. The same applies in case third countries express a commitment to only partially implement certain EU Benchmarks or alter unilaterally the substance of the necessary mitigating measures to address the serious concerns identified by the Commission (i.e., if countries still modify the substance of the final EU Benchmarks without agreement of the Commission). In such event, the Commission services, in coordination with the EEAS, will formally inform the concerned third country, that the Commission will conclude its assessment based on the lack of commitment to address the serious concerns and that the Commission will include the country in the Delegated Regulation identifying it as having strategic deficiencies. The lack of high-level political commitment will be indicated in the Delegated Regulation.

Once listed, the Commission will monitor progress made by the countries in view of a subsequent delisting when the EU delisting criteria will be met. The situation of the third country would be re-assessed by the Commission services when they receive reliable information, e.g. from international organisations, allowing the Commission to determine that the strategic deficiencies were removed. The Commission may also further collect information required to corroborate the removal of strategic deficiencies (notably information from international organisations active in the AML/CFT field). Following the adoption of a Delegated Regulation identifying a high-risk third country, the concerned third country may still express a high-level political commitment at a later stage. While such commitment is welcome, it will not be sufficient to remove this country from the list until the country has addressed the strategic deficiencies identified by the Commission. 4.5.2Countries representing an overriding level of risk In case a country represents an overriding level of risk to the financial system of the Union that needs to be mitigated, the Commission may immediately conclude its assessment and initiate a listing when strategic deficiencies are identified. An “overriding level of risk” is present if the following two conditions are met: 1) there is a significant threat of money laundering or terrorist financing, and 2) the country does not have the necessary administrative ability to implement EU benchmarks. The lack of administrative ability occurs for instance if the country does not have a stable governance system in place that would give assurance that AML/CFT related mitigating measures can reasonably be put in place and sustained in the future, or when the country's government does not hold effective control over large parts of its territory which hinders the effective implementation of mitigating measures throughout its territory. The Commission will consider information received from the EEAS, Europol, Member States, and other reliable sources in order to assess whether any of those conditions are met. In such situations, there is reasonable doubt that a high-level political commitment, and the necessary mitigating measures, could reasonably be implemented in the foreseeable future. Considering the high level of threat for money laundering or terrorist financing emanating from those jurisdictions, it is necessary to adopt mitigating measures at Union level to protect the integrity of the EU financial system. In light of the above, the Commission will immediately proceed with finalising its assessment and initiate appropriate steps in view of including the jurisdiction on the list of third countries having strategic deficiencies. The assessment will be based on available information sources and body of evidence. The concerned third country will be informed about this step when the Commission services conclude their preliminary findings. Third countries in that situation can still express a high-level political commitment to implement EU Benchmarks agreed with the Commission. Such high-level political commitment will be reflected in the Delegated Regulation identifying the concerned third country as presenting a high risk. The Commission will monitor progress made by such countries against the EU Benchmarks that have been established for them in order to assess whether the EU delisting criteria set in the methodology are met in view of a delisting. 4.5.3Countries expressing a high level political commitment to address serious concerns ·High level political commitment to address strategic deficiencies For countries that expressed a high-level political commitment to address serious concerns identified by the Commission, the Commission will after a 12-month observation period assess the country's progress in adopting the necessary mitigating measures. This approach is justified by the fact that developments are still ongoing and factual changes taking place, which could impact on the functioning of the AML/CFT regime of the country. In addition, the high-level political commitment expressed towards the Commission may lead to the adoption of mitigating measures within the set timeframe. Therefore, it would generally not be considered proportionate to reach immediately a conclusion on its AML/CFT regime. The Commission will review progress in implementing the agreed Benchmarks in view of addressing the serious concerns, as follows: After a period of 12 months, the third country should report to the Commission on the progress in implementing all the agreed EU Benchmarks. The Commission will review the progress as follows: ØIn case all the EU Benchmarks are reported as being implemented, the Commission may request further written information, organise a meeting and/or, in coordination with the EEAS, an onsite visit in order to receive further information regarding the effective application of the mitigating measures and the confirmation of the sustained political will to continue improving the AML/CFT regime. If the analysis concludes that all the EU Benchmarks are effectively implemented, the Commission will finalise its assessment and in principle consider that the country does not have strategic deficiencies in its AML/CFT regime at this stage. The concerned country will be informed accordingly. ØIn case the report and available information does not allow concluding that all EU Benchmarks are completed, the Commission will initiate appropriate steps in view of including the jurisdiction on the list of third countries having strategic deficiencies and inform the country accordingly. Considering that those EU Benchmarks cover areas of strategic importance, failing to implement one or several Benchmarks will be considered as a sufficient ground for a listing. In such event, the listing decision will remain in force until the country has fully implemented the EU Benchmarks and meets the EU delisting requirements defined in this methodology.

ØIn case the third country does not report within the 12 months following the deadline that the Commission had set for the expression of the high-level political commitment (see above), it is assumed that the country failed in implementing the agreed EU Benchmarks. In such event, the Commission will initiate appropriate steps in view of including the jurisdiction on the list of countries having strategic deficiencies and inform the country accordingly. An overview of the main steps and deadlines is provided in Annex 5. ·Countries for which there is no Mutual Evaluation Report (MER) within the FATF process or which are not participating in a Financial Action Task Force-Style Regional Body (FSRB) When there is no Mutual Evaluation Report (MER) or equivalent report within the process of the FATF, or where the third country does not participate in a Financial Action Task Force-Style Regional Body (FSRB), it will be necessary to engage with the country in order to address serious concerns with regard to its lack of commitment to implement international standards. In such cases, the Commission, in coordination with the EEAS, will formally inform the third country about its serious concerns regarding its commitment to implement internationally agreed AML/CFT standards. The third country will be invited to express a high-level political commitment in order to confirm, within 12 months, that: -it is, or will effectively become a member of an FSRB; and -a date for an FSRB/FATF mutual evaluation in line with the FATF methodology has been agreed by an FSRB/international organisations competent in the AML/CFT field. The third country will be informed that this matter will also be discussed in ICRG. At the next FATF ICRG meeting following transmission of the information to the concerned third country, the Commission and Member States will request putting this issue on the agenda. FATF and/or the respective FSRB will be invited to confirm whether a date for the mutual evaluation can be agreed in the coming months. In case the third country has a confirmed date for an FSRB/FATF evaluation within 12 months, it shall communicate this to the Commission, by sharing the FSRB/FATF’s confirmation of the evaluation’s date. In such event, the Commission will accept the commitments taken by the third country to implement international standards. The Commission will re-assess the AML/CFT regime of the country when new information sources become available, notably the results of the mutual evaluation reports. Should the third country not confirm a date for a mutual evaluation by the FATF/FSRB, the Commission will initiate the appropriate steps in view of a listing. Hence the third country will be presumed as having strategic deficiencies. This is justified by serious uncertainties regarding the compliance with AML/CFT standards, and/or concerns regarding political commitment to implement those standards and/or the absence of international escalation mechanisms. This will in particular be considered in case the security situation does not allow the FATF, the FSRB or the Commission services to attend an onsite visit in the country. In case the Commission decides to list a country in such a situation, the listing decision will remain in force until the delisting criteria are met. Third countries in this situation are invited to take commitments to address those strategic deficiencies; however the Commission will proceed with a listing pending the complete implementation of mitigating measures. As a first step, the third country will be invited to be subject to a mutual evaluation report carried out by an international organisation competent in the AML/CFT field whose results are publicly available. Following the results of the mutual evaluation report, further EU Benchmarks will be established. Following this listing decision, the Commission will aim at bringing the issue to the FATF ICRG – and seek together with Member States whether FATF can design an action plan to address strategic deficiencies of the AML/CFT regime of the country. Similarly, a country which rejects the publication of the report carried out by an international organisation competent in the AML/CFT field will be invited to ensure that the report is published within 12 months. The process described above will be applied by analogy. 4.5.4Emergency situations

In order to cope with unexpected situations concerning a third country not currently found in the scoping or list of priorities, an "emergency procedure" should be in place. In case of exceptional circumstances raising serious concerns, the Commission services may trigger a specific mechanism consisting of assessing the immediately available information. The Commission services will then re-prioritise their work in order to carry out a full assessment as soon as possible. Pending the full assessment under the general procedure, the Commission services will, as a matter of urgency, assess the AML/CFT regime of the third country raising serious concerns based on an evaluation of the exceptional circumstances that have initiated the emergency procedure (i.e. "prima facie analysis"). The strategic deficiencies would be assessed on a preliminary basis by finding a body of evidence/range of indices ("faisceau d'indices") that relate to one or several building blocks. A body of evidence would generally be considered sufficient to trigger a listing of a third country in this situation. This emergency procedure would aim at ensuring that obliged entities apply enhanced customer due diligence measures in urgent situations. 4.6Step 6 - Adoption of Delegated act The Commission will follow the standard procedure for adoption of delegated acts listing high-risk third countries, including consultation of the EGMLTF during the assessment phase. Following this assessment, the Commission services will prepare the adoption of a new EU Delegated Regulation on high-risk third countries, pursuant to the specific provisions of Article 9 of the 4th Anti-Money Laundering Directive and the time limits set out therein. 4.7Step 7: Review of the assessment of the Priority 1 third countries The objective of this step is to ensure an update of assessment for Priority 1 countries reviewed in step 3. The Commission services need to maintain an ongoing monitoring of those Priority 1 countries already assessed (but not listed), especially in case of countries where only 3rd round MER information (i.e. based on the old FATF standards) was available. This step will also allow the Commission services to take into account possible deterioration of the AML/CFT regime which may not yet be covered by up-to-date FATF/FSRB reports. The Commission services will update their assessment for Priority 1 countries: - when a 4th round MER becomes available for countries reviewed based on 3rd round MER information; and/or - when new relevant information becomes available (e.g. new legislation having a negative impact on AML/CFT regime, new reports from credible sources). The Commission will apply the criteria described under step 3, 4 and 5 and will follow the same procedure as above for delegated acts to be adopted within 1 month of identification of the strategic deficiencies.

4.8Step 8: Assessment– Follow up of countries listed under step 6 (high-risk third countries) 4.8.1Follow up of high risk third countries The objective of this step is to ensure continuous monitoring of high-risk third countries' progress in improving their AML/CFT regime in view of their consequent possible removal from the EU list. The Commission, in coordination with the EEAS, will remain in close contact with authorities from high risk third countries in order to monitor progress in implementing mitigating measures. The situation of the third country will be re-assessed ex officio by the Commission when it receives reliable information from international organisations indicating that all strategic deficiencies were removed. The situation will also be re-assessed on demand, following a request made by a third country after it has reported having completed all measures necessary to meet the EU delisting requirements. In that case, the Commission may request further written information, organise a meeting and/or an onsite visit in the third country in order to receive further information to assess whether the EU delisting requirements are met. The Commission may also further collect information which is required to corroborate the removal of strategic deficiencies (notably information from international organisations active in the AML/CFT field). 4.8.2Delisting criteria In order to be removed from the EU list, the assessment will focus on all of the 3 following requirements: 1) First, the legislation of the country should be considered by the Commission services as technically compliant at least with the following criteria which are considered to be "EU fundamental criteria": -the requirements on criminalising money laundering and terrorist financing (see criteria 1 under section 4.3.2), -applying customer due diligence requirements, record keeping and reporting of suspicious transactions in the financial and non-financial sector (see criteria 2 and 3 under section 4.3.2),

-transparency of beneficial ownership for legal persons and legal arrangements (see criteria 7 under section 4.3.2), -and international cooperation (see criteria 6 under section 4.3.2). 2) To the extent that the first set of exit requirements is fulfilled, the Commission services will assess the effectiveness of the country's regime in ensuring the transparency of beneficial ownership information of legal persons and legal arrangements. Particular consideration will be given on the availability of beneficial ownership information, access to beneficial ownership information by competent authorities and exchange of beneficial ownership information in the context of international cooperation. 3) To the extent that the first two exit requirements are fulfilled, the Commission services will assess whether the country's efforts are adequate to demonstrate progress towards increasing effectiveness with regard to each building block considered as presenting significant or very significant deficiencies (i.e. tangible and positive impact). When assessing these three requirements, the Commission will take into account the risk, materiality and context for determining whether each requirement is met. Once the assessment concludes that those requirements are met, the Commission services will prepare the adoption of a new EU Delegated Regulation on high-risk third countries pursuant to the specific provisions of Article 9 of the 4th Anti-Money Laundering Directive. 5Consultation during the decision-making process 5.1 Consultation of Member States experts In implementing the approach described in this document, the Commission will consult Member States experts as described under section 3.2. In particular, the EGMLTF will be consulted with regard to: -Third countries' inclusion in the scope (as set above under 2.1.1.) and the timing of the review (e.g. risk factors to be considered for priority setting as set above under 2.1.2.); -The third country's risk profile and threat level. Specific Member States competent authorities (e.g. law enforcement, intelligence services, Financial Intelligence Units (FIUs) via the EU FIU Platform) may also be consulted with regard to the level of threat of money laundering and countering terrorist financing in specific third countries. Similarly, Europol and the EEAS may be requested to provide analysis on ML/TF threats in third countries. In this context, the Commission services may organise classified meetings with Member States competent authorities, Europol and the EEAS on the level of threat of money laundering and terrorist financing.The information collected through those consultations will be included in the risk profile and threat level that will be shared with EGMLTF. -The assessment of the level of deficiencies in each area of the AML/CFT regime covered by the analysis ("building blocks"). The EGMLTF will notably be consulted with regard to third countries' cooperation with Member States' competent authorities. It will also be consulted on the factual situation with regard to the implementation of AML/CFT measures in the areas covered by the analysis. In this context, the EGMLTF will be given 4 calendar weeks to review the draft assessment. -Definition of mitigating measures with third countries: in this context, the EGMLTF will be given 2 weeks to review the proposed mitigating measures.

-Third countries' implementation of EU Benchmarks at the end of the observation period of 12 months. In this context, the Commission's Expert Group will be given 2 calendar weeks to review the progress in implementing the Benchmarks. -Preparation of the Delegated Regulation in view of a listing. In this context, the Commission's Expert Group will be consulted for 1 calendar week on the proposed Delegated Regulation (based on earlier reviewed analysis). Member States experts will be invited to share any relevant information that they may have during this process. It is expected that Member States experts take active participation by providing relevant information to assess the risk profile and threat level, the assessment of the level of deficiencies in the AML/CFT regime and the definition of appropriate mitigating measures in light of the specific context. In order to facilitate the consultation process, any communication made with third countries will be shared with Member States experts (i.e. the Commission will share all written exchanges with the EGMLTF). Similarly, the EGMLTF will be consulted for the preparation for Delegated Regulation in view of a delisting. EEAS will be invited to attend the meetings of the EGMLTF and will receive copies of any document sent to the EGMLTF. An overview of the main steps and indicative timing for each step is presented in Annex 5. 5.2 Reporting to the European Parliament and Council The Commission commits to maintaining a regular political dialogue with the European Parliament and the Council on meeting the obligation under Article 9 of the Anti-money Laundering Directive regarding the policy regarding high-risk third countries, and more specifically on progress in implementing this methodology. It will keep the European Parliament and Council informed of the progress concerning the different steps covered by this document. In particular, the European Parliament and the Council will receive a copy of any communication by the Commission to the Commission's Expert Group (including on preliminary findings, propo