What this covers
You have found that a counterparty, a shareholder, a supplier, or your own nationality touches a country that appears on a list. Your bank has asked for more documents, your accountant has gone quiet, or a payment is sitting somewhere.
The first thing to establish is which list. There are three, they are maintained by three different bodies, they exist for different reasons, and they trigger completely different consequences. Professionals confuse them routinely. A country can be on one and not the others.
This guide explains the mechanism. It deliberately does not reproduce the lists themselves, because they change several times a year and a stale list is worse than no list. Links to the live lists are at the end.
The three lists
| FATF lists | EU AML high-risk third countries | EU list of non-cooperative jurisdictions for tax purposes | |
|---|---|---|---|
| Maintained by | Financial Action Task Force | European Commission | Council of the EU, through the Code of Conduct Group |
| Legal instrument | None. FATF is an intergovernmental standard setter with no direct legal force in Cyprus | Commission Delegated Regulation (EU) 2016/1675, made under Article 9(2) of Directive (EU) 2015/849 | Council conclusions, published in the C series of the Official Journal. Most recently OJ C/2026/1465 of 6 March 2026 |
| About | Weaknesses in a country’s anti-money-laundering and counter-terrorist-financing regime | The same weaknesses, but only where the Commission judges them a significant threat to the EU financial system | Tax transparency, fair taxation, and the OECD BEPS minimum standards. Nothing to do with money laundering |
| The two tiers | High-Risk Jurisdictions subject to a Call for Action (the “black list”) and Jurisdictions under Increased Monitoring (the “grey list”) | One list, in the Annex to the Delegated Regulation | Annex I, the actual blacklist, and Annex II, jurisdictions that have committed to fix something |
| Updated | After each plenary. In recent years that has been three times a year, in February, June and October | Whenever the Commission adopts an amending delegated regulation. There is no fixed cycle | By Council conclusions. In recent years twice a year, in February and October |
| What it triggers in Cyprus | Nothing directly. It feeds the Commission’s assessment | Mandatory enhanced due diligence under Article 64(1)(a) of the Cyprus AML Law | Withholding taxes on dividends, interest and royalties. No AML consequence at all |
The single most useful thing to understand: the EU AML list and the EU tax list are unrelated instruments with unrelated consequences. One is compliance, the other is tax. Being on the tax blacklist does not make your bank apply enhanced due diligence. Being on the AML list does not create a withholding tax.
Why the EU AML list is not the same as the FATF list
The Commission takes FATF’s output into account. Recital 4 of Delegated Regulation (EU) 2022/229, which amended the AML list, records that the Commission considers “recent FATF Public Statements, the FATF list of ‘Jurisdictions under Increased Monitoring’, and FATF reports of the International Cooperation Review Group”.
But taking it into account is not adopting it. The Commission makes its own assessment against the criteria in Article 9(2) of Directive (EU) 2015/849, then has to adopt a delegated act, which then has to be published in the Official Journal and enter into force. ICPAC’s Compliance Circular 1/2024 records the mechanics for one such change: the list was amended by Delegated Regulation (EU) 2024/163 on 18 January 2024 and entered into force 20 days after publication.
The practical result is a lag. A country FATF grey-lists in June may not be on the EU AML list for months, and may never be added. The reverse also happens.
What the EU AML list actually triggers
If your counterparty, shareholder or beneficial owner is in a country on the EU AML list, Article 64(1)(a) of the Cyprus AML Law requires the Cyprus firm or bank to apply six enhanced due diligence measures. These are not optional and not a matter of the firm’s judgement. They transpose Article 18a of Directive (EU) 2015/849.
| The measure | What it means for you in practice | |
|---|---|---|
| 1 | Additional information on the client and the beneficial owner | More identity documents, more of the ownership chain, often certified and apostilled |
| 2 | Additional information on the intended nature of the business relationship | Written explanation of what you want the Cyprus entity for |
| 3 | Information on the source of funds and the source of wealth of both the client and the beneficial owner | The heaviest one. Source of wealth means how the whole fortune was built, not just where this payment came from |
| 4 | Information on the reason for the transactions being planned or carried out | Commercial rationale, in writing, for the specific movements |
| 5 | Senior management approval to establish or continue the relationship | Your file goes to the board or a partner. This is why onboarding stops being a two-day process |
| 6 | Enhanced ongoing monitoring, through more frequent checks and selecting transaction patterns for further examination | Periodic reviews, more often, indefinitely |
There is one carve-out in Article 64(1)(a). Automatic enhanced due diligence is not required for a branch or majority-owned subsidiary sitting in a high-risk third country that is owned by an EU-established obliged entity, where that branch or subsidiary fully applies group-wide policies under Article 68A. In that case the firm applies a risk-based approach instead.
Separately, Article 59(13) lets Cyprus supervisory authorities go further and require regulated firms to apply extra mitigating measures, including restricting or refusing business relationships and transactions with persons from those countries. That is the legal basis on which a Cyprus bank can decline the account outright rather than merely asking for more paper.
What the EU tax list actually triggers
Cyprus applies defensive tax measures to Annex I jurisdictions. They came into force on 31 December 2022, through Law 195(I)/2021 for the Special Defence Contribution and Law 193(I)/2021 for income tax.
| Payment from a Cyprus company to a company in an Annex I jurisdiction | Rate | Provision |
|---|---|---|
| Dividends | 17% | Article 3(1)(δ) of the Special Defence Contribution Law |
| Interest | 17% | Article 3B(γ) of the Special Defence Contribution Law |
| Royalties and similar intellectual property income from sources in Cyprus | 10% on the gross amount | Article 21A of the Income Tax Law |
All three only bite where there is an association of more than 50%, held directly or indirectly, alone or with connected persons. That can run either way, or through a common person: the recipient controls the Cyprus payer, or the Cyprus payer controls the recipient, or the same person controls both. Voting rights, capital, or entitlement to profits all count.
There are carve-outs. The dividend and interest charges do not apply to payments in respect of securities listed on a regulated market of a recognised stock exchange where the payer could reasonably be unaware of the connection. The interest and royalty charges do not apply where the payer is an individual.
The company also has to be caught by the definition. The charge applies to a company that is resident in a non-cooperative jurisdiction, or is incorporated or registered in one and is not tax resident in a jurisdiction that is not non-cooperative. A company registered in an Annex I jurisdiction but tax resident somewhere clean falls outside it.
The timing rule almost everyone misses
Both laws define a non-cooperative jurisdiction as one that appears in the Annex I list published in the Official Journal during the previous calendar year, and also appears in the latest version of that list currently in force.
Both limbs have to be satisfied. A jurisdiction added to Annex I in February 2026 is not a non-cooperative jurisdiction for Cyprus withholding tax purposes during 2026, because it was not on a list published in 2025. It becomes one in 2027, provided it is still listed then. A jurisdiction removed from the list stops being caught immediately, because the second limb fails.
The Cyprus definition is wider than the EU list
This catches people out. Article 2 of the Cyprus AML Law defines a high-risk third country as two things, not one:
- a third country identified by the Commission by delegated act under Article 9(2) of the EU Directive, and
- a third country that the obliged entity itself classifies as high risk under the risk assessment required by Article 58A.
The second limb means your Cyprus accountant, bank or administrative service provider can lawfully treat a country as high risk even though it appears on none of the three lists, if their own documented risk assessment says so. Asking them to point to the list is not an argument. There may not be one.
Worked example
A Cyprus holding company is 100% owned by a company incorporated in a jurisdiction that was added to Annex I in February 2026. It pays a €400,000 dividend in November 2026 and a €60,000 royalty for use of a trademark.
- Ownership is 100%, so the more-than-50% association test is met on both payments.
- The jurisdiction was added in February 2026. It was not on an Annex I list published during 2025, so the first limb of the definition fails for 2026.
- Special defence contribution on the dividend in 2026: €0.
- Withholding on the royalty in 2026: €0.
- If the jurisdiction is still on Annex I during 2027, both limbs are then satisfied. The same payments made in 2027 would carry 17% on the dividend (€68,000) and 10% on the gross royalty (€6,000).
None of this says anything about AML. If that jurisdiction is not on the EU AML list, no enhanced due diligence is triggered by the listing. The bank may still apply it under the second limb of the Cyprus definition, on its own risk assessment.
What commonly goes wrong
Treating the EU tax blacklist as a money laundering list. It is not. It is about information exchange, harmful tax regimes and BEPS standards. Nobody is suggesting the jurisdiction launders money. The consequence is a withholding tax, not enhanced due diligence.
Assuming FATF grey-listing means the EU has listed the country. It often does not, and never does immediately. Check the Commission’s delegated regulation, not the FATF page.
Reading a copy of the list instead of the list. Every professional body republishes consolidated tables. They are useful for orientation and out of date within months. ICPAC Circular 1/2024 is a good example: the mechanism it describes is still correct, the country table in it is from January 2024 and is not.
Applying the withholding tax in the year of listing. The definition requires the jurisdiction to have been on a list published in the previous calendar year. Getting this wrong in either direction is expensive.
Assuming the withholding applies to any payment. It only applies where there is more-than-50% association between the Cyprus payer and the recipient, directly, indirectly, or through a common controller. A genuinely third-party payment is not caught.
Expecting the enhanced due diligence to end. Measure six is enhanced ongoing monitoring. There is no point at which the file goes back to normal while the connection persists.
Arguing that you are not on any list. The Cyprus AML Law lets the firm classify a country as high risk on its own assessment. Their file has to justify the classification; it does not have to cite a list.
Where to check
The three live lists, each maintained by the body that owns it:
- EU AML high-risk third countries: the Annex to Commission Delegated Regulation (EU) 2016/1675 on EUR-Lex, as amended. Read the consolidated version, not the 2016 original.
- EU list of non-cooperative jurisdictions for tax purposes: the European Commission’s page on the common EU list, which carries the current Annex I and Annex II and links the underlying Council conclusions.
- FATF: the High-Risk and Other Monitored Jurisdictions page, updated after each plenary.
One thing this guide does not cover: the EU’s anti-money-laundering framework is being replaced by the 2024 AML package, including Regulation (EU) 2024/1624, adopted on 31 May 2024. The application dates and what exactly changes for the country lists should be checked against the Regulation itself rather than assumed. We have not verified those dates against a primary source and have not stated them here.
If a listing is affecting a real transaction, have the position confirmed by a firm licensed to advise in Cyprus before you act on it. The tax consequences turn on the association test and the timing rule, and both are easy to get wrong.
