UK narrows the EDD trigger, but the high risk third country duty survives

What happened

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026, Statutory Instrument 2026/621, came into effect on 30 June 2026. The change is already live. Its principal effect is to relax the obligation on regulated firms to conduct enhanced due diligence (EDD) on higher-risk transactions.

The EDD requirement is narrowed from all “complex” transactions to “unusually complex” arrangements. Under the new regulations, EDD is automatically required only if the other party is based in a country on the Financial Action Task Force (FATF) “Call for Action” list. That list names North Korea, Iran, and Myanmar.

HM Treasury has issued updated guidance on the new regulations. That guidance still requires EDD and enhanced ongoing monitoring to be applied in any high-risk third country where a high risk of money laundering or terrorist financing (ML/TF) is identified, even if that country does not appear on the Call for Action list.

Why it matters

The relaxation is narrower than it looks, and that gap is where firms will get caught. Read the statutory instrument on its own and the rule appears to collapse into a three-country list. Read HM Treasury’s guidance alongside it and the duty is plainly wider: identified high risk in a high-risk third country still pulls EDD and enhanced ongoing monitoring into play.

A firm that hears “deregulation” and starts switching off triggers is building a defect into its control framework at the exact point a supervisor will look. The automatic trigger and the risk-based duty are two different things. Only the automatic trigger has been cut back. The risk-based obligation continues to bite wherever your own assessment says the risk is high.

The word “unusually” is the second exposure. It shifts a slice of judgment from the rulebook into the firm’s own policy, and undefined judgment is exactly what turns into an inconsistent file review two years later. Whoever defines “unusually complex” in your business is, in practice, setting your EDD perimeter.

Practitioner angle

Treat this as a policy exercise, not a switch-off exercise. Concretely:

• Re-read the EDD section of your AML policy against the “unusually complex” wording and write down what “unusually complex” means for your customer base, products, and transaction types. Give the definition worked examples, not adjectives.
• Keep a high-risk third country trigger that fires on identified risk, not only on the Call for Action list. If your rules engine or onboarding workflow now keys EDD solely to North Korea, Iran, and Myanmar, that is a defect, and HM Treasury’s guidance is the reason.
• Confirm that enhanced ongoing monitoring, not just onboarding EDD, still runs where high ML/TF risk has been identified. Post-onboarding monitoring is the part most likely to be quietly dropped in a rules rewrite.
• Document the risk assessment justifying any EDD you now stand down. Name the transaction category, the rationale, the residual risk, and the approver. An undocumented reduction in due diligence looks identical to a control failure after the fact.
• Brief the first line. Relationship managers will hear “the rules got easier” long before they hear the qualification.

The single most important thing to do: before you retire a single EDD trigger, make sure your high-risk third country trigger still fires on identified risk alone, and get that decision in writing.