do I do business with countries that are considered high risk
High-risk country is a fixed list, not your own assessment
The question is not about your opinion of a country, but about verification against an established list. In practice, this comes back as part of the client due diligence that banks and sometimes also major customers must conduct on the basis of the Anti-Money Laundering and Financing of Terrorism Act. That act obliges the bank or institution to check whether there is a relationship with a country that has been designated as high-risk, and to conduct enhanced due diligence in the event of a hit. Your enterprise itself does not need to "determine" anything — the questionnaire actually asks: do you have facilities, subsidiaries, suppliers or cash flows in such a country.
What is often forgotten: this cannot be viewed separately from the question about the beneficial owners of the company. A UBO who lives in or via a high-risk country or holds assets there often counts just as heavily as a facility there. The question about the origin of the company's assets is also linked to this: money that has passed through a high-risk jurisdiction attracts extra attention, even if the enterprise itself is not established there. Without concrete documentation on where your activities, entities and cash flows are located, this label cannot be filled in on the basis of assumption — it must come from your own structural data.
The basis lies in client due diligence, not in the Business Register
The Business Register Act 2007 establishes where an enterprise is registered and who is listed there as a manager or authorized representative, but that register contains no risk classification of countries. The obligation to assess country risk follows from the Anti-Money Laundering and Financing of Terrorism Act, which obliges banks and other AML Act institutions to conduct client due diligence and enhanced due diligence in the case of high-risk countries. For a complete answer, it is therefore necessary to map your own facilities, subsidiaries and banking relationships; that aligns with the question at which banks the enterprise maintains accounts, because an account at a bank in such a country is often requested separately.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- Act on the prevention of money laundering and the financing of terrorism — client due diligence
- Directive (EU) 2022/2464 (CSRD)
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.