Enhanced due diligence after the 2026 MLR reforms: two mistakes firms are making

The absence of a red flag isn't a green flag

Before the change, roughly 25 countries sat on the UK's high-risk third country list and automatically triggered mandatory EDD. Now only three do. For most firms, that's a genuinely welcome simplification. But it's also where the mistake creeps in: staff hear "the automatic trigger's gone" and quietly translate that into "there's nothing for me to do".

The reality is closer to the opposite. Was it ever realistic to think elevated money laundering risk was confined to those 25 countries? No. Is it realistic now that it's confined to three? Also no. The regulations have simply stopped doing the thinking for firms on the other 22, which means firms now have to do it themselves, using their own judgment and a wider view of country risk, not just a single list.

Two ways firms are getting this wrong

The first mistake is treating "not mandatory" as "not risky" and moving on. The second, less obvious one is overcorrecting: deciding to keep mandatory EDD in place for every country that used to sit on the old list, just to be safe.

Overcorrecting might feel like the cautious option, but it can backfire. The whole point of the reforms is to make a genuinely risk-based approach work, giving firms more discretion to apply resources where they're actually needed. If a regulator sees a firm still running blanket mandatory EDD regardless of actual risk, that's evidence the firm isn't applying a risk-based approach at all. It's a sign the compliance team is falling back on a rule rather than exercising the judgment the new regime is asking for, and a regulator who spots that in one place will likely look for it elsewhere too.

Rewording your checklist won't fix this

A related trap is treating this as a find-and-replace exercise: taking the existing checklist, swapping out the old terminology, and calling it done. Terms like "high-risk third country" have effectively disappeared from the language firms should be using, and if a firm's policies and file notes haven't caught up, that's an easy thing for an inspector to spot. It signals that the firm hasn't properly read the latest legislation, even if the substance of its compliance is otherwise sound.

But the deeper issue isn't wording. It's that the shift from a checklist approach to a judgment-based approach is a fundamentally different skill for the people doing the work day to day. Staff who've spent years being told "if X, then do Y" aren't going to switch to confident, evidenced judgment calls overnight just because a policy document has been updated. That takes real training, examples, support, and the freedom to get it wrong occasionally while they build the muscle.

Building a culture where "I don't know" is fine

Part of that support is cultural. One of the most useful shifts a firm can make is treating uncertainty as a strength rather than a weakness. If a compliance officer would rather hear "I'm not sure, can we talk this through" than a fee earner guessing and moving on, that needs to be said out loud and modelled from the top.

Practically, that can be as simple as bringing anonymised real examples to team meetings and talking through them together: what was unusual about this case, what was decided, and why. Some firms run this as a regular "case clinic", sharing recent examples and building everyone's confidence in exercising discretion consistently, rather than leaving each person to work it out alone. For more on building AML training that actually changes behaviour rather than sitting in a folder, our guide to improving AML training covers practical ways to make this stick.

The judgment was always the job

Removing the automatic trigger for 22 countries didn't remove the risk that sat behind it. It just moved the responsibility for recognising that risk back onto the firm. Getting this right isn't about a longer checklist or a stricter blanket rule, it's about making sure every person making these calls day to day genuinely understands what they're looking for, and feels able to say so when they're not sure.