FATF grey list and black list: what they are, who is on them, and what they mean for your AML programme
The FATF grey list names countries that are fixing weaknesses in their anti-money laundering regime under FATF supervision. The black list names the three countries the FATF considers a continuing threat to the financial system.
Neither list is a sanctions list. What they do is change how banks, fintechs and regulators treat a country's risk, and that is where most compliance teams get it wrong in both directions.
As at 31 October 2026, after the FATF's October plenary, there are 18 jurisdictions on the grey list and 3 on the black list.
This guide explains what each list means, who is on it now, what changed this week, how countries get on and off, and what your institution should actually do about it.
FATF grey list and black list Key Takeaways |
|
|
|
|
|
What are the FATF grey list and black list?
The FATF grey list and black list are two public statements the Financial Action Task Force issues after each of its three yearly plenaries.
The FATF grey list, officially "jurisdictions under increased monitoring", names countries with strategic deficiencies in their regimes against money laundering, terrorist financing and proliferation financing. These countries have committed to fix those deficiencies under an action plan with agreed deadlines.
The FAFT black list, officially "high-risk jurisdictions subject to a call for action", names countries whose deficiencies are so serious that the FATF asks its members and all other jurisdictions to apply enhanced due diligence or, in the most serious cases, countermeasures.
Neither statement is a sanctions list, and neither prohibits transactions.
The FATF itself is not a regulator. It is an intergovernmental standard-setter with 40 members, based at the OECD in Paris, whose 40 Recommendations are the global benchmark for AML, counter-terrorist financing and counter-proliferation financing rules.
The lists are how the FATF puts public pressure on countries that fall short of those standards.
The names "grey" and "black" are not FATF terms; they come from the market and the press, and the FATF now uses them in brackets on its own site.
Grey list: jurisdictions under increased monitoring
A country on the grey list has had its deficiencies identified, usually through a mutual evaluation, and has made a high-level political commitment to resolve them.
It works through a published action plan with the FATF and the relevant FATF-style regional body, and reports progress at each plenary. The FATF calls on these jurisdictions to complete their action plans expeditiously and says it will monitor them closely.
The FATF does not ask its members to apply enhanced due diligence to grey-listed countries as a class. The statement is information for risk-based decisions, not an instruction.
Black list: high-risk jurisdictions subject to a call for action
A country on the black list has significant strategic deficiencies and, in the FATF's judgement, is not addressing them.
Here the FATF does instruct. For every black-listed country, it calls on all members and urges all jurisdictions to apply enhanced due diligence.
For the most serious cases, it calls for countermeasures, which can include limiting business relationships, prohibiting the establishment of branches, increased reporting and refusing correspondent relationships.
As at 30 October 2026, the FATF calls for countermeasures on Iran and the Democratic People's Republic of Korea, and for enhanced due diligence proportionate to the risk on Myanmar.
Shield Your Business from Country Risk
Navigating complex jurisdictional sanctions doesn't have to stall your growth. azakaw flags entity threats, categorises risk levels in real time, and guides your team to enforce the exact compliance measures needed for every counterparty.
Which countries are on the FATF grey list and black list right now?
As at 30 October 2026, 18 jurisdictions are on the FATF grey list, and three are on the black list.
The grey list runs from Angola to Yemen and includes two Gulf-adjacent names, Kuwait and Iraq, and three in the wider Middle East, Lebanon, Syria and Yemen.
The black list has not changed since October 2022: Iran, the Democratic People's Republic of Korea and Myanmar.
The next scheduled update is the February 2027 plenary.
FATF grey list, as at 30 October 2026 (18 jurisdictions)
Jurisdiction | Region | Under increased monitoring since |
Angola | Africa | October 2024 |
Bolivia | Americas | June 2025 |
Bosnia and Herzegovina | Europe | June 2026 |
Cameroon | Africa | June 2023 |
Haiti | Americas | June 2021 |
Iraq | Middle East | June 2026 |
Kenya | Africa | February 2024 |
Kuwait | Middle East (GCC) | February 2026 |
Lao People's Democratic Republic | Asia-Pacific | February 2025 |
Lebanon | Middle East | October 2024 |
Nepal | Asia-Pacific | February 2025 |
Papua New Guinea | Asia-Pacific | February 2026 |
South Sudan | Africa | June 2021 |
Syria | Middle East | February 2010 |
Venezuela | Americas | June 2024 |
Vietnam | Asia-Pacific | June 2023 |
Virgin Islands (UK) | Caribbean | June 2025 |
Yemen | Middle East | February 2010 |
FATF black list, as at 30 October 2026 (3 jurisdictions)
Jurisdiction | What the FATF asks members to apply | Listed since |
Democratic People's Republic of Korea | Countermeasures | February 2011 (call for countermeasures) |
Iran | Countermeasures | February 2020 (countermeasures re-imposed after its action plan expired) |
Myanmar | Enhanced due diligence proportionate to the risk; countermeasures under consideration | October 2022 |
Two cautions when you use these tables.
First, the FATF statement for each country says what it still has to do, and that detail matters more than the label when you set a country's risk score.
Second, the lists are a snapshot. Syria and Yemen have been listed for over fifteen years, while Bosnia and Herzegovina and Iraq arrived in June 2026, so "grey-listed" covers very different situations.
What changed at the October 2026 FATF plenary?
At its plenary in Paris on 28–30 October 2026, the first under the UK Presidency of Giles Thomson, the FATF removed four jurisdictions from the grey list and added none.
Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco all completed their action plans and passed on-site visits. The grey list fell from 22 jurisdictions to 18.
The black list was left unchanged, but the FATF updated its statements on Iran and Myanmar. It also said it had significant concern about Vietnam's pace of progress, warning that it will consider next steps if Vietnam does not make tangible improvements by the next plenary.
Three of the four exits are instructive.
Monaco had been listed since June 2024. Before its September 2026 on-site visit it introduced an offence of presumed money laundering, increased funding for its financial regulator and created a specialist prosecution unit.
The Democratic Republic of the Congo had been listed since October 2022 and Côte d'Ivoire since October 2024. Bulgaria, listed in October 2023, was the only EU member on the grey list, and its exit will ease the extra scrutiny applied to its cross-border transfers.
Vietnam's warning is the other side of the process. A grey-listed country that stalls can be moved towards the black list, and the FATF's language on Vietnam is the formal first step.
How the grey list has changed, February 2024 to October 2026
Plenary | Added to the grey list | Removed from the grey list |
October 2026 | None | Bulgaria, Côte d'Ivoire, Democratic Republic of the Congo, Monaco |
June 2026 | Bosnia and Herzegovina, Iraq | Algeria, Namibia |
February 2026 | Kuwait, Papua New Guinea | None |
October 2025 | None | Burkina Faso, Mozambique, Nigeria, South Africa |
June 2025 | Bolivia, Virgin Islands (UK) | Croatia, Mali, Tanzania |
February 2025 | Lao PDR, Nepal | Philippines |
October 2024 | Algeria, Angola, Côte d'Ivoire, Lebanon | Senegal |
June 2024 | Monaco, Venezuela | Jamaica, Türkiye |
February 2024 | Kenya, Namibia | Barbados, Gibraltar, Uganda, United Arab Emirates |
The pattern over these nine plenaries is a steady churn of two to four countries in and out each time, with the list size moving between 18 and 25.
That is why a compliance programme cannot treat the list as fixed. A country rating set two years ago is likely to be wrong today.
How does a country get on the grey list, and how does it get off?
A country reaches the grey list through the FATF's mutual evaluation process.
The FATF Global Network members are assessed periodically against the 40 Recommendations and 11 effectiveness outcomes.
A poor result in priority areas sends the country to the International Co-operation Review Group (ICRG). The ICRG reviews it for about a year and, if the deficiencies are confirmed, agrees an action plan and places the country under increased monitoring.
Getting off requires completing every item, an on-site visit by assessors to confirm the reforms are real and sustainable, and a plenary decision. The whole cycle usually takes two to four years.
In practice, the route looks like this:
Mutual evaluation. Assessors from the FATF or a regional body (MENAFATF for the Gulf, ESAAMLG for southern and eastern Africa, APG for Asia-Pacific, MONEYVAL for Europe) rate technical compliance and effectiveness.
ICRG referral. Countries that fall below set thresholds, typically on effectiveness, enter a one-year observation period and can be referred to the ICRG.
Action plan and listing. The country makes a high-level political commitment to an action plan with dated milestones and is placed on the grey list at a plenary.
Progress reporting. The country reports at each plenary. The FATF publishes a short statement on what has been done and what remains.
Substantial completion. When the FATF judges all items substantially addressed, it authorises an on-site visit.
On-site visit and delisting. Assessors verify that reforms are implemented and sustainable and that political commitment remains. The next plenary removes the country.
South Africa is a recent example of the full cycle: evaluated in 2021, listed in February 2023 with 22 action items, substantially complete by June 2025, visited in July 2025 and delisted in October 2025.
Its next mutual evaluation has already started, which shows that delisting is a milestone rather than an end point. We cover that case in detail in our guide to South Africa and the FATF grey list.
The path to the black list runs the other way. A grey-listed country that fails to progress, as Myanmar did when its action plan expired in 2021, can be moved to the call-for-action list, first with a call for enhanced due diligence and then, if nothing changes, for countermeasures.
Vietnam's October 2026 warning is the first signal in that direction.
Does grey listing mean sanctions or mandatory enhanced due diligence?
No, on both counts. Grey listing is not a sanction, creates no legal prohibition, and the FATF does not call for enhanced due diligence on grey-listed countries as a group.
What the FATF asks is that institutions take the information in its statements into account in their risk-based approach.
The black list is different. The FATF explicitly calls for enhanced due diligence on all three listed countries and for countermeasures on Iran and the DPRK.
Separately, the EU and the UK maintain their own statutory lists of high-risk third countries. Those lists, not the FATF's, are what create a legal obligation to apply enhanced due diligence in those jurisdictions.
The distinction matters because many institutions set a hard rule in 2023 or 2024 that any grey-listed country triggers EDD, and then never revisited it.
The cost is onboarding friction and false positives for customers from countries that have since reformed, with no regulatory requirement behind it.
What each list asks of you
List | What the FATF asks | Legal effect |
Black list – countermeasures (Iran, DPRK) | Apply countermeasures: limit or prohibit relationships, increase reporting, refuse correspondent accounts | Usually implemented through national law and sanctions regimes |
Black list – EDD (Myanmar) | Apply enhanced due diligence proportionate to the risk, without disrupting humanitarian flows | Implemented through national AML rules on high-risk countries |
Grey list (18 jurisdictions) | Take the statements into account in the risk-based approach | No FATF-mandated measure; the institution decides |
Not listed | No FATF statement | Ordinary risk assessment applies |
How the EU and UK lists relate to the FATF lists
The European Union publishes its own list of high-risk third countries under the Anti-Money Laundering Directive. EU-regulated institutions must apply enhanced due diligence to relationships and transactions involving those countries.
The EU list tracks the FATF lists closely but not instantly, and the lag runs both ways.
South Africa left the FATF grey list on 24 October 2025 but stayed on the EU list until 29 January 2026, so EU banks were still legally required to apply EDD for three months after the FATF decision.
The United Kingdom has aligned its high-risk third country list directly with the FATF's two statements since 2023, so UK-regulated firms should treat a FATF change as an immediate change in their legal position.
Institutions elsewhere should check their own regulator's approach. In South Africa, for example, the Financial Intelligence Centre issues an advisory after each plenary telling accountable institutions to take the updated statements into account.
What the lists mean for compliance teams in practice
For a compliance team, the lists are an input to three controls: the country-risk component of customer risk scoring, the triggers for enhanced due diligence, and the treatment of correspondent and payment-partner relationships.
The right response is to weight the input according to what the FATF statement actually says, apply the mandated measures for black-listed countries, and review the settings after every plenary.
The wrong responses are the two extremes: a blanket EDD rule for every grey-listed country, and a rating that never changes after a country is delisted.
Country-risk scoring
Most risk models give each country a score built from several sources: the FATF lists, the EU and UK lists, sanctions programmes, corruption and secrecy indices, and the institution's own experience.
The FATF grey list should raise a country's score, not set it. A newly listed country with a credible action plan and a country that has been listed for fifteen years are not the same risk, and the FATF statement for each one says which is which.
When a country is delisted, the score should fall with the change documented. If your model has no mechanism to lower a score, delisted countries keep paying for a status they no longer have.
Enhanced due diligence triggers
Enhanced due diligence is mandatory where your regulator says it is: black-listed countries, EU or UK high-risk third countries for institutions in those jurisdictions, and any other high-risk categories in national law.
For grey-listed countries, EDD should follow from the customer's overall risk score rather than from the listing alone.
A low-risk retail customer in a grey-listed country is still a low-risk retail customer. A complex corporate structure with opaque ownership is a high-risk customer whether or not its country is listed.
Correspondent banking and payment partners
The lists have their sharpest effect here, because a counterparty bank's own regulator may require it to tighten controls on a listed country. A listing can mean slower settlements, more requests for information and, at the extreme, de-risking.
When a country is delisted, the formal signal lifts, but counterparties update on their own cycle. A year after South Africa's exit, some international banks were still applying the rules they set in 2023.
Faster Settlements, Zero Counterparty Friction
Partner banks take months to adjust to geopolitical updates. azakaw empowers your team with real-time AML intelligence to resolve counterparty inquiries instantly and prevent payment bottlenecks.
Common misconceptions
"Grey-listed means sanctioned." It does not. Sanctions come from the UN Security Council, the EU, OFAC, OFSI and national authorities, not from the FATF.
"The FATF requires EDD on grey-listed countries." It does not. It requires EDD on black-listed countries and asks for grey-list statements to be taken into account.
"Delisting means the risk is gone." It means the country completed a specific action plan. The next mutual evaluation decides whether the improvements held.
"The list only matters for banks." Any accountable institution with a country-risk model, including fintechs, payment firms, crypto asset service providers, law firms and real estate businesses, is affected.
A post-plenary checklist
The FATF publishes its statements on the last day of each plenary. The steps below are an example workflow for the 30 days that follow, not a regulatory procedure.
Read the three FATF statements, not a summary: the plenary outcomes, the increased-monitoring statement and the call-for-action statement.
Update the country-risk table for every addition and removal, and record the rationale and the date.
Check your regulator's advisory (for example, FinCEN in the United States or the FIC in South Africa) and the EU or UK list if either applies to you.
Review EDD triggers so that mandated measures apply to black-listed countries and grey-list treatment follows the risk score.
Re-screen the affected customer base and re-rate customers whose country score changed.
Check correspondent and partner exposure to the countries that moved, in both directions.
Record the review so an inspector or assessor can see what changed, when and why.
The FATF lists from a GCC perspective
For institutions in the Gulf, the lists are not an abstraction.
The United Arab Emirates spent two years under increased monitoring before leaving the grey list in February 2024.
Kuwait was added in February 2026. Iraq, Lebanon, Syria and Yemen, all significant trade and remittance corridors for the region, are on the current list.
Bahrain and Saudi Arabia are scheduled for fifth-round mutual evaluations with on-site visits indicated for late 2026, and the UAE follows them in the same round.
That makes the next two years a period when every GCC regulator will be watching how well its licensed firms handle country risk.
The UAE's exit and what it changed
The UAE was grey-listed in March 2022 and removed on 23 February 2024 after completing its action plan, which included stronger supervision of designated non-financial businesses, better use of financial intelligence and more money laundering prosecutions.
The supervisory regime built in those two years did not go away. The Central Bank of the UAE, the DFSA, the FSRA and VARA have all kept inspection and enforcement at the level set during the listing, and a 2026 mutual evaluation will test whether it works.
Read more about UAE AML regulations
Kuwait's listing and what it means for counterparties
Kuwait was placed under increased monitoring on 13 February 2026 with an action plan covering risk-based supervision, beneficial ownership information and the investigation and prosecution of money laundering and terrorist financing.
For Gulf institutions with Kuwaiti customers and counterparties, the practical effect is a change in one country-risk input, not a reason to de-risk.
Kuwaiti banks and licensed firms remain supervised by the Central Bank of Kuwait and the Capital Markets Authority, and the FATF statement sets out what the country is working on.
What Gulf institutions should do with listed counterparties
Treat Iran and the DPRK as countermeasure jurisdictions, in line with the FATF call and with UAE, Saudi and other national sanctions regimes.
Apply enhanced due diligence to Myanmar exposure, proportionate to the risk.
For grey-listed countries in the region, Kuwait, Iraq, Lebanon, Syria and Yemen, weight the country score according to the FATF statement and let the customer's overall risk drive EDD.
Document country-risk changes after each plenary so that DFSA, FSRA, CBUAE, SAMA or CMA inspectors can see the review happened.
Use regulator-specific rules where your licence requires them: the DFSA, FSRA and CBUAE each publish their own expectations on high-risk countries that sit on top of the FATF lists.
Fully Compliant Everywhere
Learn how azakaw makes MLRO life easier with an AI-powered AML solution that uses regulator-specific templates or allows you to create your own rules and workflows.
Where technology can help
The operational problem with the FATF lists is not reading them. It is propagating a change through a risk model, a screening programme and a customer base three times a year, consistently and with an audit trail.
Technology helps when it lets a compliance team change a country-risk input once and see the effect everywhere.
The capabilities that matter most are:
Configurable risk scoring, so that a country's weighting can be changed after a plenary, with the logic documented, rather than hard-coded.
Screening with ongoing monitoring, so that customers linked to a newly listed or delisted country are re-screened and re-rated automatically.
Regulator-specific rule sets, so that a firm licensed by the DFSA, the FSRA and the CBUAE can apply each regulator's expectations on high-risk countries without three separate processes.
Transaction monitoring with alert triage, so that flows to and from listed countries are caught consistently, and investigators spend time on the cases that matter.
Audit-ready records, so that every change to a country rating and every resulting decision can be produced for an inspector.
azakaw brings digital onboarding (KYC, KYB and AML screening), real-time transaction monitoring across fiat and crypto transactions with configurable alerts, and corporate compliance into a single platform, with continuous monitoring through the client lifecycle and audit-ready reporting.
It was built for firms operating under several Gulf regulators at once, which is the situation where a FATF list change has to be applied in more than one rulebook at the same time.
End-to-End AML Compliance Solution
Learn how azakaw makes MLRO life easier with an AI-powered AML solution that uses regulator-specific templates or allows you to create your own rules and workflows.
Frequently asked questions
What is the difference between the FATF grey list and black list?
The grey list (jurisdictions under increased monitoring) names countries that are fixing identified deficiencies under an agreed action plan, and the FATF asks only that its statements be taken into account.
The black list (high-risk jurisdictions subject to a call for action) names countries the FATF considers a continuing threat, and it calls on members to apply enhanced due diligence or countermeasures.
Which countries are on the FATF grey list in 2026?
As at 30 October 2026: Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, Virgin Islands (UK) and Yemen. The list is updated in February, June and October.
Which countries are on the FATF black list?
Iran, the Democratic People's Republic of Korea and Myanmar. The FATF calls for countermeasures on Iran and the DPRK and for enhanced due diligence proportionate to the risk on Myanmar.
Is the UAE on the FATF grey list?
No. The UAE was placed under increased monitoring in March 2022 and removed on 23 February 2024.
Is Kuwait on the FATF grey list?
Yes. Kuwait was added on 13 February 2026 and is working through an action plan with the FATF and MENAFATF.
Is South Africa or Nigeria on the FATF grey list?
No. Both were removed on 24 October 2025, together with Mozambique and Burkina Faso.
Is Pakistan on the FATF grey list?
No. Pakistan was removed in October 2022 and has not been re-listed. The FATF does not announce candidates for listing in advance, so reports about possible re-listing are speculation until a plenary decision is published.
Does the FATF impose sanctions?
No. The FATF sets standards and publishes the two lists; it has no power to sanction. Sanctions are imposed by the UN Security Council, national governments and bodies such as OFAC and OFSI. The FATF's call for countermeasures on Iran and the DPRK is implemented by its members through their own laws.
Do banks have to apply enhanced due diligence to grey-listed countries?
Not because of the FATF. The FATF asks for enhanced due diligence on black-listed countries only. Statutory EDD obligations for grey-listed countries exist where a national or regional list says so, such as the EU list of high-risk third countries or the UK's high-risk third country list, which follows the FATF statements directly.
How often are the FATF lists updated?
Three times a year, at the end of the FATF plenaries in February, June and October. Each update is published as two statements on the FATF website on the final day of the plenary.
How long do countries stay on the grey list?
Typically two to four years. Monaco and Côte d'Ivoire left after two years, South Africa after 32 months, and the UAE after just under two years. Syria and Yemen have been listed since 2010.
What does it mean that Vietnam is "on notice"?
At the October 2026 plenary, the FATF said it had significant concern about Vietnam's pace of progress and would consider next steps if there are no tangible improvements by February 2027. That is the formal warning that precedes a move towards the call-for-action list.
Conclusion
The FATF grey list and black list are two of the most-cited and most-misread documents in AML compliance.
The grey list is a monitoring programme, not a sanction, and the FATF asks nothing more of institutions than to take it into account.
The black list is where the FATF actually instructs, with enhanced due diligence for Myanmar and countermeasures for Iran and the DPRK.
For compliance teams, the work is the same after every plenary: update the country-risk model, check the regulator's advisory, re-screen the affected customers and record what changed.
For Gulf institutions, the lists sit close to home, with Kuwait listed this year, the UAE delisted in 2024, and the region's own mutual evaluations under way.
Treating the lists as a living input to a risk-based programme, rather than as a fixed rule, is what keeps a programme both compliant and proportionate.
Advanced Transaction Monitoring Tool
Detect, prevent, and resolve suspicious activities in real-time with azakaw's AI-powered AML solution. Adopt a smarter and faster monitoring system that reduces false positives.
Related articles
Sources
FATF – Outcomes of the FATF Plenary, 28–30 October 2026
FATF – Jurisdictions under Increased Monitoring, 30 October 2026
FATF – High-Risk Jurisdictions subject to a Call for Action, 30 October 2026
FATF – Jurisdictions under Increased Monitoring, 19 June 2026
FATF – Outcomes of the FATF Plenary, 22–24 October 2025
FATF – "Black and grey" lists
FATF – Global Assessment Calendar
FinCEN – Financial Action Task Force identifies jurisdictions with AML/CFT/CPF deficiencies, 30 October 2026
Financial Intelligence Centre (South Africa) – Advisory on the FATF statement on jurisdictions under increased monitoring, June 2026
FINMA – FATF has updated its statements, July 2026
De Nederlandsche Bank – FATF warning lists
Monaco Life – Monaco pledges further reforms after FATF grey-list exit, 30 October 2026
Cliffe Dekker Hofmeyr – Removal of South Africa from the EU list of high-risk third countries, 2026
This content is provided for general informational purposes and does not constitute legal or regulatory advice. The FATF lists change three times a year and national and regional high-risk country lists may differ from them. Organisations should consult the current FATF statements, their regulator's guidance and qualified legal or compliance professionals before acting on any point in this article.
