The FATF: Standards, Mutual Evaluations and the Black and Grey Lists

The FATF (Financial Action Task Force) is the intergovernmental body that writes the global standards for combating money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction. It makes no law of its own. Its Recommendations, its country assessments and its two public lists nevertheless reach every bank customer, through national AML statutes, supervisory rules and the questionnaires of correspondent banks.

A private client usually notices the FATF in one of two situations: when the country of residence, or of a company's incorporation, is placed on the "grey" or "black" list, and when a bank starts asking detailed questions about source of wealth for no apparent reason.

Concept

The FATF works as a club of governments that have agreed on a single standard and on checking each other against it. The standard is the 40 Recommendations with their interpretive notes. The check is the mutual evaluation: experts from other countries examine both the laws of the assessed jurisdiction and the results its system actually produces. A country that fails its evaluation receives an action plan and is placed under public monitoring.

The FATF describes itself as a policy-making body whose task is to generate the political will for national legislative and regulatory reform. The Recommendations are not a treaty. They acquire force through three mechanisms.

• Public evaluations: the UK Money Laundering Regulations 2017 expressly name mutual evaluations as a source of information on country risk.
• Public lists: the FATF names jurisdictions with strategic deficiencies three times a year, after each plenary meeting.
• Transposition into national law: the EU, the UK, the US and the Asian financial centres attach enhanced due diligence (EDD) to the lists or take them into account in risk assessment.

This gives the system its defining property. The consequences of listing fall on the country's counterparties: a bank in London, Frankfurt or Hong Kong is required, or inclined, to scrutinise any customer connected with a listed jurisdiction more closely, and the jurisdiction itself feels the listing through dearer and slower payments. That is why governments give political commitments to the FATF and carry out their action plans.

The main parameters of the system as at September 2026 are set out below.

Origins and mandate

The FATF was established at the G7 summit in Paris in July 1989 to lead international action against money laundering. The first 40 Recommendations appeared in 1990 and were revised in 1996 and 2003. Special recommendations on terrorist financing were added in 2001, and in 2012 the whole standard was rebuilt as the current 40 Recommendations, with terrorist and proliferation financing integrated into a single text.

On 12 April 2019 ministers of the member states gave the FATF an open-ended mandate. The President serves a two-year term: from 1 July 2026 to 30 June 2028 the FATF is led by Giles Thomson of the United Kingdom, succeeding Elisa de Anda Madrazo of Mexico; the new presidency lists fraud, the risk-based approach and information sharing among its priorities.

Members and regional bodies

The FATF has 40 members: 38 jurisdictions, including Hong Kong, Singapore, Switzerland, the United Kingdom, the United States and Russia with its membership suspended, together with the European Commission and the Gulf Co-operation Council. The rest of the world is covered by nine FATF-Style Regional Bodies (FSRBs). Through them, more than 200 jurisdictions have committed to the FATF standards.

A regional body assesses its members under the same methodology and works with them on their action plans. That is why the FATF statement on each grey-listed country names a pair: Monaco, Bulgaria and Bosnia and Herzegovina work with the FATF and MONEYVAL, the British Virgin Islands with the FATF and CFATF, Iraq and Kuwait with MENAFATF, and Papua New Guinea with the APG.

Russia: suspended membership

On 24 February 2023 the FATF suspended the membership of the Russian Federation, citing the military invasion of Ukraine as contrary to the organisation's principles. Suspension removes Russia from the FATF's work while leaving it accountable for implementing the standards and liable for its financial obligations; within the global network Russia remains an active member of the EAG.

Every plenary since has confirmed the position. In October 2025 and June 2026 the FATF repeated that the suspension continues to stand. Russia has been placed on neither the black nor the grey list: suspension and listing are separate procedures with separate consequences. The European Union went further than the FATF and placed Russia on its own list of high-risk countries; the details are in the section on EU law.

The 40 Recommendations

The FATF Recommendations are a 2012 text with regular amendments, the latest made in June 2026. Each Recommendation is short; most of the substance sits in the Interpretive Notes (INR) and the glossary. The forty Recommendations fall into seven groups.

For a financial institution the working part of the standard is group D, for the owner of a structure group E, and for a state all seven. The groups are connected: a country with a weak group F receives low effectiveness ratings, ends up on a list, and banks elsewhere then apply their group D duties more intensively to its residents.

The risk-based approach

R.1 requires states and financial institutions to assess risks and allocate effort accordingly. In February 2025 R.1 and the interpretive notes to R.1, R.10 and R.15 were amended to support financial inclusion. "Commensurate" was replaced by "proportionate": a measure must correspond to the identified risk and effectively mitigate it. Countries must allow and encourage simplified measures in lower-risk situations, and supervisors must take account of the mitigating measures an institution has adopted. Non-face-to-face onboarding counts as higher risk only where such measures are absent.

Preventive measures

Group D describes what a client meets at onboarding: identification and verification of the customer and beneficial owner (R.10), specific measures for politically exposed persons (R.12), correspondent banking (R.13), information in wire transfers (R.16) and suspicious transaction reporting (R.20). R.10 sets a hard consequence: an institution that cannot complete CDD should not open the account or perform the transaction, should terminate the relationship and should consider filing an STR.

The bridge from the standard to the lists is R.19, "Higher-risk countries". Its text is short:

R.19, FATF Recommendations: "Financial institutions should be required to apply enhanced due diligence measures to business relationships and transactions with natural and legal persons, and financial institutions, from countries for which this is called for by the FATF. The type of enhanced due diligence measures applied should be effective and proportionate to the risks."

The second part of R.19 allows states to apply countermeasures when the FATF calls for them and independently of any such call. The black list is that call.

Transparency of companies and trusts

Group E has been almost entirely rewritten in recent years. On 4 March 2022 the FATF amended R.24 on legal persons: countries must use a combination of mechanisms to collect beneficial ownership information, including a register or an alternative mechanism with efficient access; the information must be adequate, accurate and up to date; and the risks of foreign legal persons with sufficient links to the country are assessed too. New bearer shares are prohibited and nominee arrangements are subject to stronger controls.

In February 2023 the FATF brought R.25 on trusts and other legal arrangements broadly into line with R.24. For owners of structures this means that information on the beneficial owners of a trust must be as available to the authorities as information on a company's shareholders. Registry practice is covered in the articles on UBO registers and on beneficial ownership disclosure where assets are held by a trustee.

Recent revisions

The standard is regularly supplemented. The key changes of 2022–2026 are summarised below.

Of these changes, clients will feel R.16 soonest. The plenary of 12–13 June 2025 approved the change and the revised text was published on 18 June 2025; an assessment methodology annex followed in October 2025. A cross-border transfer above USD/EUR 1,000 must carry the originator's name, account number and address and, for an individual, the date of birth — country and town suffice where no standardised postal address exists, and the year of birth where the full date is unavailable; for a legal person, a BIC, LEI or official identifier. For the beneficiary, the name, account, country and town are transmitted. The FATF expects implementation by the end of 2030; the crypto version of the same rules is covered in the article on the Travel Rule.

Mutual evaluations

The mutual evaluation is the FATF's main instrument. A team of experts from other countries examines legislation, statistics and cases and interviews public agencies and the private sector; the plenary then adopts the report. The assessment runs on two dimensions, each with its own scale.

A gap between the two dimensions is the typical picture. A country can rewrite its laws within a year and earn good technical ratings, whereas effectiveness is measured by cases, convictions, confiscations and the quality of supervision, which a year cannot fix.

Once the report is adopted, the country is placed in regular or enhanced follow-up and reports on its progress. An example from the fifth round is the report on Belgium, published on 16 December 2025: it rated financial intelligence (IO.6) and terrorist financing (IO.9) as substantial, with moderate ratings predominating elsewhere, and placed Belgium in enhanced follow-up.

The fifth round

The 2022 Methodology was adopted in February 2022, and the FATF began its fifth round of evaluations under it in 2024. The cycle has been shortened to six years, against roughly ten in earlier rounds. The first FATF members assessed under the new methodology were Belgium and Malaysia, whose reports were adopted in October 2025. Each country receives a roadmap of Key Recommended Actions with a three-year horizon.

In June 2026 the plenary adopted the reports on Canada (a joint FATF–APG evaluation) and Türkiye; the report on Türkiye was published on 23 September 2026.

How a country gets listed

The lists are run by the International Co-operation Review Group (ICRG). A country comes into its scope if it does not participate in a regional body or delays publication of its evaluation, if a FATF member nominates it, or if its mutual evaluation results cross one of four thresholds:

• 20 or more NC or PC ratings for technical compliance;
• NC or PC on three or more of R.3, R.5, R.6, R.10, R.11 and R.20;
• low or moderate effectiveness on nine or more of the 11 Immediate Outcomes, with at least two lows;
• low effectiveness on six or more Immediate Outcomes.

The procedure then runs in a fixed order.

1. A one-year observation period, during which the country works with the FATF or its regional body to address the deficiencies.
2. If deficiencies remain, the FATF agrees an action plan with the country, and the government gives a written high-level political commitment.
3. The country is publicly placed on the grey list, and the FATF reviews progress on the plan at every plenary.
4. Once the plan is complete, an on-site visit confirms that the reforms are working.
5. On that basis the plenary decides whether to remove the country from the list.

The grey list is formally "Jurisdictions under Increased Monitoring". It holds countries that have acknowledged strategic deficiencies and are working through an action plan. The FATF itself stresses that it does not call for EDD in respect of them and that its standards do not envisage de-risking, meaning the cutting-off of entire classes of customers; the information is to be taken into account in risk analysis. Where deadlines have expired, the FATF says so: in June 2026 it did so for South Sudan, Cameroon and Haiti, and it strongly urged Vietnam to move faster, all of its action plan deadlines having expired in May 2025.

The black list is formally "High-Risk Jurisdictions subject to a Call for Action". It holds countries with serious strategic deficiencies, and the FATF calls on everyone to apply EDD to them and, in the gravest cases, countermeasures.

The lists after the June 2026 plenary

The current version of both lists was published on 19 June 2026 following the plenary of 17–19 June, and both statements were checked against the FATF site on 24 September 2026. The next update is expected after the October plenary: the lists are reviewed three times a year, so the composition below has a shelf life of one plenary.

The black list

There is a material distinction within the black list: for two countries the FATF calls for countermeasures, for the third only for EDD.

The source is the FATF statement of 19 June 2026. For the DPRK and Iran, sanctions regimes come on top of the FATF measures, so accounts, transactions and structures connected with them are practically shut out of the Western financial system.

The grey list

The grey list holds 22 jurisdictions. The EU list of high-risk third countries is built on the FATF lists but updated at its own pace, so the second column shows whether each jurisdiction also appears in Delegated Regulation 2016/1675 as at September 2026.

The four "No" entries are the countries the FATF listed in 2026, which the EU has not yet reached. For private wealth three jurisdictions stand out: Monaco as a place of residence (listed since June 2024), the British Virgin Islands as a place of incorporation for holding companies (since June 2025) and Bulgaria as an EU member state (since October 2023).

Who came and went

The composition of the grey list changes at every plenary. Movement over the last four plenaries shows countries entering each time while others leave after years of work on their plans.

South Africa and Nigeria, removed in October 2025, had been listed in February 2023, more than two and a half years earlier. Namibia was on the list from February 2024 to June 2026.

How the lists become law

A FATF list does not by itself bind any bank. The obligation arises when national law refers to the list, or to a domestic list drawn up on the FATF's lead. The four legal systems that matter most to private clients do this differently.

European Union

Directive 2015/849 empowers the European Commission to identify high-risk third countries by delegated acts. The current list is Delegated Regulation 2016/1675 as amended. For business relationships and transactions involving these countries, Article 18a requires six EDD measures:

• additional information on the customer and the beneficial owner;
• additional information on the intended nature of the business relationship;
• information on the source of funds and source of wealth of the customer and the beneficial owner;
• information on the reasons for intended or performed transactions;
• senior management approval for establishing or continuing the relationship;
• enhanced monitoring by increasing the number and timing of controls.

Where applicable, Member States must also require additional mitigating measures and apply countermeasures (Art. 18a(2)–(3)).

The EU list follows the FATF with a lag. The FATF removed the UAE, Barbados, Gibraltar and Uganda from the grey list in February 2024; the EU took them off its own list only in August 2025. The last three amendments to Regulation 2016/1675 are summarised below.

The divergence runs both ways. Algeria and Namibia, which left the FATF grey list in June 2026, remain on the EU list for now. Conversely, Afghanistan, Trinidad and Tobago and Vanuatu are on the EU list but on neither FATF list. The EU list holds 26 jurisdictions in total.

The EU added Russia by Delegated Regulation 2026/46 of 3 December 2025. A separate category IV was created for it: countries that the FATF has placed on neither list and whose FATF membership is suspended. The Commission named three groups of deficiencies: the independence of the financial intelligence unit and its ability to co-operate with foreign counterparts, beneficial ownership transparency, and the application of AML rules to crypto-assets.

From 10 July 2027 the mechanism moves to Regulation (EU) 2024/1624 (AMLR). It distinguishes three categories: third countries with significant strategic deficiencies (Article 29), with compliance weaknesses (Article 30), and posing a specific and serious threat to the Union's financial system (Article 31). For the second category the Commission takes as its baseline the lists of jurisdictions under increased monitoring and selects specific EDD measures for each country. The architecture of the package is covered in the article on the EU AML package.

United Kingdom

The UK Money Laundering Regulations 2017 changed model in June 2026: the 2026 amending regulations, made on 9 June, replaced the concept of a "high-risk third country" with that of a "FATF call for action country".

The EDD measures in regulation 33(3A) mirror the six EU measures. Regulation 33(2) makes an exception for branches and majority-owned subsidiaries on three conditions: the parent is subject to equivalent AML requirements and supervision, the branch or subsidiary fully complies with group-wide policies, and the firm, on a risk-based view, does not consider EDD necessary.

The grey list nevertheless retains weight through the risk factors in regulation 33(6): among the indicators of higher geographical risk are countries identified by credible sources, including mutual evaluations, as lacking effective AML systems, which are the same grounds on which the FATF compiles the grey list. For an individual, "established in" a country means being resident there; having merely been born there is not enough.

United States

The United States has no dedicated statute on the FATF lists. After each plenary FinCEN issues a notice to financial institutions. Its notice of 6 March 2026, following the February plenary, advises institutions to consider the FATF's stance when reviewing their obligations and risk-based policies. On Iran it recalls the section 311 measures (31 CFR 1010.661) and the sanctions-based prohibitions on correspondent relationships; on Myanmar, proportionate EDD; and, for all jurisdictions under increased monitoring, including the newly listed Kuwait and Papua New Guinea, the due diligence obligations for correspondent accounts of foreign financial institutions under 31 CFR 1010.610(a).

Hong Kong and Singapore

The Asian centres transmit the lists through supervisory publications. The HKMA, the SFC and the Companies Registry (for trust and company service providers) publish the FATF statements, including those of June 2026, while the duty to apply EDD in high-risk situations derives from section 15 of Schedule 2 to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. MAS likewise publishes the FATF statements for Singapore's financial institutions.

In summary:

The upshot: the same grey-listed country, if it is also on the EU list, triggers mandatory EDD in Frankfurt and only a risk factor in London, so a client with an identical profile goes through onboarding at different depths in different banks.

What it means in practice

For the client

Where a client's connection with a listed country triggers mandatory EDD, the bank must gather the same set of information listed in Article 18a and regulation 33(3A). In practice that means questions on the source of funds for a given transaction and on source of wealth overall, documents on beneficial owners at every level, and an explanation of the purpose of transactions. Senior management approval means the decision on the account leaves the front office, and onboarding takes longer.

Enhanced monitoring under the same provision means more checks and manual review of transaction patterns, so payments to and from a listed country move more slowly and are more often held pending documents. If the client cannot close the questions, R.10 and the national laws modelled on it require the bank to decline or terminate the relationship. Building a file for this kind of review is covered in the article on AML/KYC for private clients.

For the bank

For a bank the lists are above all a matter of correspondent relationships. R.13 requires a correspondent to apply additional checks to the respondent beyond ordinary CDD, and the respondent's home country is the first parameter of that check. Following such a check, a correspondent may exit its relationship with a bank from a grey-listed country. This effect is called de-risking, and the FATF states plainly that its standards do not envisage cutting off entire classes of customers. The mechanics of the payment chain are covered in the article on correspondent banking.

For a licensed operator two duties follow:

• tracking changes after every FATF plenary and every EU delegated act, because the lists differ in composition and timing;
• documenting in the risk assessment how a country's status affects CDD, EDD and monitoring.

Where these processes sit in the wider control system is shown in the article on the compliance stack.

For the structure

A company incorporated in a listed country carries that status into all its banking relationships. The British Virgin Islands are the clearest example: on the FATF grey list since June 2025 and on the EU list since 29 January 2026. For a European bank, custodian or fund administrator, a BVI company as client now means mandatory EDD under Article 18a, whereas in the UK after 30 June 2026 the same client remains only a risk factor.

Monaco works the same way for residents and local structures. The three grey-listed jurisdictions most visible to private wealth show how differently one FATF status translates into bank obligations.

The status of every link in a holding chain feeds into the client's risk assessment, so when choosing a place of incorporation the status on both lists is weighed alongside tax and the rules on beneficial ownership disclosure.

For investment migration

For an individual, UK law ties EDD to residence: being born in a country is not enough, and regulation 33(3) does not mention nationality. The EU provision is broader and speaks of relationships and transactions "involving" a high-risk country. A passport from a listed jurisdiction is therefore weighed as a risk factor by each bank in its own way.

Vanuatu is the telling case. The EU Council ended visa-free travel for its citizens because of its investor citizenship scheme, and the Commission keeps Vanuatu on its list of high-risk countries even though it is on neither FATF list. A second passport from such a jurisdiction adds questions at onboarding; the logic is covered in the article on due diligence in investment migration.