FATF: Grey Lists and 40 Recommendations

As of September 2026: FATF grey and black lists change at each plenary (February, June and October). As of the list published on June 19, 2026, jurisdictions under increased monitoring (grey list) were Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Côte d'Ivoire, Democratic Republic of Congo, Haiti, Iraq, Kenya, Kuwait, Lao People's Democratic Republic, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, Virgin Islands (UK) and Yemen. Jurisdictions subject to a call for action (black list) were the Democratic People's Republic of Korea, Iran and Myanmar. The June plenary added Bosnia and Herzegovina and Iraq, and removed Algeria and Namibia. The mutual evaluation reports for Canada and Türkiye were adopted in June 2026 and are due to be published in September to October 2026. Check FATF's site after the October 2026 plenary for changes.

What is FATF?

The Financial Action Task Force was set up in 1989 by the G7 to study money laundering and recommend how to fight it. In April 1990, less than a year later, it issued its first Forty Recommendations. Its mandate later widened to terrorist financing (2001) and to the financing of weapons proliferation. Since 2019 it has had an open-ended mandate.

Today FATF sits at the centre of a global network of more than 200 jurisdictions, which includes regional bodies that work like FATF for their own areas. It is not a court or a regulator. It writes the standard, and national law does the rest. That is why AML rules look so similar from Canada to Australia: most of them trace back to the same document.

What are the 40 Recommendations?

The current set was adopted in February 2012, merging the earlier money laundering rules with the terrorist financing recommendations, and it is amended regularly. The latest update was in June 2026. Together with their interpretive notes, the Recommendations form the FATF Standards. Several drive what banks do every day:

• Risk-based approach. Countries and firms should focus effort where risk is highest.
• Customer due diligence and beneficial ownership. The basis of KYC. In 2022, FATF tightened its beneficial ownership rules to stop criminals hiding behind secret company structures.
• Politically exposed persons. Extra measures for people in prominent public roles.
• Suspicious transaction reporting. The basis of the reporting system and of national financial intelligence units.
• Virtual assets. Since June 2019, binding rules for crypto asset service providers, including the travel rule on sending customer details with transfers.

How does a mutual evaluation work?

FATF checks each country by peer review. A team of experts from other countries studies the laws, visits on site, and writes a report. The evaluation has two parts. Technical compliance asks whether the laws and rules exist, with a rating for each of the 40 Recommendations. Effectiveness asks whether the system works, across eleven areas. FATF calls effectiveness the most important part.

The country under review has no say in who assesses it. The FATF Plenary discusses the report, and the country being assessed has no vote on it. A full evaluation can take up to 18 months. Under the current round, which began in 2024, countries also receive a time-bound roadmap of key actions to strengthen their defences within three years.

How do the grey and black lists work?

A separate group, the International Co-operation Review Group, reviews countries with serious weaknesses. A country may be reviewed because it is nominated by a member, does not take part in a regional body, or scores badly on its evaluation. One trigger is 20 or more non-compliant or partially compliant technical ratings. A country entering review through its evaluation gets a one-year observation period to fix problems before public identification.

Reviews of countries with larger financial sectors, such as those with US$5 billion or more in financial sector assets, are prioritised. FATF requires a high-level political commitment from each listed country to carry out its action plan.

FATF then publishes two statements at the end of each plenary:

• Jurisdictions under increased monitoring (grey list). The country has committed to an action plan and timeframes. Removal follows completed reforms and a successful on-site visit.
• Jurisdictions subject to a call for action (black list). For all countries on it, FATF calls on members and urges all jurisdictions to apply enhanced due diligence and, in the most serious cases, countermeasures.

The current membership of both lists is in the status note above. The lists are short and they move. In June 2026, two countries joined the grey list and two left it.

Why do countries care about being listed?

FATF gives its own reason. Global safeguards are only as strong as the jurisdiction with the weakest measures, and criminals can go around weak controls. The public warnings are meant to protect the international financial system and to put pressure on listed countries to fix their deficiencies “in order to maintain their position in the global economy,” as FATF puts it. Public identification, and the prospect of it, is itself the tool.

For a government, that pressure is about reputation and access to global finance. For banks, a listing is a prompt to look harder at customers and payments linked to that country, and on the black list FATF asks for enhanced due diligence directly. Each bank still sets its own risk ratings.

Where does FATF fall short?

FATF itself moved from checking laws toward checking results, which is why effectiveness now anchors each evaluation. Even so, the Wolfsberg Group notes in its 2024 monitoring statement that ever-growing report volumes have not shown a proportionate rise in useful information for authorities. A country can pass on paper and still catch little. See why detection still fails.

For how a country’s own system is judged, see Canada, whose mutual evaluation was adopted in June 2026. How transaction monitoring puts the standards into practice inside a bank is covered on its own page.

First published September 21, 2026 · Last updated September 21, 2026 · Legal statuses current as of September 2026