FATF maintains two public lists. The blacklist, formally High-Risk Jurisdictions subject to a Call for Action, held three jurisdictions after the June 2026 plenary. The grey list, formally Jurisdictions under Increased Monitoring, held 22. Neither is a sanctions regime, yet both trigger mandatory enhanced due diligence in most major jurisdictions.
Key takeaways
- After the plenary of 17 to 19 June 2026, three jurisdictions sat on the call-for-action list and 22 on the increased-monitoring list.
- FATF imposes nothing directly. The binding duty comes from national law, such as regulation 33 of the UK Money Laundering Regulations 2017.
- National lists are not copies of FATF's. The Russian Federation has been on the EU high-risk list since 29 January 2026 while appearing on neither FATF list.
- Grey-listing is measurably costly for the listed country, with IMF research putting the average fall in capital inflows at 7.6 percent of GDP.
- List changes carry a commencement date. The UK regulations giving effect to the June 2026 update came into force on 30 June 2026, eleven days after the plenary closed.
How does the FATF blacklist differ from the grey list?
The two lists differ in severity and in what FATF asks its members to do. The call-for-action list identifies jurisdictions whose deficiencies are serious enough that members are urged to apply countermeasures, up to and including restrictions on correspondent relationships. The increased-monitoring list identifies jurisdictions that have agreed an action plan with FATF and are working through it against agreed timeframes.
Grey-listing is therefore a supervised remediation status with a defined exit, evidenced by an on-site visit before removal. Call-for-action status reflects a failure or refusal to remediate. The underlying standard for both sits in Recommendation 19 of the FATF Recommendations, which requires enhanced due diligence for higher-risk countries and countermeasures where FATF calls for them.
| Feature | Call for action (blacklist) | Increased monitoring (grey list) |
|---|---|---|
| Formal name | High-Risk Jurisdictions subject to a Call for Action | Jurisdictions under Increased Monitoring |
| Entries after 19 June 2026 | 3 | 22 |
| What FATF asks of members | Enhanced due diligence, plus countermeasures in the most serious cases | Enhanced due diligence proportionate to the risk |
| Action plan agreed with FATF | No | Yes, against agreed timeframes |
| Route off the list | Address the identified deficiencies and re-engage | Complete the action plan, then a successful on-site visit |
| Review cadence | Every plenary, three times a year | Every plenary, three times a year |
Which jurisdictions are listed after the June 2026 plenary?
Three jurisdictions sat on the call-for-action list: the Democratic People's Republic of Korea, Iran and Myanmar. Countermeasures are called for against the first two on proliferation financing grounds. Myanmar, listed since October 2022, attracts enhanced due diligence rather than countermeasures, and FATF has said it will consider countermeasures if there is no further progress by October 2026.
The 22 jurisdictions under increased monitoring were Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Cote d'Ivoire, the Democratic Republic of the Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK) and Yemen. HM Treasury restated the same set in its June 2026 advisory notice, using the name British Virgin Islands.
| Change at the plenary of 17 to 19 June 2026 | Jurisdiction |
|---|---|
| Added to increased monitoring | Bosnia and Herzegovina |
| Added to increased monitoring | Iraq |
| Removed from increased monitoring | Algeria |
| Removed from increased monitoring | Namibia |
| Unchanged on call for action | Democratic People's Republic of Korea, Iran, Myanmar |
Country-level detail for the newly added jurisdictions sits on our Iraq and Bosnia and Herzegovina coverage pages.
What does a FATF listing legally require you to do?
Nothing, on its own. FATF is a standard-setting body established by the G7 in Paris in 1989, and its membership has grown from the original 16 to 40, including all G20 countries. It publishes findings and calls on members to act. The enforceable duty always arrives through national law.
In the United Kingdom, regulation 33(1)(b) of the Money Laundering Regulations 2017 requires enhanced due diligence in any business relationship with a person established in a FATF call-for-action country, a term defined at regulation 33(3)(a) by direct reference to the FATF list as it has effect from time to time. That dynamic reference is what makes a plenary outcome operative in UK law without new primary legislation.
Regulation 33(3A) then prescribes six measures rather than leaving intensity to firm judgement: additional information on the customer and beneficial owner, additional information on the intended nature of the relationship, information on source of funds and source of wealth, information on the reasons for the transactions, senior management approval to establish or continue the relationship, and enhanced ongoing monitoring. Our enhanced due diligence page sets out what a defensible file against those six looks like.
How do the UK, EU and US positions diverge from FATF's?
Assuming the three follow FATF is the single most common design error in a country risk model. Each regime sets its own list, on its own cycle, with its own legal trigger. A programme that screens against FATF alone will under-apply enhanced due diligence in the European Union and over-apply it nowhere useful.
| Regime | How the list is set | Divergence to plan for |
|---|---|---|
| United Kingdom | Regulation 33(3)(a) of the Money Laundering Regulations 2017 refers directly to the FATF lists; HM Treasury issues an advisory notice after each plenary | Fast alignment with FATF, but the amending regulations for the June 2026 update took effect on 30 June 2026, not on the plenary date |
| European Union | Commission Delegated Regulation (EU) 2016/1675 as amended, feeding the mandatory enhanced due diligence trigger in Article 18a of Directive (EU) 2015/849 | Broader than FATF and slower to update. As of August 2026 the EU list included Afghanistan, Trinidad and Tobago and Vanuatu, none of which appear on a FATF list, and still carried Algeria and Namibia after their FATF removal |
| European Union, Russia | Commission Delegated Regulation (EU) 2026/46 added a new Annex point IV for jurisdictions whose FATF membership is suspended | The Russian Federation is a high-risk third country in the EU from 29 January 2026 while on no FATF list at all |
| United States | No published country list of this kind. Treasury acts through section 311 special measures and OFAC sanctions programmes | The fifth special measure bars US institutions from maintaining correspondent accounts for Iranian and North Korean financial institutions, which bites harder than any FATF call |
The practical rule is to drive your risk model from the union of the applicable lists, and to record which instrument triggered the treatment. Our AML in the USA explainer covers the American side in more depth.
What does grey-listing actually cost the listed jurisdiction?
The reputational effect is quantifiable. IMF Working Paper 21/153 estimates that capital inflows fall on average by 7.6 percent of GDP when a jurisdiction is grey-listed, made up of a 3.2 percent fall in foreign direct investment, 3.3 percent in portfolio inflows and 3.1 percent in other inflows.
The transmission channel matters more to a compliance team than the headline. Inflows fall largely because correspondent banks and investors withdraw rather than absorb the higher cost of diligence, so a listing that changes nothing about a given customer still changes their access to payment rails.
That has two consequences for you. Customers in a newly listed jurisdiction will present payment routing changes, new intermediaries and unfamiliar counterparties, all of which are legitimate responses that also raise risk. Blanket exit from a listed country is not the answer either, since wholesale de-risking is itself a supervisory concern and destroys the visibility you need.
How should a compliance team respond to a plenary outcome?
Treat the plenary as a scheduled event with a fixed clock, not news. The June 2026 sequence ran from the plenary closing on 19 June to the UK amending regulations taking effect on 30 June, so the working window between publication and legal effect was eleven days.
A workable response has five steps. Identify every customer incorporated, resident or materially transacting in a newly listed jurisdiction. Re-rate those relationships, apply the six regulation 33(3A) measures where the country is call-for-action, obtain senior management approval to continue, and increase monitoring frequency. Then repeat the exercise in reverse for delisted jurisdictions, because leaving Algeria and Namibia rated as high risk after June 2026 is as much a control defect as missing Iraq.
The step teams most often skip is the back book. New onboarding picks up the change automatically; existing customers only do so if the country field on the record is re-evaluated against the new list. MemberCheck maintains country coverage against the published lists so a re-rating runs against current data rather than a policy annexe someone last edited two plenaries ago.
Is a country risk model built only on the FATF lists defensible?
Not on its own, and supervisors increasingly say so. List membership is binary and lagging. FATF acts after a mutual evaluation and a follow-up cycle, so a jurisdiction with deteriorating controls can sit off both lists for years, and the Russian Federation case shows a jurisdiction can carry serious risk while fitting no FATF category.
The lists are best used as a floor rather than the model. Underneath them, mutual evaluation ratings give a far finer signal, since technical compliance and effectiveness ratings are published per Recommendation and per immediate outcome. Our explainer on FATF mutual evaluations sets out how to read them.
Layer sectoral and product risk on top. A jurisdiction can be unlisted and still be high risk for cash-intensive businesses, bearer instruments or a specific virtual asset corridor, and a listed jurisdiction can be low risk for a narrow domestic product. Our jurisdiction risk page and the glossary of AML terms cover the scoring inputs.
What do compliance teams most often get wrong about the FATF lists?
Five errors recur in remediation work. The first is describing a listing as a sanction. FATF imposes none, and conflating the two produces policies that cite the wrong legal basis and fall over at audit.
The second is cadence. The lists are revised at every plenary, three times a year, as the June 2026 plenary outcomes show, so an annual policy refresh guarantees stale ratings for months at a time. The third is treating grey-listing as a prohibition, which drives exit decisions that no regulation requires.
The fourth is copying the FATF list into a policy without mapping it to the list your own regime enforces, which leaves EU-facing firms short on Afghanistan, Vanuatu and Russia. The fifth is publishing a country list as static text, which is why FATF's own black and grey lists page is the reference point rather than any secondary summary. Pair the country view with name-level controls: sanctions and PEP screening, adverse media checks and, for practice detail, sanctions screening best practice and our jurisdictions and regulation collection.
