A FATF mutual evaluation rates a country twice: on technical compliance with the 40 Recommendations, and on the effectiveness of its system against 11 Immediate Outcomes. Grey-list status is only the headline. The rating detail underneath is what a defensible country risk model should be built on, and in the UK it is now the only part that still bites.
Key takeaways
- Twenty-two jurisdictions were under increased monitoring after the plenary of 19 June 2026, plus three subject to a call for action. Iraq and Bosnia and Herzegovina were added; Algeria and Namibia left.
- Since 30 June 2026 the UK no longer requires mandatory enhanced due diligence for grey-listed jurisdictions. Only FATF call for action countries trigger it automatically.
- The fifth evaluation round runs on a six-year cycle rather than roughly ten, and attaches a time-bound roadmap of Key Recommended Actions to each report.
- Australia's own 2015 evaluation returned six moderate effectiveness ratings and non-compliant marks on Recommendations 22 and 23, which is the gap the 1 July 2026 reforms close.
- A never-listed jurisdiction can still carry real risk. Singapore's 2026 report rated it moderate on beneficial ownership and partially compliant on Recommendations 24 and 25.
How does a FATF mutual evaluation actually work?
An evaluation has two components that are scored separately. Technical compliance is a desk-based review of laws, regulations and institutional frameworks against the 40 Recommendations. Effectiveness is an assessment of what the system actually delivers, measured against 11 Immediate Outcomes set out in the FATF Methodology.
FATF has 38 member jurisdictions plus two regional organisations, the European Commission and the Gulf Co-operation Council, per HM Treasury's advisory notice. Everyone else is assessed by a FATF-Style Regional Body. Members of both are assessed under FATF procedures, with the regional body adopting the same report, as the Asia/Pacific Group explains.
The sequence is slow and worth knowing when you read a rating. Singapore's fifth-round assessment ran an on-site visit from 1 to 18 July 2025, was adopted at the February 2026 plenary and published in May 2026. A rating you read today therefore describes a system as it stood many months earlier.
What do the two rating scales actually mean?
Confusing the scales is the most common error in country risk documentation. Technical compliance measures whether the law on the books matches the standard. Effectiveness measures whether anything happens as a result. A jurisdiction can be largely compliant almost everywhere and still be rated moderate on outcomes.
| Dimension | Measured against | Rating scale | What a weak rating tells you |
|---|---|---|---|
| Technical compliance | The 40 FATF Recommendations | Compliant, largely compliant, partially compliant, non-compliant | A legal or regulatory gap. Often a scope gap, where a sector simply is not covered. |
| Effectiveness | 11 Immediate Outcomes | High, substantial, moderate, low | Supervision, prosecution, confiscation or registry practice is not producing results, even where the law is adequate. |
In the fifth round, technical compliance is only re-assessed where the country has changed its framework since the last report, or where the FATF Standards themselves have moved. Unchanged Recommendations carry forward the earlier rating, so a single report can mix findings that are a decade apart in vintage.
What changed in the fifth round of evaluations?
The fifth round began in 2024 under the 2022 Methodology and runs on a six-year cycle, against roughly ten years for earlier rounds. The 2022 procedures also sequence assessments by risk, so the jurisdictions with the weakest previous scores and the highest risk are assessed first.
The most useful addition for a risk team is the roadmap of Key Recommended Actions. Each report now names the highest-priority measures, attaches them to specific Immediate Outcomes and forms the basis of the follow-up process. Singapore's roadmap, adopted at the February 2026 plenary, lists twelve actions across four Immediate Outcomes.
Regional timing lags the global round. The Asia/Pacific Group notes that its own member evaluations start in 2026, with the first reports adopted from 2027 and follow-up beginning in 2030 (APG). Expect fourth-round ratings to remain in circulation for several more years.
Which jurisdictions are currently listed by FATF?
Both lists are refreshed on the final day of each plenary. The position after 19 June 2026 is set out in FATF's statements on increased monitoring and on jurisdictions subject to a call for action, and restated verbatim by HM Treasury.
| List | Count at 19 June 2026 | Jurisdictions |
|---|---|---|
| Call for action | 3 | Democratic People's Republic of Korea, Iran, Myanmar |
| Increased monitoring | 22 | Angola, Bolivia, Bosnia and Herzegovina, British Virgin Islands, Bulgaria, Cameroon, Côte d'Ivoire, Democratic Republic of the Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, Yemen |
Iraq and Bosnia and Herzegovina joined at that plenary; Algeria and Namibia left it. Nine of the 25 listed jurisdictions are also subject to UK financial sanctions, which impose obligations that have nothing to do with FATF listing and are not discharged by applying enhanced due diligence.
Does grey-listing still trigger mandatory enhanced due diligence?
Less often than most policies assume, and the UK position changed recently. Until 30 June 2026, a person established in any FATF-listed jurisdiction was a high-risk third country customer and attracted mandatory enhanced due diligence under regulation 33(1)(b) of the Money Laundering Regulations 2017.
Regulation 19 of the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 replaced the term "high-risk third country" in regulation 33(1)(b) with "FATF call for action country", defined solely by reference to the call for action list. Grey-listing is now a geographical risk factor firms must weigh under regulation 33(6)(c), not an automatic legal trigger.
| Jurisdiction | What triggers mandatory enhanced due diligence on FATF listing |
|---|---|
| United Kingdom, to 29 June 2026 | Both lists. Any of the 25 listed jurisdictions. |
| United Kingdom, from 30 June 2026 | Call for action list only. Grey-listed jurisdictions revert to a risk factor under regulation 33(6)(c). |
| Australia | Only where FATF has called for enhanced customer due diligence to be applied, per AUSTRAC. Iran and the DPRK are separately the only prescribed foreign countries. |
The practical effect is the same in both directions: the evaluation detail, not the list, is what has to carry your risk rating. A policy that says "apply enhanced due diligence to grey-listed countries" and nothing else is now under-specified in the UK and was never sufficient in Australia.
What did Australia's own mutual evaluation find?
Australia's fourth-round report was adopted in April 2015 after an on-site visit from 30 July to 12 August 2014, and placed the country into enhanced follow-up. The effectiveness picture was mixed rather than poor: one high rating, four substantial and six moderate, with no low ratings.
| Immediate Outcome | 2015 rating |
|---|---|
| IO.2 International co-operation | High |
| IO.1 Risk, policy and co-ordination | Substantial |
| IO.6 Financial intelligence | Substantial |
| IO.9 TF investigation and prosecution | Substantial |
| IO.11 PF financial sanctions | Substantial |
| IO.3 Supervision | Moderate |
| IO.4 Preventive measures | Moderate |
| IO.5 Legal persons and arrangements | Moderate |
| IO.7 ML investigation and prosecution | Moderate |
| IO.8 Confiscation | Moderate |
| IO.10 TF preventive measures and financial sanctions | Moderate |
The sharper finding sat in technical compliance. Recommendations 22 and 23 were both rated non-compliant on a scope issue: designated non-financial businesses and professions other than casinos and bullion dealers were not subject to AML/CTF obligations at all (Australia MER 2015). Australia's fourth enhanced follow-up report, adopted in March 2024, re-rated Recommendations 10, 13, 17, 18 and 26 upwards but downgraded Recommendation 15 to partially compliant, leaving six partially compliant and four non-compliant ratings.
Those four gaps are the direct lineage of the current reforms. AUSTRAC confirms that changes for existing reporting entities started on 31 March 2026, and that real estate professionals, dealers in precious stones and metals, lawyers, conveyancers, accountants and trust and company service providers are regulated from 1 July 2026. See our note on the 2024 amendments and what Tranche 2 means for AML teams.
How should evaluation ratings feed a country risk model?
Score the Immediate Outcomes that map to the risk you are actually taking, rather than averaging all eleven into a single country number. For correspondent banking, IO.3 (supervision), IO.4 (preventive measures) and IO.5 (beneficial ownership) tell you how much weight the respondent's own controls can bear. For asset tracing and information requests, IO.2, IO.6 and IO.8 matter more.
Singapore's 2026 report shows why list status is a poor proxy. Singapore has never been listed and was placed in regular follow-up, yet it was rated moderate on IO.5, IO.7, IO.10 and IO.11, and partially compliant on Recommendations 24 and 25 on beneficial ownership transparency (Singapore MER 2026).
That is an operational instruction, not a headline. If the assessors found that registry beneficial ownership data is not verified consistently, a firm relying on that registry as its sole ownership evidence has an evidenced control gap. Record the rating, its vintage and the specific finding you relied on in your jurisdiction risk methodology, so a reviewer can reconstruct the reasoning.
How should teams handle the three-times-a-year list cycle?
Treat the plenary calendar as a change event, not a newsletter. HM Treasury notes that the lists are updated on the final day of each February, June and October plenary, and reissues its advisory notice afterwards. The effective date of a change is the plenary closing date, not the day your team reads about it.
Removals need as much handling as additions. Algeria and Namibia left the grey list on 19 June 2026, so any control applied purely on list status should be unwound, with the rationale recorded. Firms that only revisit jurisdiction risk at periodic review will hold stale enhanced measures on two countries and none on two others for up to a year.
The workable pattern is to hold the jurisdiction list as data rather than policy text, rescreen the affected portfolio when it changes, and log which version drove each decision. MemberCheck rescreens the stored customer record on list change rather than waiting for the next scheduled review, which is what makes the June and October cycles survivable. For related reading see our post on the FATF blacklist, enhanced due diligence for high-risk jurisdictions, the Australia country coverage page and our jurisdictions and regulation collection.
