The FATF October 2026 plenary closed in Paris on 30 October as the first meeting under the UK Presidency of Giles Thomson. On the lists, the headline is short: four jurisdictions left the grey list, none joined it, and the black list kept the same three names. For an enterprise compliance team, the decision is the easy part. The work is getting it into country-risk tables, customer risk scores, EDD populations and monitoring rules in a way an auditor or regulator can follow later.
This article sets out what the plenary decided, why a delisting should not trigger an automatic downgrade, and a change-control workflow your team can run after every plenary.
What the FATF Decided on 30 October 2026
The FATF removed Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco from its list of jurisdictions under increased monitoring after successful on-site visits. Each will keep working with its regional body: MONEYVAL for Bulgaria and Monaco, GIABA for Côte d'Ivoire, and GABAC and ESAAMLG for the DRC. Starting from the 22 names on the 19 June 2026 list, that leaves 18 jurisdictions under increased monitoring.
| List | October 2026 outcome | Operational note |
|---|---|---|
| Grey list (increased monitoring) | Bulgaria, Côte d'Ivoire, DRC and Monaco removed. No additions. 18 remain. | Review internal ratings for the four. Do not close open EDD cases automatically. |
| Grey list warning | The FATF will consider next steps if Vietnam does not make tangible improvements by the next plenary. | Treat Vietnam as a watch item ahead of February 2027. |
| Black list (call for action) | DPRK and Iran remain subject to countermeasures. Myanmar remains subject to enhanced due diligence. | No population change. Statements on Myanmar (fraud and scams) and Iran (TF offence and sanctions regime) were updated. |
| Black list escalation point | The FATF will consider countermeasures on Myanmar if no further progress is made by February 2027. | Prepare the decision path now if countermeasures would change your treatment of Myanmar-linked business. |
The 18 jurisdictions still under increased monitoring are Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK) and Yemen. Load your table from the FATF statement itself rather than from this list or any secondary summary.
Two other outcomes will reach screening files later. The plenary adopted the mutual evaluation reports of Mexico and the United States, and it launched a targeted review of jurisdictions with materially important virtual asset activity, with results due in June and October 2027.
Why a Grey-List Removal Is Not an Automatic Risk Downgrade
An FATF statement is an international assessment. It is not, by itself, a domestic legal obligation. Each jurisdiction you operate in decides how FATF lists feed its law, and those links move on different timetables.
- Australia. Under the AML/CTF Act as amended in 2024, a customer connection to a jurisdiction the FATF has called on members to apply enhanced due diligence or countermeasures to is a trigger for enhanced customer due diligence. Grey-list status is an input to your ML/TF risk assessment rather than a standalone trigger. Confirm the exact wording against the Act and the AML/CTF Rules 2025 for your designated services.
- United Kingdom. Mandatory EDD under regulation 33(1)(b) of the Money Laundering Regulations 2017 now refers to FATF call-for-action countries only, following an amendment in force from 30 June 2026. Grey-list status remains a geographical risk factor, and EDD is still mandatory under regulation 33(1)(a) where your own assessment finds high risk.
- European Union. Article 18a EDD applies to countries in the Annex to Delegated Regulation (EU) 2016/1675. That Annex changes only when the Commission amends it, so Côte d'Ivoire, the DRC and Monaco stay in scope until an amending act enters into force. Bulgaria is an EU Member State and was never in the Annex.
- United States. FinCEN's release of 30 October asks institutions to consider the FATF's reasons for each delisting when assessing risk, and cautions against wholesale de-risking.
The practical consequence is that a single "FATF high risk: yes/no" flag cannot carry this information. Country tables work better with separate fields for FATF status, the legal trigger in each operating jurisdiction, your internal rating, the effective date and the rationale for any change. When a regulator asks why Monaco-linked customers were re-scored on a given date, the answer is already recorded.
A delisting tells you the FATF verified that an action plan was completed. It does not tell you that every customer, beneficial owner or transaction linked to that country is now lower risk. Your rating should reflect the FATF's reasons, your own exposure, and any other risk indicators you hold.
A Five-Step Change-Control Workflow After Each Plenary
The decisions from the FATF October 2026 plenary are a good test of whether your process is repeatable. The workflow below is MemberCheck's practitioner framework, not a regulatory requirement.
- Capture the source. Save the FATF increased-monitoring and call-for-action statements dated 30 October 2026, with the retrieval date. Every later decision should point back to these documents.
- Map legal triggers. For each jurisdiction where you hold obligations, record whether the change alters a mandatory EDD trigger (Australia, UK, EU, US and others) or only a risk input. In October 2026, the answer differs by regime for the same four countries.
- Decide the internal rating. Approve any rating change through your governance route, citing the FATF's reasons, the on-site verification, continuing regional-body follow-up and your own exposure data. A documented decision to keep a rating unchanged is as valid as a downgrade.
- Re-score the affected population. Identify customers, beneficial owners and counterparties linked to the four removed jurisdictions, Vietnam and Myanmar through nationality, residence, incorporation or transaction corridors. Re-run customer risk scores. Close or step down EDD only through a recorded review, not by bulk update.
- Update rules and keep evidence. Adjust onboarding rules, ongoing monitoring scenarios and alert thresholds that reference country risk. Keep a change log showing who approved what, when it went live and how many records it touched.
Most teams can run steps 1 and 2 within days of a plenary. Steps 3 to 5 depend on data quality: if country of residence or incorporation is missing for part of the customer base, the re-scoring step will understate exposure, and that gap is worth reporting to your risk committee in its own right.
What to Watch Before the February 2027 Plenary
- Vietnam. The FATF expressed significant concern about the pace of progress. If next steps follow in February 2027, they could affect Vietnam-linked onboarding and corridor monitoring.
- Myanmar. A move from enhanced due diligence to countermeasures would be a material change for any business with exposure to Myanmar, and the updated statement centres on fraud and scam activity.
- Mexico and United States evaluations. The reports adopted at this plenary are expected to be published after the FATF's quality and consistency review. Their ratings may feed country-risk models once public.
- Virtual assets. The new targeted review will report in June and October 2027. Teams with VASP customers or crypto-linked flows should expect jurisdiction-level findings that bear on counterparty risk.
- Scam compounds. The plenary approved a report on illicit financial flows linked to scam compounds. Once published, its typologies are worth testing against your monitoring scenarios.
How MemberCheck Supports Country-Risk Updates
MemberCheck provides tools that can form part of this workflow, including customer risk assessment, ongoing monitoring of screened customers, batch screening for re-running a defined population, and audit records that show what was checked and when. Regulated entities remain responsible for their own risk assessment and for deciding how FATF changes apply to their obligations.
If you are reviewing how your team handles plenary updates, request a MemberCheck demo to see how screening, monitoring and audit records fit into that process. For the wider fraud implications of this plenary, read our analysis of AI-enabled scams, synthetic identities and deepfakes.
