Outcomes of the FATF Plenary, June 2023

The FATF plenary of 21 to 23 June 2023 added Cameroon, Croatia and Vietnam to its list of jurisdictions under increased monitoring, removed none, left the call-for-action list unchanged, adopted Luxembourg's mutual evaluation report, and published its fourth targeted update on virtual assets. No FATF Recommendation was amended at that meeting.

Key takeaways

• Three additions and no removals took the grey list to 26 jurisdictions on 23 June 2023, the largest it had been since 2021.
• No new virtual asset standard was created. The plenary published an implementation report showing 75% of assessed jurisdictions only partially compliant or non-compliant with Recommendation 15.
• Luxembourg was rated compliant or largely compliant on 39 of 40 Recommendations, with a single partially compliant rating on Recommendation 8.
• A FATF listing is not itself law. Cameroon and Vietnam became a binding EU enhanced due diligence trigger only in October 2023, and a UK one on 5 December 2023.
• Croatia was removed on 13 June 2025. Cameroon and Vietnam were still listed after the plenary of 19 June 2026, with all action plan deadlines expired.

What did the FATF June 2023 plenary decide?

The meeting ran from 21 to 23 June 2023 in Paris, the third plenary under the presidency of T. Raja Kumar of Singapore, with delegates from the more than 200 jurisdictions of the Global Network. Its published outcomes cover four things a compliance team has to act on: list changes, an adopted mutual evaluation, an implementation report on virtual assets, and standard-setting work put out for consultation.

Two of those are immediately operational. List changes feed country risk ratings and, in several jurisdictions, statutory enhanced due diligence triggers. An adopted mutual evaluation changes how you assess counterparty risk in that country and what your correspondent banks will ask about it.

The rest was pipeline. Amendments to Recommendations 4 and 38 on asset recovery, and to Recommendation 8 on non-profit organisations, were still in draft at this point and were only adopted at the October 2023 plenary. Jeremy Weil of Canada was confirmed as vice-president with effect from 1 July 2023.

Which countries were grey-listed, and where are they now?

Cameroon, Croatia and Vietnam were identified as jurisdictions under increased monitoring on 23 June 2023, each having made a high-level political commitment to work through an action plan. Nothing was removed, so the list moved from 23 to 26 jurisdictions.

The plenary did approve on-site visits to Albania, the Cayman Islands, Jordan and Panama, all of which had substantially completed their action plans. All four were delisted at the October 2023 plenary, which is why the practical effect of the June sitting was a net increase that reversed within four months.

Three years on, the three additions have diverged sharply. That divergence is the reason a grey-list entry should never be copied into a static country risk table.

Country context sits on our Croatia, Cameroon and Vietnam coverage pages.

How did the June 2023 listing become a legal obligation?

A FATF listing carries no direct legal force. It becomes binding only when a national or supranational instrument picks it up, and in June 2023 that transposition took months. Firms that waited for the law were applying standard due diligence to Cameroonian and Vietnamese relationships for an entire quarter after FATF had flagged them.

In the EU, Commission Delegated Regulation (EU) 2023/2070 was adopted on 18 August 2023, published in the Official Journal on 28 September 2023 and entered into force twenty days later. Only then did the mandatory measures in Article 18a of Directive (EU) 2015/849 attach, including source of funds and source of wealth, senior management approval and increased monitoring.

The UK change is the one worth noting. Since 23 January 2024 a FATF listing bites in UK law on the day FATF publishes it, so regulation 33 enhanced due diligence now follows the plenary rather than the next statutory instrument. The EU still requires a delegated act, and the lag persists.

Why did Croatia's listing not trigger EU enhanced due diligence?

Because Croatia is an EU member state, and the EU list under Article 9 of Directive (EU) 2015/849 covers third countries only. A member state cannot be added to it, so the Article 18a package of mandatory measures never applied to Croatian counterparties despite the FATF finding.

The UK took the opposite route. SI 2023/1306 placed Croatia in Schedule 3ZA from 5 December 2023, which made regulation 33 enhanced due diligence mandatory for UK firms dealing with persons established there, for roughly eighteen months until FATF delisted Croatia.

The lesson for a multi-jurisdiction programme is that "grey-listed" is not a single control state. The same FATF decision produced a statutory EDD trigger in London, a risk-based judgement call in Frankfurt, and different answers again outside both. Encode the trigger per jurisdiction, not per country flag, and record which rule you applied. Our enhanced due diligence page sets out what the resulting file needs to contain.

What did the plenary actually change for virtual assets?

Nothing in the standards themselves. Recommendation 15 and its interpretive note had already been extended to virtual asset service providers in 2018 and 2019, and the roadmap to strengthen implementation was agreed at the February 2023 plenary, not this one. What June 2023 produced was measurement.

The plenary agreed to publish the fourth targeted update on implementation of the FATF standards on virtual assets and VASPs. Across 98 mutual evaluation and follow-up reports since the revised Recommendation 15 was adopted, 75% of jurisdictions were only partially compliant or non-compliant. Of 151 jurisdictions responding to FATF's 2023 survey, more than half had taken no steps at all towards the travel rule, and 34% had not carried out a virtual asset risk assessment.

That gap is a counterparty risk problem rather than a standards problem. If a majority of jurisdictions have not implemented the travel rule, originator and beneficiary data on inbound virtual asset transfers will be absent or unverified, and your own controls have to compensate. See our guide to the FATF travel rule and KYC for crypto.

What did Luxembourg's mutual evaluation find?

Luxembourg's fourth-round report was adopted at this plenary and published on 27 September 2023, following an on-site visit from 2 to 18 November 2022. On technical compliance the report rated Luxembourg compliant on 28 of the 40 Recommendations and largely compliant on 11. The single partially compliant rating was Recommendation 8, on non-profit organisations.

Effectiveness was more mixed than the headlines suggested. None of the 11 immediate outcomes reached a high level. Five were rated substantial, covering risk and policy co-ordination, international co-operation, legal persons and arrangements, financial intelligence, and terrorist financing investigation. Six were rated moderate: supervision, preventive measures, money laundering investigation and prosecution, confiscation, terrorist financing preventive measures, and proliferation financing sanctions.

Luxembourg was placed in regular follow-up, the best available outcome, and the CSSF's risk-based supervisory approach was singled out for praise. The moderate rating on supervision reflected the non-financial sectors rather than banking. Read alongside our explainer on what mutual evaluations mean for financial institutions and the Luxembourg coverage page.

What standard-setting work was put out for consultation?

Two strands. The plenary agreed to release potential revisions to Recommendation 8 and its interpretive note for public consultation, together with an updated best practices paper on combating the abuse of non-profit organisations. The aim was to curb over-application of preventive measures to the sector, where blanket de-risking had cut legitimate charities out of the banking system.

Separately, the plenary discussed enhancements to Recommendations 4 and 38 to strengthen freezing, seizure and confiscation, including non-conviction-based confiscation and property of corresponding value. Both packages were finalised at the October 2023 plenary rather than this one.

Members also progressed the universal procedures for the fifth round of mutual evaluations, and took updates on projects covering the misuse of citizenship and residency by investment schemes, cyber-enabled fraud, and crowdfunding for terrorist financing. Note the internal consistency point: Luxembourg's only partially compliant rating was on the same Recommendation 8 that FATF had just conceded needed rewriting.

What should a compliance team have done with these outcomes?

Four actions, in order. Re-rate Cameroon, Croatia and Vietnam in the country risk model on the date of the FATF publication, not the date of national transposition, and record the earlier date as the trigger. Then identify every existing customer, beneficial owner and counterparty with a nexus to those three, which is a screening and data question before it is a policy question.

Next, check whether the listing changed your legal obligation or only your risk assessment. In the UK from January 2024 it does both automatically. In the EU it does neither until a delegated act lands, and never for a member state such as Croatia. Separately, confirm that the call for action list was unchanged, as it was in June 2023: the DPRK, Iran and Myanmar.

Finally, build the reverse path. Croatia's delisting in June 2025 should have downgraded ratings and closed out enhanced measures just as promptly as the listing raised them, and a programme that only ratchets upwards accumulates unjustified friction. MemberCheck's country risk data tracks both directions of FATF list movement. See our jurisdiction risk and PEP and sanctions screening pages, the February 2023 plenary outcomes, and the wider jurisdictions and regulation collection.