FATF's plenary of 22 to 24 February 2023 suspended Russia's membership, added South Africa and Nigeria to the grey list, removed Cambodia and Morocco, and adopted revisions to Recommendation 25 on legal arrangements. This page records those decisions and tracks what has since happened to each jurisdiction.
Key takeaways
- The suspension of the Russian Federation on 24 February 2023 was the first suspension of a FATF member, and it was still in force after the plenary of 17 to 19 June 2026.
- South Africa and Nigeria were grey-listed at this plenary and both exited on 24 October 2025, South Africa after completing a 22-item action plan.
- The plenary changed a Standard, not just guidance: Recommendation 25 on legal arrangements was revised to align with the Recommendation 24 requirements for legal persons.
- EU law lagged the FATF decision by roughly four months in 2023 and by about ten weeks in 2025, and EU enhanced due diligence obligations attach to the EU list rather than the FATF list.
- The virtual asset roadmap agreed here produced the June 2024 targeted update, which found 75% of assessed jurisdictions only partially compliant or non-compliant with Recommendation 15.
What did FATF decide about Russia at this plenary?
FATF suspended the membership of the Russian Federation on 24 February 2023, one year after the full-scale invasion of Ukraine. Russia lost the right to attend plenary meetings in person or remotely, to access member-only documents, and to take part in project teams. It remained accountable for implementing the FATF Standards and kept its place in the Global Network as a member of the Eurasian Group (EAG).
The grounds were institutional rather than technical. FATF held that Russia's conduct ran counter to the principles of security, safety and integrity of the global financial system that members sign up to, which is a different test from any mutual evaluation rating.
The suspension has not been lifted. FATF reconsiders the grounds at every plenary, and its statement on the Russian Federation records the restrictions as still standing after the plenaries of 11 to 13 February 2026 and 17 to 19 June 2026. For screening purposes this is a governance decision, not a listing: Russia sits on neither the grey nor the black list, and Russian country risk is driven by OFAC, EU and UK sanctions instead.
Which jurisdictions changed grey-list status, and where are they now?
South Africa and Nigeria were added to the list of jurisdictions under increased monitoring. Cambodia and Morocco came off it. Three and a half years later, none of the four sits on the list, which is a useful reminder that a grey-list entry is a status with an expected exit date, not a permanent label.
| Jurisdiction | Decision, 24 February 2023 | Where it stands, August 2026 |
|---|---|---|
| South Africa | Added to increased monitoring with an agreed action plan | Removed on 24 October 2025 after completing 22 action items, confirmed by an on-site visit in July 2025 (SARS) |
| Nigeria | Added to increased monitoring with an agreed action plan | Removed on 24 October 2025 at the same plenary, alongside Burkina Faso and Mozambique |
| Cambodia | Removed from increased monitoring | Still off the list; EU delisting took effect in July 2023 (EUR-Lex) |
| Morocco | Removed from increased monitoring | Still off the list; EU delisting took effect on the same date |
South Africa's exit came 32 months after listing, which is close to the typical two to three year action plan cycle. If your country-risk model treats a listing as a step change that never reverses, it will misprice four jurisdictions from this single plenary. See our South Africa coverage and Nigeria coverage for the current regime detail.
What did the Qatar and Indonesia mutual evaluations conclude?
The plenary adopted mutual evaluation reports for Qatar and for Indonesia, then an observer that had held that status since June 2018.
Indonesia was found to have a strong legal, regulatory and institutional framework producing robust technical compliance across several areas, with good results in countering terrorist financing, using financial intelligence, and domestic and international co-operation. The gaps FATF identified were pursuing larger-scale money launderers and improving asset confiscation. Indonesia was admitted as FATF's 40th member at the October 2023 plenary.
Qatar's technical compliance with the FATF Standards was assessed as very strong, with a clear improvement in its national understanding of money laundering and terrorism financing risk. FATF asked for a stronger law enforcement response, better availability of and access to beneficial ownership information for competent authorities, and stronger implementation of targeted financial sanctions for proliferation financing. The Qatar report was published in May 2023. For how these ratings feed a country-risk model, see what mutual evaluations mean for financial institutions.
What changed in the beneficial ownership standards?
The substantive standards change at this plenary was to Recommendation 25, on transparency and beneficial ownership of legal arrangements. FATF had toughened Recommendation 24 for legal persons in March 2022; the February 2023 revisions brought the requirements for trusts and similar arrangements broadly into line, so that the two Recommendations form one coherent set rather than a strict company regime beside a weaker trust regime.
Delegates also signed off guidance to help countries and the private sector implement the revised Recommendation 24. FATF published that Guidance on Beneficial Ownership of Legal Persons in March 2023, covering risk assessment for legal persons and the mechanisms competent authorities can use to verify beneficial ownership information rather than accept it as filed. Companion guidance on legal arrangements followed after a public consultation.
The practical consequence for onboarding is that a self-declared beneficial ownership form is a weaker control than it was before March 2022. See preventing misuse of legal persons.
What did the virtual assets roadmap produce?
The plenary agreed a roadmap to strengthen implementation of Recommendation 15 on virtual assets and virtual asset service providers, with a commitment to report in the first half of 2024 on what FATF members and FSRB countries with materially important virtual asset activity had done to regulate and supervise VASPs.
That commitment was met. The June 2024 targeted update drew on 130 mutual evaluation and follow-up reports issued since the revised Recommendation 15 was adopted in 2019 and found that 75% of assessed jurisdictions were only partially compliant or non-compliant. Travel Rule implementation was singled out as the weakest area.
For a firm with virtual asset exposure, that figure is the operative one. It means a counterparty VASP in a jurisdiction with a legal framework on paper may still be sending transfers without originator and beneficiary data attached, so the receiving institution carries the identification burden. Our guide to the Travel Rule sets out what the data element requirements actually are.
How long did EU law take to catch up with these decisions?
FATF decisions are not directly binding. In the EU, enhanced due diligence obligations attach to the Commission's own list of high-risk third countries, which is updated by delegated regulation after each relevant FATF statement. That creates a gap in both directions.
| FATF decision | FATF date | EU instrument | In the Official Journal |
|---|---|---|---|
| South Africa and Nigeria added; Cambodia and Morocco removed | 24 February 2023 | Delegated Regulation (EU) 2023/1219, adopted 17 May 2023 | 26 June 2023, in force 20 days later |
| South Africa, Nigeria, Burkina Faso, Mali, Mozambique and Tanzania removed | 24 October 2025 | Delegated Regulation (EU) 2026/83, adopted 4 December 2025 | 9 January 2026 |
Roughly four months in 2023 and about ten weeks in 2025. During the second gap, an EU-regulated firm was still legally required to apply enhanced due diligence to South African and Nigerian customers that FATF had already cleared. Firms that key country risk directly off the FATF statement, with no separate EU list field, under-applied EDD for that period and would struggle to evidence otherwise at inspection.
What should a compliance team have done when a listing changed?
Three things, in order. Reprice the jurisdiction in your country-risk methodology on the date of the FATF statement, and record that date. Re-run the affected customer population rather than waiting for the next scheduled review, because a country-risk change moves customers between due diligence tiers and can trigger enhanced due diligence for files that were previously standard.
Then hold the higher standard until every applicable list has caught up. A delisting is not permission to downgrade, since the EU, UK and national lists move on their own timetables and the strictest applicable list governs.
What makes this workable is a rescreening capability that acts on the customer record rather than a name string, so a country-risk change propagates without a manual campaign. MemberCheck is built that way, and the same record is what PEP and sanctions screening and a documented AML risk assessment both draw on.
What does this plenary tell you about running jurisdiction risk?
Every element of the February 2023 outcome has since moved. Russia's suspension persists, South Africa and Nigeria have exited, Indonesia became a full member, and the virtual assets roadmap has produced two further annual updates. A country-risk table populated once and reviewed annually would have been wrong about at least four jurisdictions for months at a time.
The listing itself keeps churning. At the plenary of 17 to 19 June 2026 FATF added Bosnia and Herzegovina and Iraq to increased monitoring and removed Algeria and Namibia. That is four changes in one meeting, three meetings a year.
The defensible process is a standing job with a named owner: read each plenary statement within days, diff it against your country-risk table, log the decision even where nothing changes, and re-screen the affected book. More posts on this in our jurisdictions and regulation collection, and the June 2023 plenary outcomes cover the next meeting in the cycle.
