FATF Grey-List and High-Risk Jurisdictions: What Monitoring Should Change After an Update

Answer in brief
A FATF update should change monitoring because the FATF treats grey-list jurisdictions and high-risk jurisdictions differently. FATF says jurisdictions under increased monitoring have committed to fix strategic AML/CFT deficiencies and are under closer review, but FATF does not call for enhanced due diligence solely because of grey-listing. By contrast, for high-risk jurisdictions subject to a call for action, FATF urges enhanced due diligence and, in the most serious cases, countermeasures. ([FATF][12])

What changed in the latest FATF update

As of the FATF’s February 13, 2026 update, the grey list includes jurisdictions such as Algeria, Angola, Bolivia, Bulgaria, Cameroon, Côte d’Ivoire, Democratic Republic of the Congo, Haiti, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Namibia, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK), and Yemen. FATF specifically noted that Kuwait and Papua New Guinea were newly identified in that round. ([FATF][12])

What the “black list” currently is

In the same February 13, 2026 publication cycle, FATF’s high-risk jurisdictions subject to a call for action were Democratic People’s Republic of Korea, Iran, and Myanmar. FATF says jurisdictions in this category warrant enhanced due diligence and, in the most serious cases, countermeasures. ([FATF][13])

What should change operationally after a FATF update

In practice, firms should not treat a grey-list update as automatic de-risking or automatic EDD for every customer touchpoint, because FATF itself says it does not call for enhanced due diligence measures for jurisdictions merely under increased monitoring. But firms should still review country-risk scores, onboarding and ongoing CDD rules, correspondent banking escalation, transaction-monitoring tuning, source-of-funds/source-of-wealth expectations, and screening/escalation logic to reflect the revised country-risk picture. That operational distinction follows directly from FATF’s different treatment of increased-monitoring versus call-for-action jurisdictions. ([FATF][12])

The compliance trap

The trap is flattening the lists into one idea. Grey list does not equal black list. If your monitoring treats them identically, you risk either under-reacting to high-risk jurisdictions or overreacting to increased-monitoring jurisdictions in a way FATF itself does not call for. ([FATF][12])