FATF grey list, October 2026: four jurisdictions removed, Vietnam warned and what changes for EDD

The FATF grey list shrank from 22 to 18 jurisdictions on 30 October 2026, when the FATF removed Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco. No jurisdiction was added. Vietnam was warned over slow progress, and the call for action on Iran, North Korea and Myanmar stays. EU country risk rules do not change automatically.

• The FATF plenary in Paris, 28 to 30 October 2026, removed Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco from increased monitoring after on-site visits. No new jurisdictions were listed.
• 18 jurisdictions remain under increased monitoring, including Vietnam, which the FATF expects to show tangible improvements at the February 2027 plenary or face next steps.
• The call for action list is unchanged: countermeasures on North Korea and Iran, enhanced due diligence on Myanmar, with countermeasures to be considered if Myanmar makes no further progress by February 2027.
• The EU list of high-risk third countries, which triggers mandatory EDD under Article 18a of Directive (EU) 2015/849, still names Côte d'Ivoire, the DRC and Monaco until the Commission amends it.
• The plenary also adopted the mutual evaluations of the United States and Mexico; the FATF will publish both reports in December 2026.

What did the FATF decide on 30 October 2026?

The FATF removed four jurisdictions from its list of jurisdictions under increased monitoring and added none. This was the first plenary under the UK presidency of Giles Thomson. Bulgaria, Côte d'Ivoire, the DRC and Monaco completed their action plans, and the FATF confirmed this through on-site visits.

The plenary outcomes statement says the four "have completed their Action Plans within agreed timeframes" and will no longer be subject to increased monitoring. Each now continues with its FATF-style regional body: MONEYVAL (Council of Europe) for Bulgaria and Monaco, GIABA (West Africa) for Côte d'Ivoire, and GABAC (Central Africa) and ESAAMLG (Eastern and Southern Africa) for the DRC.

The updated FATF grey list statement leaves 18 jurisdictions: Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK) and Yemen.

Sources: the FATF statement of 30 October 2026 for the first three columns, and the European Commission's high-risk third countries page, last updated on 9 January 2026, for the EU column.

The plenary also agreed a targeted review of jurisdictions with materially important virtual asset sectors, with results due in June and October 2027. It approved a report on the money flows behind scam compounds, which the FATF said it would publish the following week, as the first output of the FATF fraud roadmap. It also adopted the mutual evaluations of Mexico and the United States.

Who is still under increased monitoring, and who got a warning?

Eighteen jurisdictions remain on the FATF grey list, and the statement flags expired deadlines for four: Vietnam, in the sharpest language, plus Cameroon, Haiti (in its carried-over June text) and South Sudan. Separately, Venezuela was asked to urgently consider re-examining parts of its November 2024 law on non-profit organisations.

On Vietnam, the FATF "expresses significant concern with the pace of progress" and notes that all deadlines expired in May 2025. It expects to see tangible improvements in February 2027, or it will consider next steps. Vietnam's open action items include regulating virtual assets and service providers, fixing customer due diligence and suspicious transaction reporting gaps, and building beneficial ownership transparency.

Bosnia and Herzegovina, Haiti, Iraq and Yemen did not report this cycle. Their June statements are carried over and, as the FATF itself notes, may not reflect the latest status. The FATF found in 2014 that Syria and Yemen had substantially addressed their action plans at a technical level, but it has been unable to conduct on-site visits because of the security situation.

The call for action statement, often called the black list, keeps its three names. North Korea and Iran remain subject to countermeasures. Myanmar remains subject to enhanced due diligence, and the FATF will consider countermeasures if Myanmar makes no further progress by February 2027. The countermeasures it asks countries to apply on Iran name virtual asset service providers alongside financial institutions.

Sources: FATF statements of 19 June 2026 and 30 October 2026.

What does the FATF grey list change for your obligations?

The FATF grey list is not itself a legal trigger for enhanced due diligence. The legal duties sit in national and EU law. In the EU, the trigger is the Commission's own list. In the UK, only the call for action list makes EDD mandatory. In both, grey list status remains relevant to geographical risk factors in your assessment.

Country risk scoring. The FATF states plainly that it "does not call for the application of enhanced due diligence" on grey-listed jurisdictions. Instead it asks firms to take the statements into account in their risk analysis. The four removals should therefore flow into your country risk methodology, but through your documented model, not as an automatic downgrade.

EU obliged entities. Article 18a of Directive (EU) 2015/849 requires specific enhanced measures for business relationships or transactions involving high-risk third countries identified by the Commission. They include additional information on the customer and beneficial owners, source of funds and source of wealth, and senior management approval. The Commission's list still names Côte d'Ivoire, the DRC and Monaco, so those measures continue until a delegated act removes them.

UK relevant persons. Regulation 33(1)(b) of the Money Laundering Regulations 2017 requires EDD for relationships and relevant transactions with persons established in a "FATF call for action country", defined by reference to the FATF list as it has effect from time to time. The 30 October decision does not change that set. Grey list status is relevant to the geographical risk factors in regulation 33(6)(c), which cover countries identified by credible sources, such as mutual evaluations, as not having effective systems.

Sanctions and correspondent banking. FATF countermeasures on Iran and North Korea do not replace sanctions screening, which rests on its own legal basis. The call for action statement asks countries to refuse new correspondent relationships with Iranian institutions and to review existing ones on a risk basis. For North Korea it asks countries to terminate correspondent relationships with DPRK banks; see our coverage of DPRK IT worker sanctions.

Record-keeping. Whatever you decide, record the date of the FATF statement, the version of the EU list you applied and the rationale for each changed rating. A dated, documented rationale is what lets you show a supervisor why a rating moved.

What is still uncertain, and where are the risks?

The main risk is a gap between lists. A jurisdiction can leave the FATF grey list months before it leaves the EU list, so a firm that downgrades on the FATF date alone can fall short of mandatory EU measures. The reverse error also exists: keeping legacy EDD long after the evidence has changed.

EU lag. The June 2026 plenary removed Algeria and Namibia, yet the Commission's list page, at its last update on 9 January 2026, still names both. It does not name Iraq, Bosnia and Herzegovina, Kuwait or Papua New Guinea, all on the FATF grey list. The gap runs both ways: the Commission's list also names Afghanistan, Trinidad and Tobago, Vanuatu and, since 29 January 2026, the Russian Federation, none of which is on either FATF list. Until a new delegated act is published, EU firms work to the Commission's list, not the FATF's.

Derisking pressure. The FATF warns against the opposite failure. Its grey list statement says "The FATF Standards do not envisage derisking, or cutting-off entire classes of customers", and calls instead for a risk-based approach. Firms that closed relationships in Côte d'Ivoire or the DRC on listing alone should check whether that decision still reflects risk.

Stale statements. Four jurisdictions skipped reporting this cycle, and the FATF has not been able to visit Syria or Yemen since they addressed their plans. Treating the statements as current intelligence about Bosnia and Herzegovina, Haiti, Iraq, Syria or Yemen would overstate what the FATF actually reviewed.

Removal is not a clean bill of health. Removal means a jurisdiction completed its action plan, not that every risk disappeared. Your own risk assessment still has to weigh sector risk as well as corruption and sanctions exposure, which regulation 33(6)(c) lists as separate geographical risk factors.

Moving dates. Vietnam and Myanmar both face a February 2027 checkpoint at the next plenary. Either could move to tougher treatment then, so firms with exposure should plan for both outcomes now.

Why does the virtual asset review matter beyond the lists?

The virtual asset decision may matter more in 2027 than this October's list changes. The FATF will run a targeted review of jurisdictions with materially important virtual asset sectors and publish results in June and October 2027. That creates a new public signal on how well crypto hubs supervise service providers.

The FATF says the review will use objective criteria and focus on jurisdictions with materially important sectors, chosen on the basis of their assessment status. For exchanges, custodians and banks serving them, the published results could become an input to counterparty and correspondent due diligence, much as the FATF grey list is today. Vietnam's open action item on regulating virtual assets shows the two tracks already overlap.

The US mutual evaluation is the other item to watch. The FATF adopted it at the October 2026 plenary, and publication follows in December 2026 after a quality and consistency review. Its findings will shape how foreign banks assess US counterparties, and they arrive while the US Financial Crimes Enforcement Network (FinCEN) is reworking its customer due diligence rule.

How should compliance teams respond?

Compliance teams should treat the October update as a scheduled country risk review, not an emergency. Update the FATF inputs to your methodology now. Leave EU-mandated measures in place until the Commission acts. Then review the customers whose ratings move, starting with those you treated as high risk on listing alone.

First, update your country risk model with the four removals and the Vietnam and Myanmar checkpoints, and document the change. Second, for EU entities, keep the Article 18a measures on Côte d'Ivoire, the DRC and Monaco and watch for the next delegated act. Third, review whether any relationship you declined or exited because of listing should be reconsidered under a risk-based approach. Fourth, confirm that screening and enhanced due diligence workflows can switch measures by jurisdiction without a code release. Our guide to enhanced due diligence versus standard CDD sets out how the two tiers differ.

FATF lists change three times a year, so the expensive part is re-collecting evidence each time a rating moves. Zyphe's KYB software resolves ultimate beneficial owners across 240+ corporate registries worldwide at a 25% default threshold, configurable per risk tier, and keeps an exportable audit trail of each decision. Verified identity data is encrypted into the user's own vault, with no central store of customer PII. If you are reworking country risk tiers, book a demo.

The bottom line

The October FATF grey list update is good news for four jurisdictions and a test of method. Removal changes a risk input, not every legal duty, and the EU list moves on its own timetable. Firms that can explain each rating change, and switch measures by jurisdiction without rebuilding evidence, will absorb this update and the next one.

Cited sources

• FATF: Outcomes FATF Plenary, 28 to 30 October 2026
• FATF: Jurisdictions under Increased Monitoring, 30 October 2026
• FATF: High-Risk Jurisdictions subject to a Call for Action, 30 October 2026
• FATF: Jurisdictions under Increased Monitoring, 19 June 2026
• European Commission: list of high-risk third countries and Delegated Regulation (EU) 2016/1675 amendments
• Directive (EU) 2015/849, consolidated text, Article 18a
• Money Laundering Regulations 2017, regulation 33: obligation to apply enhanced customer due diligence