When Iraq and Bosnia and Herzegovina joined the FATF gray list in June 2026, every institution with exposure to those jurisdictions had to reassess affected customers, tighten monitoring thresholds, and update its enterprise-wide risk assessment without delay.
Gray-listed jurisdictions have committed to fixing identified AML deficiencies under FATF oversight, which means business relationships can continue under enhanced controls. Meanwhile, countries on the black list have serious unaddressed deficiencies, and the FATF calls for the most stringent controls available.
According to an IMF working paper, gray listing alone drives an average 7.6% decline in capital inflows to affected jurisdictions, pressure that reaches every institution transacting with them.
This guide covers what each designation requires, where most programs miscalibrate their response, and what gets missed when a jurisdiction exits the list.
Key takeaways:
- Delisting requires active work, not passive adjustment
When a jurisdiction exits the gray list, elevated customer risk classifications don’t lift automatically, and every affected relationship needs to be reassessed and reset.
- The same FATF designation carries different legal weight in different markets
Gray list status is a discretionary risk input in the US but triggers a mandatory EDD obligation in the EU once the Commission formally designates the country.
- Correspondent banking pressure can arrive without any direct customer exposure
A gray listing creates friction in correspondent banking relationships even for institutions whose customers have no connection to the listed jurisdiction.
- Blanket de-risking is a miscalibration, not a conservative response
Treating every customer connected to a gray-listed country as uniformly high-risk goes beyond what FATF standards require and is itself a pattern examiners look for.
- Sigma360 keeps jurisdiction risk current as the lists move
With country risk ratings and Perpetual KYC updating automatically as FATF designations change, Sigma360 allows plenary updates to flow into customer risk scores without manual reconciliation.
What is the FATF gray list?
The FATF gray list, formally known as the Jurisdictions Under Increased Monitoring list, identifies countries with strategic deficiencies in their AML, counter-terrorist financing, and counter-proliferation frameworks that have committed to a time-bound remediation plan. FATF and the relevant regional body monitor each listed jurisdiction’s progress and review it at every plenary.
Institutions can maintain relationships with customers and counterparties connected to a gray-listed country, but those relationships require closer scrutiny, tighter documentation, and more frequent review than standard CDD delivers.
Of the 112 jurisdictions publicly identified since the process began, 85 have addressed their deficiencies and been removed. The UAE exited in February 2024 after being on the list for under two years, and South Africa followed in October 2025 after 32 months. Both cases show the list functions as a remediation mechanism, not a permanent designation.
Current FATF gray list
The FATF plenary held 17–19 June 2026 resulted in two additions and two removals. As of June 2026, the gray list covers 22 jurisdictions:
- Angola
- Bolivia
- Bosnia and Herzegovina (added June 2026)
- Bulgaria
- Cameroon
- Côte d’Ivoire
- Democratic Republic of the Congo
- Haiti
- Iraq (added June 2026)
- Kenya
- Kuwait
- Lao PDR
- Lebanon
- Monaco
- Nepal
- Papua New Guinea
- South Sudan
- Syria
- Venezuela
- Vietnam
- Virgin Islands (UK)
- Yemen
Algeria and Namibia were delisted after completing their action plans and passing on-site assessments.
What is the FATF black list?
The FATF black list, formally called the High-Risk Jurisdictions Subject to a Call for Action list, identifies countries with significant strategic deficiencies in their AML/CFT frameworks that remain unresolved. The FATF calls on all members to apply enhanced due diligence (EDD) to all business relationships and transactions with these jurisdictions and, in the most serious cases, apply countermeasures.
As of June 2026, three jurisdictions remain on the black list:
- Iran: Subject to countermeasures
- Democratic People’s Republic of Korea: Subject to countermeasures
- Myanmar: EDD proportionate to risk
Myanmar’s treatment under the black list is less severe than Iran and North Korea’s. All three have action plans that expired without completion, but FATF hasn’t yet called for countermeasures against Myanmar, citing some incremental progress. If Myanmar makes no further progress by October 2026, the FATF has stated it will consider moving to countermeasures.
Countermeasures go beyond EDD. In practice, they may require terminating correspondent banking relationships, prohibiting subsidiaries or branches of blacklisted banks, and restricting financial dealings with persons from the listed jurisdiction.
How the two lists differ in practice
Treating both lists as the same high-risk flag is a calibration error. The table below outlines where they differ:
| Gray list | Black list | |
| Formal FATF name | Jurisdictions Under Increased Monitoring | High-Risk Jurisdictions Subject to a Call for Action |
| Country’s position | Committed to remediation under FATF oversight | Action plan expired with deficiencies unresolved |
| Minimum compliance response | Risk-based enhanced measures; tighter monitoring and documentation | EDD on all business relationships |
| Countermeasures required? | No | Yes, for Iran and North Korea |
| Relationship permitted? | Yes, under enhanced controls | Iran and DPRK: restricted or prohibited; Myanmar: case-by-case |
| Review cadence | More frequent than standard; risk-triggered | Ongoing and intensive |
What a gray listing triggers for your compliance program
Every FATF plenary update triggers a workflow, but additions and removals require different responses from your program. Additions are well-rehearsed, and most teams have a response plan. Removals are where programs tend to develop blind spots, because actively resetting elevated treatment is less instinctive than applying it.
When a jurisdiction is added
When Iraq and Bosnia and Herzegovina joined the gray list in June 2026, the obligation to act arrived the same day. Institutions with exposure to either country had to review existing EDD files, check whether monitoring thresholds reflected the new country risk rating, and update the enterprise-wide risk assessment (EWRA) accordingly.
Gray list additions call for enhanced review, while black list additions may also require restricting or terminating affected relationships. These steps apply regardless of which list the jurisdiction has been added to, though the depth of each scales with the designation:
- Re-score all customers, beneficial owners, and counterparties with direct or indirect connections to the newly listed jurisdiction.
- Review existing EDD files for affected relationships and assess whether the current depth of review still holds.
- Tighten transaction monitoring thresholds and alert scenarios for flows touching the jurisdiction.
- Escalate high-risk relationships connected to the jurisdiction for senior compliance sign-off.
- Update your EWRA to reflect the changed country risk rating.
- Check screening configurations to ensure the jurisdiction flags correctly across all onboarding and monitoring workflows.
The listing raises the bar on what your program must demonstrate, but applying EDD to every connected customer isn’t automatic. On each affected relationship, the question is whether the current level of scrutiny is adequate and documented.
When a jurisdiction is removed
Algeria and Namibia’s exit from the gray list in June 2026 didn’t automatically close the file on elevated customer treatment. Delisting requires active review, and every relationship held at a higher standard because of the jurisdiction’s listing status needs to be worked through and reset.
These steps apply specifically to relationships that were elevated because of the jurisdiction’s gray list status. Where other risk factors drove the heightened treatment independently, those relationships stay at the higher level regardless of the delisting. Here’s the sequence for running through each affected relationship:
- Identify all customers and counterparties classified at elevated risk due to the jurisdiction’s listing status.
- Review each relationship to determine whether the heightened treatment was driven by the listing alone or by additional, independent risk factors.
- Downgrade the country risk weighting for relationships where the gray list status was the primary driver.
- Document the reassessment and the rationale for any change in treatment.
- Update your EWRA and screening configuration to reflect the improved classification.
Leaving stale elevated treatment in place generates unnecessary alert volume, burdens analysts with reviews that are no longer warranted, and produces a documented record out of step with actual risk. Across programs that rely on manual gray list tracking, this is one of the most common and least visible drivers of false positives in AML screening.
How your regulatory framework translates FATF designations into obligations
FATF Recommendation 19 sets the international baseline, requiring financial institutions to apply EDD to business relationships and transactions with persons from countries the FATF identifies as high-risk.
Recommendation 13 governs correspondent banking relationships separately, requiring banks to assess respondent AML/CFT controls, obtain senior management approval for new relationships, and refuse accounts for shell banks. A respondent’s FATF jurisdiction status is a significant factor in that assessment.
How those standards translate into binding domestic obligations depends on which regulatory framework governs your institution.
United States
In the US, FATF gray list designations aren’t a direct legal trigger. Section 312 of the USA PATRIOT Act requires EDD for correspondent accounts held for foreign banks operating under offshore banking licenses or from jurisdictions subject to Treasury special measures.
FATF gray list status is one input into that country risk assessment, and the obligation to act on it flows from their BSA/AML programs rather than from a statutory gray list mandate. OFAC designations are a separate legal framework and must be treated as such.
European Union
The AMLR applying from July 10, 2027 takes a more direct approach. Under Article 29, the Commission can designate high-risk third countries via delegated acts, drawing on FATF and other international assessments.
Once a country is designated, EDD becomes a mandatory obligation for all obliged entities. The risk-based discretion that applies under other frameworks doesn’t apply here. The EU’s list doesn’t automatically mirror FATF’s, but FATF designations are a primary input into the Commission’s designation process.
United Kingdom
The Money Laundering Regulations 2017 treat high-risk third countries, a designation that broadly tracks FATF gray and black list status, as grounds for mandatory EDD, with the FCA’s Financial Crime Guide setting out what that requires.
The UK has maintained its own country risk framework since Brexit and follows FATF listings more closely than the EU does. The UK Sanctions List (the sole authoritative source for UK designations since January 28, 2026) runs as a separate control alongside FATF country risk.
The sharpest operational difference for multi-jurisdiction institutions is that gray list exposure may carry different legal weight in each market: a discretionary risk-based response in the US, and a mandatory EDD obligation once the EU Commission formalizes the designation.
Read more: PEP and Sanctions Screening: A Complete Guide for 2026
The correspondent banking problem
Gray listing puts pressure on correspondent banking relationships even for institutions whose customers have no direct connection to the listed jurisdiction.
Correspondent banks holding accounts for institutions in the affected country come under closer scrutiny from regulators, regardless of any specific finding against those institutions. The response follows a consistent pattern across markets:
- Demand more extensive documentation from respondent banks.
- Increase fees on affected correspondent relationships.
- Restrict the range of services available.
- Terminate relationships where the compliance cost outweighs the commercial case.
None of these decisions typically follows from a specific finding against the respondent bank. Instead, they reflect a structural response to jurisdictional signals and represent exactly what FATF’s own guidance warns against.
The FATF standards caution against blanket de-risking of entire jurisdictions because it shifts risk elsewhere and cuts off legitimate financial activity. Applying the same elevated treatment to every customer connected to a gray-listed country floods alert queues with low-risk relationships while the actual risk drivers go unexamined.
Institutions that manage gray list exposure well demonstrate individual risk assessments, not jurisdictional assumptions, and can show that reasoning to regulators and examiners.
Sigma360 and jurisdiction risk: Keeping pace with every plenary update
Gray list management fails when programs treat FATF designations as static data, configured once and updated manually if someone gets to it before the next plenary.
A jurisdiction’s risk status can change three times a year, and every change requires a defined response across customer scoring, monitoring thresholds, and documentation.
At the architecture level, country risk ratings update as FATF designations change, feeding automatically into customer risk scores so that a gray listing or delisting triggers reassessment across affected relationships without a manual reconciliation step. Perpetual KYC means the monitoring cadence runs on the data’s schedule, not according to the next periodic review cycle.
The platform’s other capabilities map directly to where gray list programs break down:
- Sanctions and watchlist screening: Runs in parallel with FATF country risk, giving analysts visibility into both the jurisdictional and entity-level picture in a single workflow
- Adverse Media Summary: Surfaces regulatory developments and enforcement actions tied to listed jurisdictions, adding real-time signal beyond the formal FATF designation
- AI360 Match Agent: Reduces alert volume from jurisdictional risk flags by clearing low-confidence hits before they reach the queue, directing analyst time to the relationships that warrant it
Compliance teams managing gray list exposure across multiple jurisdictions can respond to each plenary update without building a manual review process around it.
Request a demo to see how Sigma360 keeps jurisdiction risk current as the lists update.
FAQ
Does the FATF gray list require enhanced due diligence?
No, not automatically. Gray listing requires a risk-based reassessment, and the depth of scrutiny applied to any connected customer depends on their own risk profile rather than the designation alone.
How long do countries typically stay on the FATF gray list?
One to three years on average, once a country completes its action plan and passes a final on-site assessment. The UAE exited in under two years, and South Africa took 32 months.
Can a gray-listed country be moved directly to the black list?
Yes. If a jurisdiction fails to make adequate progress, the FATF can escalate it to the High-Risk Jurisdictions Subject to a Call for Action list. Myanmar followed that path after its action plan expired without completion.
Does gray list status apply to transactions, or only to customer relationships?
Both. Gray list exposure is relevant at onboarding, during ongoing monitoring, and at the point of individual payments. A compliance program that only screens at onboarding and not at the transaction level carries a gap that examiners will flag.
How should gray list status be documented in a customer file?
Record the plenary that triggered the change, the country risk rating adjustment, and the enhanced measures applied. If the jurisdiction is later delisted, document the reassessment and the rationale for any change in treatment.
