The FATF Grey List: What It Means and Why It Matters

The FATF Grey List is one of the most consequential - and most misunderstood - tools in the global AML/CFT framework.

Formally known as "Jurisdictions under Increased Monitoring," the grey list identifies countries with strategic AML/CFT or counter-proliferation financing deficiencies that have committed to action plans with the FATF to address those weaknesses. As of February 2026, eighteen countries are listed, including Algeria, Angola, Bolivia, Bulgaria, Cameroon, Côte d'Ivoire, the Democratic Republic of the Congo, Kenya, Lao PDR, Lebanon, Monaco, Namibia, Nepal, South Sudan, Venezuela, Vietnam, the British Virgin Islands, and Yemen. Kuwait and Papua New Guinea were added in the most recent review.

The grey list is distinct from the FATF's "black list" - formally, High-Risk Jurisdictions Subject to a Call for Action - which targets countries with more systemic or intentional non-compliance. Grey-listed jurisdictions have acknowledged their deficiencies and agreed to fix them. That distinction matters.

The common misconception is that a grey listing triggers mandatory enhanced due diligence from financial institutions. Technically, the FATF does not mandate EDD for grey-listed jurisdictions - it emphasises a risk-based approach rather than blanket de-risking. In practice, however, the effect is often the same. Banks become reluctant to maintain correspondent banking relationships with institutions in grey-listed jurisdictions, investment flows slow, letters of credit become harder to obtain, and businesses find themselves locked out of parts of the international financial system.

For regulated businesses, the practical question is not whether to de-risk grey-listed jurisdictions entirely, but how to incorporate grey-list status into a proportionate risk framework. Customer risk assessments should reflect whether customers have beneficial ownership, control, or transaction flow connections to grey-listed jurisdictions. Transactions involving those jurisdictions should attract enhanced monitoring - not because the FATF demands it, but because the underlying risk profile warrants it.

The grey list is not static. In October 2025, Burkina Faso, Mozambique, Nigeria, and South Africa were removed - a significant signal that action plan implementation can and does lead to delisting. For businesses, this means that risk assessments need to be reviewed and updated at every FATF plenary cycle, not just when a new list is published.

For the Isle of Man - which is not on the grey list and maintains strong standing with MONEYVAL - the relevance is indirect but important. IOM financial institutions should maintain awareness of grey-list changes, apply proportionate scrutiny to transactions involving listed jurisdictions, and document their risk assessment rationale clearly. With the MONEYVAL evaluation approaching in October 2026, demonstrating that grey-list dynamics are integrated into compliance frameworks will be expected.

At Kybri Consulting Limited, we help regulated businesses build risk frameworks that account for FATF grey-list dynamics - from customer risk assessment design to transaction monitoring calibration and regulatory readiness.