The FATF updated its grey list on 30 October 2026, removing DRC, Monaco, Bulgaria, and Côte d’Ivoire and adding no new jurisdictions. For UAE organisations, the update is more than an AML task. Country risk runs through customer onboarding, supplier selection, correspondent relationships and the risk reports that reach the board.
What changed at the October 2026 FATF Plenary
- Added to increased monitoring: None
- Removed: DRC, Monaco, Bulgaria, and Côte d’Ivoire
- Grey list total: 18 jurisdictions
- Call-for-action list: No change
FATF grey list as of 30 October 2026
- Angola
- Bolivia
- Bosnia and Herzegovina
- Cameroon
- Haiti
- Iraq
- Kenya
- Kuwait
- Lao People’s Democratic Republic
- Lebanon
- Nepal
- Papua New Guinea
- South Sudan
- Syria
- Venezuela
- Vietnam
- Virgin Islands (UK)
- Yemen
FATF call-for-action list as of 30 October 2026
- Iran and DPRK: the FATF calls on members to apply countermeasures.
- Myanmar: the FATF calls for enhanced due diligence proportionate to the risk, without disrupting humanitarian aid or remittance flows.
Why a grey list change is a governance issue
Supervisors expect senior management to own the institution’s risk appetite. When the FATF moves a country onto or off its lists, three questions belong at board or risk committee level:
- Should our risk appetite change for the delisted jurisdictions, and do our conditions for the jurisdictions that remain listed still hold?
- How much exposure do we have, across customers, suppliers, distributors, banking partners and group entities?
- Can we evidence our response, with dated policy changes, re-assessments and management information?
Where the update touches your risk framework
| Area | What to review |
|---|---|
| AML/CFT compliance | EWRA geographic risk, customer risk methodology, EDD triggers, screening and monitoring rules |
| Enterprise risk management | Country risk in the risk register; key risk indicators for exposure to listed jurisdictions |
| Third-party risk management | Due diligence on vendors, agents and distributors based in or paying through listed countries |
| Treasury and banking | Correspondent and payment corridors that may face more scrutiny or delays |
| Internal audit | Test that changes were made on time and consistently across systems |
| Board reporting | Brief summary of exposure, decisions taken and residual risk |
Regulatory expectations in the UAE
Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025 require financial institutions, DNFBPs and VASPs to identify, assess and mitigate their risks, including geographic risk, and to keep those assessments current. Grey-listing calls for a risk-based response; for call-for-action jurisdictions, enhanced measures and goAML high-risk country reporting (HRC/HRCA) apply.
A 30-day response plan
- Week 1: update the high-risk country list, screening tables and the risk register.
- Week 2: run an exposure analysis across customers and third parties linked to DRC, Monaco, Bulgaria, and Côte d’Ivoire, and review whether enhanced measures are still justified.
- Week 3: complete re-assessments and EDD; decide on any relationships outside risk appetite.
- Week 4: report to the board or risk committee; schedule an internal audit check.
FAQs on the FATF grey list update, October 2026
Which countries were added to the FATF grey list in October 2026?
None. No countries were added to the FATF grey list at the Plenary that concluded on 30 October 2026.
Which countries were removed?
DRC, Monaco, Bulgaria, and Côte d’Ivoire were removed after completing their action plans and passing on-site visits.
Should the board be told about FATF grey list changes?
Yes, where the organisation has material exposure. Boards own risk appetite, and supervisors expect evidence of senior management oversight.
Does the grey list affect suppliers as well as customers?
It can. Third parties based in or paying through listed jurisdictions carry higher financial crime risk and should be covered by third-party due diligence.
Is grey-listing the same as sanctions?
No. Grey-listing is a risk indicator. Sanctions are legal restrictions screened separately.
Turn the FATF update into a documented risk decision
