FATF Removes Four Jurisdictions from Grey List as Japan Updates Financial Crime Guidance

The Financial Action Task Force (FATF) has removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo (DRC) and Monaco from its list of jurisdictions under increased monitoring, following confirmation that the four countries have made sufficient progress in addressing strategic deficiencies in their anti-money laundering and counter-terrorist financing (AML/CFT) frameworks.

The decisions were announced following the FATF Plenary held in Paris from 28 to 30 October 2026. On 2 November, Japan’s Financial Services Agency (FSA) published a notice drawing attention to the updated FATF jurisdiction statements and reminding financial institutions to take the revised assessments into account when reviewing their geographical risk exposure.

The four jurisdictions completed their respective action plans within the agreed timeframes and underwent successful on-site assessments confirming that the required reforms had been implemented. Their removal means they are no longer subject to the FATF's increased-monitoring process. However, it does not indicate that all financial crime risks have disappeared or that their AML/CFT systems no longer require supervision.

The reforms undertaken by Bulgaria included strengthening its national AML/CFT strategy, addressing technical compliance deficiencies and improving risk-based supervision of certain non-financial businesses and virtual asset service providers. The country also improved the accuracy of beneficial ownership information, enhanced the prioritisation of suspicious transaction reports and strengthened investigations and prosecutions involving different forms of money laundering, including high-level corruption and organised crime.

Côte d’Ivoire and the DRC also demonstrated progress in addressing deficiencies identified through the FATF process. Their continued engagement with the relevant regional bodies will be important in maintaining the improvements achieved. Monaco's removal similarly followed the implementation of its agreed action plan and confirmation of progress through the FATF's assessment process.

Following these removals, 18 jurisdictions remain on the FATF list under increased monitoring: Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the British Virgin Islands and Yemen.

The FATF's increased-monitoring designation, commonly referred to as the grey list, applies to jurisdictions that have committed to addressing identified strategic deficiencies within agreed timeframes. It is not equivalent to a sanctions designation or an instruction to terminate business relationships. The FATF expressly states that grey-list inclusion does not automatically require enhanced due diligence across the board or the de-risking of entire categories of customers. Financial institutions are expected to incorporate the information into their risk assessments and apply proportionate controls based on the relevant circumstances.

The October update also maintains a distinction between jurisdictions subject to increased monitoring and those facing a FATF call for action. Iran and North Korea remain subject to calls for countermeasures, while Myanmar continues to be subject to enhanced due diligence requirements proportionate to the risks associated with the jurisdiction.

For North Korea, the FATF continues to highlight serious concerns involving proliferation financing, opaque corporate structures and the activities of financial institutions connected with the country. It reiterates calls for jurisdictions to terminate correspondent banking relationships with North Korean banks, close their subsidiaries and branches, and limit business relationships and financial transactions involving North Korean persons.

Iran remains subject to countermeasures because of unresolved deficiencies concerning the criminalisation of terrorist financing and the implementation of targeted financial sanctions. The FATF continues to call for restrictions involving correspondent banking relationships, branches and representative offices, as well as relevant business relationships and financial transactions. The statement also recognises the need to handle humanitarian assistance, food, medical supplies, diplomatic operating expenses and personal remittances in accordance with applicable international obligations.

Myanmar remains subject to a different set of measures. The FATF calls for enhanced due diligence rather than the countermeasures applicable to Iran and North Korea. It has expressed concern about extensive fraud and cyber-scam operations originating from the country and warned that further action will be considered if adequate progress is not demonstrated by February 2027. The organisation has also emphasised the importance of protecting legitimate humanitarian activities, civil society organisations and victims of trafficking.

Vietnam has received a particularly strong warning concerning the pace of its reforms. The FATF noted that the country's action-plan deadlines expired in May 2025 and expressed significant concern about the lack of tangible progress. Vietnam is expected to demonstrate improvements by February 2027, failing which the FATF will consider further steps. The outstanding issues include virtual asset supervision, beneficial ownership transparency, suspicious transaction reporting, financial intelligence and the investigation and prosecution of money laundering.

The FATF also highlighted concerns in Venezuela relating to the regulation of non-profit organisations. It called on the country to reconsider whether aspects of its November 2024 legislation are consistent with proportionate, risk-based supervision of the sector. This reflects the FATF's wider position that controls intended to prevent terrorist financing should not unnecessarily obstruct legitimate charitable and humanitarian activities.

For financial institutions, the latest update requires a review of geographical risk assessments, customer relationships and internal control systems. Institutions should ensure that country-risk databases and screening systems reflect the updated FATF designations and that obsolete automatic escalation rules are removed where appropriate.

The removal of a jurisdiction from increased monitoring should not automatically result in the approval of previously restricted relationships or the discontinuation of enhanced controls. Customer-specific risks, beneficial ownership structures, sources of funds, transaction patterns and exposure to other high-risk jurisdictions must continue to be considered. Equally, customers connected with grey-listed countries should not automatically be classified as high risk solely because of the jurisdiction's FATF status.

Institutions operating across multiple jurisdictions must also distinguish FATF assessments from domestic and regional regulatory requirements. The European Union, for example, maintains its own high-risk third-country framework under separate legislation. A jurisdiction's removal from the FATF grey list does not automatically result in its removal from the EU's corresponding list. Financial institutions must therefore check the applicable legal requirements in each jurisdiction in which they operate.

The October decisions demonstrate that successful completion of a FATF action plan can result in removal from increased monitoring, but they also underline the continuing pressure on jurisdictions that have not addressed identified weaknesses. For compliance teams, the priority is to ensure that changes in international risk assessments are reflected accurately in internal policies and systems, while maintaining a proportionate, evidence-based approach to customer and geographical risk.

By fLEXI tEAM