The Financial Action Task Force (FATF) updated its list of jurisdictions under increased monitoring, commonly known as the grey list, on 30 October 2026. Four countries have been removed: Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo, and Monaco.
Corporate service providers (CSPs) and other regulated businesses should update their country risk lists and review affected customer assessments to ensure their compliance processes reflect the latest changes.
Which countries have been removed?
FATF confirmed that the following countries have made sufficient progress in addressing the strategic AML/CFT deficiencies covered by their respective action plans:
- Bulgaria
- Côte d’Ivoire
- Democratic Republic of the Congo
- Monaco
These countries are no longer subject to FATF’s increased monitoring process. They will continue working with their respective FATF-style regional bodies to sustain improvements to their AML/CFT systems.
Current FATF Grey List
Following the October 2026 update, 18 jurisdictions remain under increased monitoring:
| No. | Jurisdiction |
|---|---|
| 1 | Angola |
| 2 | Bolivia |
| 3 | Bosnia and Herzegovina |
| 4 | Cameroon |
| 5 | Haiti |
| 6 | Iraq |
| 7 | Kenya |
| 8 | Kuwait |
| 9 | Lao PDR |
| 10 | Lebanon |
| 11 | Nepal |
| 12 | Papua New Guinea |
| 13 | South Sudan |
| 14 | Syria |
| 15 | Venezuela |
| 16 | Vietnam |
| 17 | Virgin Islands (UK) — British Virgin Islands |
| 18 | Yemen |
List reflects FATF’s statement dated 30 October 2026.
What Should CSPs Do?
For Singapore CSPs, this update is a practical reminder to keep country risk information aligned across internal policies, customer due diligence procedures and compliance systems.
Recommended actions include:
- Update country risk lists and system settings. Check that internal registers, risk assessment templates and automated rules reflect the revised FATF list.
- Review affected customer assessments. Consider customers with connections to the relevant jurisdictions through incorporation, business operations, beneficial ownership or sources of funds.
- Document any changes. Record the source and date of the update, together with the rationale for any revised customer risk rating or due diligence measures.
- Inform relevant staff. Ensure employees responsible for customer onboarding, reviews and ongoing monitoring use the updated information.
Removal from the grey list should inform a customer’s risk assessment, but should not automatically result in a low-risk rating. Other factors, including ownership complexity, business activities, transaction patterns and adverse information, remain relevant.
FATF also clarifies that grey-list inclusion alone does not constitute a call for blanket enhanced due diligence or the rejection of entire categories of customers. Businesses should apply a risk-based approach while observing applicable local requirements.
Keeping lists current is only part of the process. The changes should also flow through to customer assessments, review decisions and ongoing monitoring, with a clear record of how they were applied.
Source: FATF — Jurisdictions under Increased Monitoring, 30 October 2026