The Financial Action Task Force (FATF) publishes two lists after each of its three yearly plenaries. Businesses use them to decide which clients need extra checks. If your country-risk settings were last reviewed in 2025, they are out of date.
The two lists
- High-risk jurisdictions subject to a call for action (often called the black list): countries where FATF calls for enhanced due diligence and, for the most serious, countermeasures.
- Jurisdictions under increased monitoring (the grey list): countries working with FATF to fix strategic weaknesses in their anti-money laundering systems.
Changes over the past year
- October 2025: South Africa, Nigeria, Mozambique and Burkina Faso were removed from the grey list.
- February 2026: Kuwait and Papua New Guinea were added.
- June 2026: Bosnia and Herzegovina and Iraq were added; Algeria and Namibia were removed.
The lists after the June 2026 plenary
Call for action: North Korea (DPRK), Iran and Myanmar.
Increased monitoring (22 jurisdictions): Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Côte d'Ivoire, Democratic Republic of the Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the British Virgin Islands and Yemen.
The next update is expected after the October 2026 plenary. Always check the current statement on the FATF website before relying on any list.
What UAE businesses should do
- Update your country-risk table. Remove countries that have left the list from your increased-monitoring category, and add the new ones.
- Re-assess existing clients. A client from Iraq or Kuwait onboarded last year may now need additional checks; one from South Africa may need fewer.
- Keep a record of the review. Note the date, the FATF statement you used and the changes made.
- Remember the grey list is not a ban. It signals higher risk and the need for proportionate extra care, not a prohibition on doing business.
- Set a reminder for each plenary. FATF meets three times a year, usually in February, June and October.
How Zetabytecloud CRM helps. The built-in country-risk table follows the latest FATF lists, your compliance team can adjust any country, and every client is re-screened automatically when the table changes. See AML & KYC screening.
Sources: FATF public statements of October 2025, February 2026 and June 2026. This article is general information, not legal advice.
