FATF Grey List and Black List Explained
FATF’s grey and black lists identify jurisdictions with serious anti-money laundering and counter-terrorist financing weaknesses. They affect how banks, payment firms and other regulated businesses assess country risk and apply customer checks.
The Financial Action Task Force, or FATF, is the global standard-setter for anti-money laundering and counter-terrorist financing. Its public country lists are closely watched by banks, payment providers, fintechs, insurers, crypto-asset businesses and compliance teams because they can materially change the risk of serving customers or processing transactions linked to a jurisdiction.
The terms “grey list” and “black list” are widely used shorthand. FATF uses more formal names, and the consequences differ. Neither list is a blanket legal prohibition on doing business with a country. But both can lead firms and governments to apply more intensive controls, and can make cross-border finance more expensive and difficult.
What is FATF?
FATF is an intergovernmental body established in 1989 by the Group of Seven industrialized nations. It develops international standards intended to prevent criminals, corrupt officials and terrorist groups from moving or concealing money through the financial system. FATF’s standards are known as the FATF Recommendations.
The Recommendations cover measures such as criminalizing money laundering and terrorist financing, identifying the real people who own or control companies, supervising financial institutions and certain non-financial businesses, freezing terrorist assets, sharing information across borders, and investigating suspicious activity. FATF does not generally impose laws directly. Instead, member governments and a global network of regional bodies are assessed on whether their legal frameworks and enforcement practices meet the standards.
What is the FATF grey list?
The grey list refers to FATF’s list of “jurisdictions under increased monitoring.” A country placed on this list has strategic deficiencies in its anti-money laundering, counter-terrorist financing and, where relevant, counter-proliferation financing regime. Counter-proliferation financing concerns efforts to stop funding connected to the spread of weapons of mass destruction.
Grey-listed jurisdictions have made a high-level political commitment to work with FATF on an action plan. That plan sets out reforms to be completed within agreed timeframes. Measures may include improving beneficial ownership records, strengthening supervision of banks or virtual asset service providers, increasing suspicious transaction reporting, or demonstrating more effective investigations and prosecutions.
Increased monitoring is not meant to require automatic blanket restrictions or indiscriminate enhanced due diligence on every person or transaction from the jurisdiction. FATF has repeatedly stressed that firms should use a risk-based approach. In practice, however, many financial institutions treat grey-list status as a material country-risk signal and tighten their controls.
What is the FATF black list?
The black list is the common term for FATF’s “high-risk jurisdictions subject to a call for action.” These are jurisdictions with serious and ongoing strategic deficiencies for which FATF calls on members and other countries to apply countermeasures, or, in some cases, enhanced due diligence proportionate to the risks.
Countermeasures can include limiting business relationships and financial transactions, requiring stronger reporting or examination of transactions, reviewing or restricting the operations of financial institutions connected to the jurisdiction, and considering other safeguards. The precise expectation is set out in FATF’s latest public statement and can vary by jurisdiction.
North Korea and Iran have been long-standing examples in FATF’s call-for-action category. FATF’s statements have treated them differently, so businesses should not assume that the same controls apply in every case. They should consult the latest FATF statement, applicable sanctions rules, and their own national regulator’s requirements rather than relying on a simplified black-list label.
How and when the lists change
FATF reviews country progress through its monitoring processes and updates its public lists at plenary meetings, which are held three times a year. A jurisdiction can be added when deficiencies and risks warrant public identification, removed after completing its action plan and undergoing the required validation, or moved between monitoring categories.
This means list status is not static. Compliance teams should monitor FATF announcements following each plenary and update their country-risk frameworks promptly. They should also distinguish FATF lists from sanctions lists. Sanctions are legally binding restrictions issued by authorities such as the US Treasury Department’s Office of Foreign Assets Control, the European Union, the United Kingdom or the United Nations. FATF listing is a separate anti-financial-crime risk designation, although a country may be relevant to both regimes.
What FATF listing means for businesses
For regulated businesses, a FATF listing should feed into customer and geographic risk assessments. It can affect onboarding, periodic reviews, payment screening, correspondent banking and decisions about whether a relationship remains within the firm’s risk appetite. Requirements differ by jurisdiction, so firms must follow local law as well as FATF guidance.
- Apply enhanced due diligence, meaning additional checks on identity, beneficial ownership, source of funds, source of wealth and the purpose of the relationship.
- Assign higher customer or country risk ratings where the facts support it, leading to more frequent review and senior compliance approval.
- Scrutinize transactions more closely, particularly complex, high-value or cross-border payments involving listed jurisdictions.
- Assess indirect exposure, including customers incorporated elsewhere but owned, controlled or operating substantially in a listed country.
- Document decisions and avoid treating nationality or residence alone as proof of suspicious activity. A risk-based approach requires consideration of the specific customer, product, transaction and delivery channel.
What listing means for countries and consumers
A FATF listing can raise the cost of international finance. Foreign banks may reduce correspondent banking relationships, which are arrangements that allow domestic banks to send and receive cross-border payments through partner institutions. Investors and lenders may demand higher returns or decline to participate, while businesses can face longer payment processing times and more compliance requests.
This withdrawal of services is often called de-risking. It can affect legitimate importers, exporters, charities, remittance providers and individuals receiving money from family abroad. At the same time, public listing creates significant pressure on governments to enact reforms, fund supervisory agencies, improve law enforcement capacity and demonstrate that rules are being used effectively.
The practical takeaway
FATF’s lists are important signals, not substitutes for a firm’s own risk assessment or for legal advice. Businesses should build them into flexible country-risk controls, monitor updates after each of FATF’s three annual plenaries, and check the latest FATF public statements before making decisions based on grey-list or black-list status.