October 2026 FATF plenary: what the updated lists change for your due diligence

On 30 October 2026, at the close of its plenary meeting in Paris, the Financial Action Task Force (FATF) published its updated lists of jurisdictions with strategic deficiencies in their anti-money laundering and counter-terrorist financing (AML/CTF) frameworks. Four jurisdictions left the list of jurisdictions under increased monitoring, better known as the grey list: Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco. None was added. The list of high-risk jurisdictions subject to a call for action, the black list, did not change.

The FATF lists do not create obligations by themselves. If you are a compliance officer in Luxembourg, Switzerland or another EU country, what changes for your clients depends on the rules that apply where you are established, and those rules do not all follow the FATF at the same pace.

Four jurisdictions off the grey list

The FATF considered that each of the four had met the commitments of its action plan, and asks them to keep working with their regional bodies to sustain the improvements (FATF).

Eighteen jurisdictions remain on the grey list. The table below lists them, together with the three jurisdictions subject to a call for action.

The FATF singled out Vietnam, whose deadlines all expired in May 2025: it expects tangible improvements in February 2027, failing which it will consider next steps.

The FATF states that it does not call for enhanced due diligence on grey-list jurisdictions, only for the information to be taken into account in risk analysis.

An unchanged call for action

North Korea, Iran and Myanmar remain subject to a call for action. For North Korea and Iran, the FATF maintains its call for countermeasures, restrictive measures such as ending correspondent banking relationships. Myanmar remains subject to enhanced due diligence, not countermeasures (FinCEN). The FATF will consider countermeasures if Myanmar makes no further progress by February 2027.

An EU list that moves at its own pace

Within the EU, enhanced due diligence for high-risk countries is triggered not by the FATF lists but by the European Commission’s list, in the annex to Delegated Regulation (EU) 2016/1675. As long as a country is on it, Article 18a of Directive (EU) 2015/849, as transposed in each member state, requires obliged entities, the professionals who must apply AML/CTF measures, to apply enhanced due diligence to business relationships and transactions involving that country.

The Commission starts from the FATF lists, but changes its own list only through a new delegated regulation. The latest two, Delegated Regulations (EU) 2026/46 and 2026/83, added Russia, Bolivia and the British Virgin Islands and removed six African countries, with effect from 29 January 2026 (European Commission). The list now has 26 countries.

The day after the plenary, the gap is therefore wide. Côte d’Ivoire, the Democratic Republic of the Congo and Monaco have left the grey list but remain on the EU list. Afghanistan, Algeria, Namibia, Russia, Trinidad and Tobago and Vanuatu are on the EU list without appearing on either FATF list. Conversely, Bosnia and Herzegovina, Iraq, Kuwait and Papua New Guinea are on the grey list but not on the EU list. Bulgaria, as a member state, falls outside a list that only covers third countries.

A client review to document

Wherever you are established, the plenary calls for a review of the clients linked to the countries concerned, through their nationality, residence or country of incorporation, or through their beneficial owners. Leaving the grey list does not make a client low-risk: the country remains one factor among others, alongside the client’s activity, the structure of the company and the source of funds. An auditor will expect a reasoned decision for each client concerned, not just a changed setting.

A tool such as Smart Oversight makes that review easier. Its country lists flag each country’s presence on these three lists and reflect the decisions of 30 October: Côte d’Ivoire, for example, now carries only the EU flag. The flag appears next to each country entered on the client record, from nationality to country of incorporation. It does not change the risk level by itself: the compliance officer sets that level, directly or through a risk scoring questionnaire, and the screening frequency follows it. The client’s dated PDF report, with the questionnaire answers and alert history, is the audit trail for the review.

Further reading

Monaco’s case, and the enhanced due diligence measures that still apply to it within the EU, are covered in Monaco leaves the FATF grey list, but enhanced due diligence still applies in the EU. Setting review frequencies by risk level is explained in Ongoing monitoring: periodic client reviews based on risk level. To organise this review in Smart Oversight, contact our team.

FATF sources

• FATF (October 2026), Outcomes FATF Plenary, 28-30 October 2026, https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-october-2026.html. Licensed under CC BY 4.0.
• FATF (October 2026), Jurisdictions under Increased Monitoring, 30 October 2026, https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-october-2026.html. Licensed under CC BY 4.0.
• FATF (October 2026), High-Risk Jurisdictions subject to a Call for Action, 30 October 2026, https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/call-for-action-october-2026.html. Licensed under CC BY 4.0.