FATF Grey List October 2026: Four Jurisdictions Removed and What Money Transmitters Change

FATF removed Bulgaria, Monaco, Côte d'Ivoire and the Democratic Republic of the Congo from its list of jurisdictions under increased monitoring, the grey list, at its plenary in Paris from 28 to 30 October 2026, and added no new jurisdictions. Its call for action list, the black list, is unchanged: countermeasures for Iran and North Korea, enhanced due diligence for Myanmar (Burma). On 30 October FinCEN told US financial institutions to reflect the changes in their risk-based policies, keep their correspondent due diligence for listed jurisdictions, and not use the lists to de-risk whole countries.

For a money transmitter, an MSB, an e-money or a payment institution, the update is a dated task. The country risk table, the transaction monitoring rules that read it, the onboarding questionnaire and the agent and counterparty files all need to match the new lists, and the firm needs a record showing when and how it made the change.

What changed at the October 2026 plenary

FATF publishes its two statements, "High-risk jurisdictions subject to a call for action" and "Jurisdictions under increased monitoring", at the end of each plenary. The October 2026 statements are dated 30 October 2026, and they are the source a screening table should be built from, not a press summary. FinCEN's release of 30 October 2026 confirms the four removals and the unchanged call for action list for US firms.

FATF also kept up its pressure on jurisdictions that have stopped making progress. Reporting on the plenary notes that FATF expressed concern about Vietnam's pace of progress, and that it will consider countermeasures for Myanmar if there is no further progress by February 2027. Both are worth a note in the country risk file so the next review picks them up.

What FinCEN asks US firms to do

FinCEN's release turns the FATF statements into expectations under the Bank Secrecy Act. In short:

• Review risk-based policies in light of FATF's positions, for both listed and removed jurisdictions.
• Keep correspondent due diligence for foreign financial institutions in jurisdictions under increased monitoring under 31 CFR 1010.610, with enhanced, risk-based controls where needed.
• MSBs apply the same thinking to foreign agents and counterparties, under FinCEN Interpretive Release 2004-1.
• Apply enhanced due diligence for Burma, using existing FinCEN and OFAC guidance.
• Never open or keep correspondent accounts for Iranian or North Korean financial institutions, which US sanctions and FinCEN rules prohibit.
• For removed jurisdictions, weigh FATF's reasons for removal when reassessing risk under 31 CFR 1010.210.
• File a SAR where the firm knows, suspects or has reason to suspect illicit activity.

FinCEN adds that risk-based due diligence should not be used as the basis for wholesale or indiscriminate de-risking of classes of customers or institutions. A money transmitter that closes every corridor to a listed country without looking at the customers in it is doing what FinCEN asks firms not to do.

Bulgaria, Monaco, Côte d'Ivoire and the DRC: what removal means

Removal from the grey list means FATF judged that the jurisdiction completed its action plan. It does not mean the jurisdiction is low risk. The country keeps whatever inherent risk it had from its economy, geography, corruption levels and the products used there, and the firm's own exposure, customers and corridors still drive the rating.

The practical change is usually one step down in the country risk score, not a move to standard risk. A firm whose methodology adds a fixed weighting for grey listing should remove that weighting and rescore, then document why the overall rating moved by the amount it did.

UK and EU firms: the lists are not identical

Firms regulated in more than one place work to more than one list. US firms take their lead from FATF and FinCEN. UK firms apply enhanced due diligence to the high-risk third countries in Schedule 3ZA of the Money Laundering Regulations 2017, which the government amends to follow FATF's statements. EU firms use the European Commission's list of high-risk third countries, adopted by delegated regulation on its own timetable, which can add or keep countries FATF has removed.

A group with US, UK and EU entities should keep one country risk table with a column for each list, so a change in one regime does not overwrite another. Our guide to high-risk jurisdictions and MSB compliance in the UK covers the UK enhanced due diligence measures in detail.

Updating the country risk table

The update follows the same steps every plenary. Writing them down as a procedure turns a three-times-a-year scramble into a routine.

1. Capture the source. Save the FATF statements and the FinCEN release with their dates, and the current UK and EU lists if the group works in those regimes.
2. Change the list fields. Mark the four removals, confirm the call for action entries, and record that there were no additions.
3. Rescore affected countries. Apply the methodology, then check the result against the firm's actual exposure.
4. Push the change to systems. Transaction monitoring thresholds, onboarding risk scoring, payout rules and any country blocks that read the table.
5. Review open cases. Customers, agents and counterparties rated high because of a removed country may now sit lower; enhanced due diligence already under way should be completed or closed with a note.
6. Approve and record. The MLRO or BSA officer signs off the change, with the date and the reasons.

What changes for agents, counterparties and corridors

MSBs carry an extra layer that banks do not: foreign agents and payout partners. Interpretive Release 2004-1 requires risk-based procedures for them, and FinCEN's foreign agent alert of 30 October 2026 shows what examiners will look for. After this plenary:

• Agents in removed jurisdictions keep their due diligence files; the review cycle can lengthen if the risk score falls, but monitoring of agent-directed payments stays in place.
• Agents in Iran or North Korea are not permitted under US sanctions; the screening that enforces that is unaffected.
• Myanmar corridors stay under enhanced due diligence. FATF has asked that humanitarian, legitimate non-profit and remittance flows not be disrupted, so a firm that serves these corridors documents how it keeps them open safely.

What examiners and bank partners will ask

State examiners, FinCEN's delegated examiners at the IRS and sponsor banks ask the same questions after each plenary:

A firm that can hand over these five items in a day shows that its programme works, not just that it is written down. For more on the yearly compliance cycle, see the money transmitter compliance calendar for 2027.

The next plenary

FATF meets three times a year, usually in February, June and October. The next update is expected after the February 2027 plenary, when FATF will also decide whether Myanmar moves to countermeasures. Set a calendar date for the week after the plenary, keep the procedure above as a standing task, and the update becomes a one-day job. Regulatory Counsel's compliance support service runs these updates for money transmitters and payment firms, alongside the wider money services businesses programme.