The two FATF lists and their consequences in practice

Two lists, two different legal weights

At each plenary, three times a year, the FATF updates two public lists, the call for action list and the increased monitoring list. The FATF reviews both lists at every plenary and publishes fresh statements, so the current lists must be read from the FATF's own pages and never from a secondary summary, including this one. The high-risk list, the black list, names jurisdictions with serious strategic deficiencies and calls on all countries to apply enhanced due diligence and, in the most serious cases, countermeasures. The increased-monitoring list, the grey list, names jurisdictions that are actively working through an agreed action plan. The legal weight differs sharply, and so should the compliance response. On the call-for-action list, enhanced due diligence is mandatory everywhere and, for the Democratic People's Republic of Korea and Iran, countermeasures and sanctions sit on top, so for most purposes the law itself closes the door, while Myanmar is on the same list with a call for proportionate enhanced due diligence and no countermeasures; grey-list exposure is a risk factor that demands calibrated, documented handling, with exit as one possible outcome of that assessment.

How a listing becomes your obligation

The FATF has no direct power over a Zurich bank or a Warsaw fintech; the transmission runs through the regional regimes, each with its own mechanics and lag. In the EU, the Commission identifies high-risk third countries by delegated act, Commission Delegated Regulation (EU) 2016/1675 as amended (consolidated to 29 January 2026), under Article 9 of Directive (EU) 2015/849, a list aligned with but not identical to the FATF's, and Article 18a obliges entities to apply enhanced due diligence to relationships and transactions involving them; from 10 July 2027 the single rulebook, Regulation (EU) 2024/1624, takes over that mechanism.

In the UK the mechanism is a dynamic reference. From 23 January 2024, regulation 33(3)(a) of the Money Laundering Regulations 2017, as amended by SI 2024/69, defined high-risk third countries by reference to both FATF lists as they have effect from time to time, so a plenary decision changed the UK obligation without further legislation. Since 30 June 2026, SI 2026/621 has narrowed the automatic trigger in regulation 33(1)(b) to a "FATF call for action country": a grey listing no longer requires enhanced due diligence of itself, though it remains a geographic risk factor under regulation 33(6)(c) that HM Treasury's advisory notice expects firms to weigh, and enhanced measures follow wherever the firm's own assessment finds high risk.

Switzerland has drawn the line between the two lists at ordinance level all along. Under Articles 13 and 14 of the FINMA Anti-Money Laundering Ordinance (GwV-FINMA, SR 955.033.0), which operationalise the risk-based duties of the GwG, a relationship with a person resident in, or a payment from or to, a country on which the FATF calls for enhanced due diligence is a higher-risk relationship or transaction in every case, which triggers the additional clarifications of Article 15; a jurisdiction the FATF lists without that call, the grey list, is a criterion the financial intermediary must weigh in its own risk analysis, and only that analysis can make it a higher-risk case. FINMA restated the distinction after the June 2026 plenary: the FATF does not call for enhanced due diligence on grey-listed jurisdictions, and intermediaries are to take the information into account in their risk management. In practice, when a list changes, the change lands in your obligations on different dates in different jurisdictions, and a group policy pegged only to "the FATF list" is pegged to the wrong variable.

The second-order effects

The statutory duty falls on obliged entities: banks, payment and crypto firms, the professions and the other categories the AML regimes name, and for them the direct enhanced due diligence obligation is manageable. An ordinary corporate whose supplier or customer sits in a listed jurisdiction has no such duty of its own; it meets the listing through its bank's questions, its counterparties' contractual requirements and its own commercial diligence, and that indirect layer is where the cost sits. Correspondent banks reprice or abandon corridors touching listed jurisdictions, a dynamic the EBA has criticised as unwarranted de-risking when applied wholesale, while recognising that exiting a relationship can be a legitimate risk-management decision. Payments slow while intermediaries ask questions. Counterparties and insurers demand comfort letters. And a grey-listing can appear mid-transaction: a supplier's jurisdiction listed between signing and closing changes the diligence, sometimes the conditions precedent, of a deal already priced. The companies that handle this well are the ones whose country-risk model anticipated the possibility, whose exposure to the jurisdiction is quantified, and whose file shows a decision, taken by someone identifiable, on why the relationship continues under enhanced controls or why it ends.

What this means for you

• Peg your model to each mechanism. The EU list moves by delegated act on its own dates, the UK obligation follows the FATF call-for-action list automatically, and the Swiss criteria read the FATF's two statements through GwV-FINMA; your policy should say which governs which entity.
• Update on a calendar, and on the law. Three FATF plenaries a year should trigger an automatic review of your country-risk ratings; an EU delegated act, a domestic amendment such as the UK's of 30 June 2026, or a FINMA statement takes effect on its own date and needs a review of its own.
• Distinguish grey from black in substance. On the call-for-action list, apply the mandatory measures and any countermeasures and sanctions; on the grey list, let documented, customer-specific due diligence and the ability to mitigate the risk decide whether a relationship continues. Treating both lists identically is the wholesale de-risking the EBA has criticised as unwarranted.
• Quantify exposure per jurisdiction. When the question comes, from a bank, an auditor or a regulator, "how much and where" should have a same-day answer.
• Minute the decisions. Continuing, restricting or exiting a relationship after a listing is a judgement; the file should show who made it and on what basis.

Isak Legal advises financial institutions, fintechs and corporates on country-risk frameworks, enhanced due diligence design and the interaction of the EU, UK and Swiss regimes. See our Sanctions and AML page, or get in touch.

This client update is provided for general information only, reflects the position as at 26 September 2026 and does not constitute legal advice or create a lawyer-client relationship. List contents change at each FATF plenary and regional lists follow their own procedures; always verify the current lists at the official sources linked above. For advice on a specific matter, please contact us.