FATF October 2026 Plenary: Four Grey-List Exits, Black List Unchanged

The FATF October 2026 plenary closed in Paris on 30 October 2026 with four removals from the list of jurisdictions under increased monitoring, the grey list: Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco. The list of high-risk jurisdictions subject to a call for action, the black list, kept its three names. The Democratic People’s Republic of Korea (DPRK) and Iran remain subject to countermeasures, and Myanmar to enhanced due diligence.

For screening and country-risk teams, the FATF flag on four countries changes today, but the legal consequences run on separate clocks. Monaco, Côte d’Ivoire and the DRC still appear in the EU Annex that triggers enhanced due diligence under Article 18a of Directive (EU) 2015/849. In the UK, mandatory enhanced due diligence is unaffected, because since 30 June 2026 only the call-for-action list drives regulation 33(1)(b) of the Money Laundering Regulations 2017.

Related reading: MONEYVAL Bulgaria AML Follow-Up: The Correspondent Banking Read

Dates around the October 2026 FATF lists

• 30 October 2026: date of both FATF list statements, at the close of the 28 to 30 October plenary.
• 1 to 2 December 2026: FATF Learning and Development Forum in Dallas on the risk-based approach, with a policy statement to follow.
• December 2026: publication of the adopted mutual evaluation reports on Mexico and the United States.
• Next FATF Plenary: the FATF will consider next steps on Vietnam absent tangible improvements.
• February 2027: FATF will consider countermeasures on Myanmar if no further progress is made.
• 10 July 2027: Regulation (EU) 2024/1624 (AMLR) applies to most obliged entities, with a new Commission mechanism for listing third countries.

What the FATF October 2026 plenary changed on each list

The four removals followed successful on-site visits. The FATF said each jurisdiction completed its action plan within the agreed timeframes and will keep working with its regional body: GIABA for Côte d’Ivoire, GABAC and ESAAMLG for the DRC, and MONEYVAL for Bulgaria and Monaco. Neither the outcomes statement nor FinCEN’s release of the same day names an addition.

Reconciling the 22 names on the 19 June 2026 list against the four removals leaves 18 jurisdictions. They are Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK) and Yemen. Treat that as a cross-check; for a screening table, use the 18 jurisdictions in the active increased-monitoring section of the FATF’s 30 October 2026 statement, not the four it separately identifies as no longer subject to increased monitoring.

On the black list, the FATF updated its statements on Myanmar’s fraud and scam risks and on Iran’s terrorist financing offence and targeted financial sanctions regime. Myanmar remains subject to enhanced due diligence, not countermeasures, as FinCEN’s 30 October release confirms. The FATF’s 30 October statement says it will consider countermeasures if Myanmar makes no further progress by February 2027.

Monaco, Côte d’Ivoire and the DRC remain on the EU list

Article 18a(1) of Directive (EU) 2015/849, inserted by Directive (EU) 2018/843, requires enhanced due diligence measures for business relationships or transactions involving high-risk third countries identified pursuant to Article 9(2). Those are the countries in the Annex to Commission Delegated Regulation (EU) 2016/1675, which changes only by Commission delegated regulation, from that act’s entry into force.

The Commission’s table, last updated on 9 January 2026, shows Monaco and Côte d’Ivoire listed with effect from 5 August 2025 and the DRC from 16 March 2023. It still shows Algeria and Namibia, which left the FATF grey list in June 2026. Until an amending delegated regulation removes the three October leavers and enters into force, Article 18a continues to apply to them. EUR-Lex is where that amendment will appear.

Bulgaria, as an EU Member State, was never in the Annex, so its removal changes an input to an EU firm’s own risk assessment and nothing in Article 18a. The divergence also runs the other way: the Russian Federation, whose FATF membership suspension the plenary said continues to stand, is on neither FATF list but has been in the EU Annex since 29 January 2026.

The mechanism changes when the AMLR applies from 10 July 2027. Article 29 covers countries with significant strategic deficiencies, taking into account calls for action by standard setters, which recital 84 identifies as the FATF. Article 30 covers countries with compliance weaknesses, uses information on jurisdictions under increased monitoring as a baseline and has the Commission specify the enhanced due diligence measures. Both set a 20-calendar-day deadline for the delegated act once the Commission ascertains the criteria are met. Our EU AML package guide covers the wider timetable.

UK firms: the grey list left regulation 33(1)(b) on 30 June 2026

S.I. 2026/621 replaced “high-risk third country” in regulation 33(1)(b) of the Money Laundering Regulations 2017 with “FATF call for action country”, defined in regulation 33(3)(a) as a country named on the FATF’s call-for-action list as that list has effect from time to time. HM Treasury’s explanatory memorandum says the old rule applied mandatory enhanced due diligence to both categories of FATF-listed countries and that the instrument narrows it to call-for-action countries.

The October grey-list removals therefore leave the regulation 33(1)(b) population untouched, and with the black list unchanged it remains Iran, the DPRK and Myanmar. On my reading of the “from time to time” wording, a future black-list change would flow into regulation 33(1)(b) without a new statutory instrument.

Grey-list status still belongs in the risk assessment: regulation 33(6)(c) lists geographical risk factors, including a country identified as not having effective systems to counter money laundering or terrorist financing. A policy that treats FATF grey-list membership alone as a mandatory enhanced due diligence trigger under regulation 33(1)(b) relies on superseded wording. However, regulation 33(1)(a) still requires firms to apply enhanced customer due diligence and enhanced ongoing monitoring where their risk assessment identifies a high risk of money laundering or terrorist financing. Grey-list status remains a geographical risk factor; where that assessment identifies high risk, the resulting enhanced measures are mandatory, not discretionary.

FinCEN’s 30 October release for US institutions

FinCEN says US financial institutions should consider the FATF’s stance toward the listed jurisdictions when reviewing their obligations and risk-based policies, and points to the correspondent account due diligence rules in 31 CFR 1010.610. For jurisdictions removed from the FATF process, institutions should take the FATF’s decisions and the reasons behind the delistings into consideration when assessing risk. The release also says due diligence should not become grounds for wholesale or indiscriminate de-risking. For Iran, it points to OFAC sanctions and a FinCEN section 311 rule barring correspondent accounts for Iranian financial institutions, both US obligations in their own right.

Status by regime for the jurisdictions in play

Reading the removals, Vietnam and Myanmar in a country-risk model

A removal is one input to a score. Bulgaria shows the sequence: in June 2026 the FATF made its initial determination that Bulgaria had substantially completed its action plan and warranted an on-site assessment, and the October removal followed the visit.

Vietnam is the name to watch. The FATF expressed significant concern with its pace of progress and will consider next steps if it does not make tangible improvements by the next Plenary, without saying what those steps would be. The June 2026 statement noted that all of Vietnam’s action-plan deadlines expired in May 2025, with open items including the regulation of virtual assets and virtual asset service providers.

The grey list itself carries no FATF call for enhanced due diligence. The June 2026 statement says so, adds that the FATF Standards do not envisage de-risking, and asks countries to keep humanitarian assistance, legitimate NPO activity and remittances flowing. In Luxembourg, the CSSF de-risking communique takes up the same theme.

Myanmar’s updated statement centres on fraud and scams. The plenary also approved a report on illicit financial flows linked to scam compounds, due for publication the week after the plenary and the first output of the FATF’s fraud roadmap under the UK Presidency; our FATF fraud roadmap article covers that programme.

Plenary outcomes that reach screening files later

The plenary adopted the FATF-GAFILAT mutual evaluation of Mexico and the FATF-APG-CFATF mutual evaluation of the United States, for publication in December 2026 after a quality and consistency review. Until then their ratings have no public source for a country-risk score or respondent review. Our FATF Türkiye mutual evaluation article shows how a published report changes a correspondent file.

The plenary also launched a targeted review of jurisdictions with materially important virtual asset sectors, with results in June and October 2027, and agreed tailored assessments for a subset of low-capacity countries. Neither moves a jurisdiction on or off a list today.

Frequently Asked Questions

Do EU group branches and subsidiaries in Côte d’Ivoire, the DRC or Monaco attract automatic enhanced due diligence while those countries stay in the Annex?

The second subparagraph of Article 18(1) of Directive (EU) 2015/849 says enhanced due diligence need not be invoked automatically for branches or majority-owned subsidiaries of EU obliged entities located in high-risk third countries that fully comply with group-wide policies under Article 45, with Member States ensuring a risk-based approach to those cases. On my reading, that carve-out remains available for the three October leavers while the Annex lists them; national transposition can add detail.

Iraq and Bosnia and Herzegovina joined the grey list in June 2026 but are absent from the Commission’s table. What applies to them?

They are not Article 18a countries unless the Commission adds them to the Annex. Annex III to the Directive lists, as a geographical risk factor, countries identified by credible sources such as mutual evaluations or published follow-up reports as not having effective AML/CFT systems; on my reading, a FATF grey-list statement belongs in that assessment. In the UK, neither is a call-for-action country.

Related Articles

• MONEYVAL Bulgaria AML Follow-Up: The Correspondent Banking Read: Bulgaria’s June 2026 MONEYVAL follow-up and correspondent banking reviews.
• The EU AML Package: The Countdown to 10 July 2027: the AMLR, AMLD6 and AMLA timetable.
• FATF Fraud Roadmap 2026-2028: Fraud as a Core AML Risk: the FATF fraud programme behind the scam compound report.
• FATF Türkiye Mutual Evaluation 2026: Refreshing the Respondent File: how a published FATF evaluation feeds a correspondent review.

Key Takeaways

• Country tables need separate FATF and EU Annex fields: the 30 October statement moves the first for Monaco, Côte d’Ivoire and the DRC, while the second waits for a Commission delegated regulation.
• UK policies written before 30 June 2026 that treat grey-list membership alone as a mandatory regulation 33(1)(b) trigger need their stated basis changed; enhanced measures remain mandatory under regulation 33(1)(a) where the firm’s risk assessment identifies high risk.
• Myanmar remains subject to enhanced due diligence; the FATF will consider countermeasures if no further progress is made by February 2027.
• US risk files on the delisted jurisdictions should record the FATF’s reasons for each delisting, which FinCEN asks institutions to consider.

Sources and References

• FATF, Outcomes FATF Plenary, 28-30 October 2026: fatf-gafi.org
• FATF, Jurisdictions under Increased Monitoring, 30 October 2026: fatf-gafi.org
• FATF, High-Risk Jurisdictions subject to a Call for Action, 30 October 2026: fatf-gafi.org
• FATF, Jurisdictions under Increased Monitoring, 19 June 2026: fatf-gafi.org
• FATF, High-Risk Jurisdictions subject to a Call for Action, 19 June 2026: fatf-gafi.org
• FinCEN, release on FATF-identified jurisdictions, 30 October 2026: fincen.gov
• Directive (EU) 2015/849, Article 18(1) and Annex III: EUR-Lex
• Directive (EU) 2018/843, inserting Article 18a: EUR-Lex
• Commission Delegated Regulation (EU) 2016/1675, consolidated 29 January 2026: EUR-Lex
• European Commission, AML/CFT at international level (high-risk third countries table): finance.ec.europa.eu
• Regulation (EU) 2024/1624, Articles 29, 30 and 90, recitals 84 and 85: EUR-Lex
• Money Laundering Regulations 2017, regulation 33: legislation.gov.uk
• S.I. 2026/621, regulation 19: legislation.gov.uk
• HM Treasury, Explanatory Memorandum to S.I. 2026/621: legislation.gov.uk

Updating Country-Risk Tables After 30 October 2026

The EU field has no fixed date for its next change: it moves when a Commission delegated regulation amending the Annex to Delegated Regulation (EU) 2016/1675 enters into force. On the FATF side, the next scheduled input is the December 2026 publication of the Mexico and United States mutual evaluations, when their adopted ratings can enter a country-risk score.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.