FATF plenary October 2026: four exits from the grey list, and why your duties have not changed

Bulgaria, Cote d’Ivoire, the Democratic Republic of the Congo and Monaco came off the FATF grey list at the October 2026 plenary. No jurisdiction was added. For UK firms the arithmetic is simpler than the obligation: four fewer countries to flag, and exactly the same duty to assess and record country risk.

At its plenary of 28 to 30 October 2026, the Financial Action Task Force (FATF) removed four jurisdictions from its grey list and added none. The grey list now stands at 18 jurisdictions. The black list is unchanged, with Iran and North Korea subject to counter-measures and Myanmar to enhanced due diligence.

That is good news for the four countries concerned. For UK estate agents, letting agents and art market participants it makes very little practical difference. Since 30 June 2026 the grey list has not been an automatic trigger for enhanced due diligence in the UK. It is a risk factor you weigh and record. Four jurisdictions leaving it should change what your risk model says about those four countries, and leave the rest of your process where it is.

The live lists are kept on the FCS FATF Tracker, which is updated after every plenary. This article is the commentary on what October’s outcome means in practice.

What changed at the October 2026 FATF plenary?

Four jurisdictions left the grey list, formally described as jurisdictions under increased monitoring, and none joined it. The FATF said each of the four had completed its action plan within the agreed timeframes, following a successful on-site visit.

Two of those will matter more than the other two to FCS clients. Monaco is a routine presence in prime and super-prime London property transactions and in the private art market, and its listing in June 2024 put a visible flag on a lot of otherwise ordinary business. Bulgaria has a substantial UK property investment footprint. Cote d’Ivoire and the DR Congo appear far less often in UK estate agency and art market files.

Beyond the lists, the plenary put Vietnam on notice. The FATF recorded significant concern at the pace of Vietnam’s progress, with all of its action plan deadlines having expired in May 2025, and said it expects to see tangible improvements in February 2027 or it will consider next steps. Vietnam stays on the grey list in the meantime.

The black list, properly the list of high-risk jurisdictions subject to a call for action, did not change in composition. Iran and North Korea remain subject to counter-measures. Myanmar remains subject to enhanced due diligence rather than counter-measures, and the FATF repeated that it will consider counter-measures if no further progress is made by February 2027. It also updated its public statements on both Myanmar and Iran, reinforcing its call on Myanmar to address the extensive fraud and cyber scam activity emanating from the country, and its call on Iran to criminalise terrorist financing and establish a targeted financial sanctions regime in line with the FATF standards. The last set of changes to the lists themselves, two additions and two removals, came at the February 2026 plenary and the June plenary that followed it.

Does a country leaving the grey list reduce what you have to do?

No. In the UK, grey list membership has not been a mandatory enhanced due diligence trigger since 30 June 2026, so a country leaving it does not remove an obligation that was no longer there.

Most commentary on a plenary misses this, and it is worth getting right in your own file notes. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026, SI 2026/621, came into force on 30 June 2026 and narrowed the geographic trigger for enhanced due diligence sharply. Mandatory enhanced due diligence on country grounds now attaches only to a FATF call for action country, which means Iran, North Korea and Myanmar. Before that change, a connection to any of the 25 listed jurisdictions pulled a file into mandatory enhanced due diligence. Afterwards, three did.

The FATF says much the same thing in its own words. Its statement of 30 October on jurisdictions under increased monitoring is explicit:

The FATF does not call for the application of enhanced due diligence measures to be applied to these jurisdictions. The FATF Standards do not envisage derisking, or cutting-off entire classes of customers, but call for the application of a risk-based approach. FATF, Jurisdictions under Increased Monitoring, 30 October 2026

It goes on to ask countries to make sure humanitarian funds, legitimate not-for-profit activity and remittances are not disrupted. Grey listing has never been an instruction to treat a country as off limits, in UK law or in the FATF’s own framework.

So the practical effect of October’s plenary is narrow and specific. If your country risk model scores Bulgaria, Cote d’Ivoire, the DR Congo or Monaco upwards because of a FATF grey listing, that particular input has gone and the model should be updated to say so. Everything else about those countries stays exactly where it was: corruption indices, sanctions exposure, conflict, weak financial reporting, citizenship by investment schemes, and the jurisdictions named in the UK National Risk Assessment are all still live risk factors, and none of them is decided by the FATF.

It cuts the other way too, which is worth saying out loud to a nervous negotiator or a gallery director. Coming off the grey list is not a clean bill of health, and it is no reason to skip a check you would otherwise have done. Monaco left because it finished an action plan, not because every risk that put it there in 2024 has evaporated. The June 2026 review of the regulations sets out the wider set of changes this sits inside.

What this means for your firm

What you need to do

1. Update your country risk matrix for Bulgaria, Cote d’Ivoire, the DR Congo and Monaco, and date the change so the reason for it is on the record.
2. Check your screening rules. If a system flags on “FATF grey list” as a static list, make sure it is reading the current 18 and not a cached 22.
3. Leave the call for action countries alone. Iran, North Korea and Myanmar are unchanged and remain the only mandatory geographic enhanced due diligence trigger.
4. Do not downgrade live files automatically. A file opened under the old grey list treatment should be reviewed on its own facts, not reclassified in bulk.
5. Record the decision either way. Where enhanced measures were considered and not applied, the reasoning needs to be in the file. If a decision is not recorded, an inspector will work on the basis that it was not made.
6. Diarise February 2027. Two things land at that plenary: whether the FATF applies counter-measures to Myanmar, and whether Vietnam has made the tangible improvements the FATF is now demanding.

Who is on the lists now?

Confirmed at the FATF plenary of 28 to 30 October 2026.

One point worth knowing before you quote any of these statements back to an inspector. Four of the 18, Bosnia and Herzegovina, Haiti, Iraq and Yemen, chose not to report this cycle, so the FATF has carried their previous statements forward and notes they may not reflect the jurisdiction’s most recent position. Syria and Yemen are further behind than that: their statements date from February 2023. The listing is current, the commentary underneath it is not always.

Not sure how country risk fits into your AML checks?

Most firms do not have a country risk problem. They have an evidence problem: a rating that is reasonable, applied consistently, and written down nowhere an inspector can find it. A review of your customer due diligence process will show you which of those three you are missing.

Customer due diligence Talk to us