FATF grey list, October 2026: four exits, no additions

The FATF wrapped up its October plenary in Paris on 30 October, and this time the grey list got shorter without anyone new being added to it. Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco have all come off, taking the list from 22 jurisdictions down to 18, while the blacklist stays as it was.

This was also the first plenary under the UK Presidency of Giles Thomson. Much of the wider discussion focused on virtual assets, with the FATF agreeing a targeted review of jurisdictions where virtual asset activity is significant (results are due in June and October 2027). The mutual evaluations of Mexico and the United States were adopted at the same meeting.

For First AML customers, the platform takes care of the list change itself. Below we've set out the detail, along with a few things your team may still want to look at.

Bulgaria, Côte d'Ivoire, the DRC and Monaco come off the grey list

All four completed their FATF action plans within the agreed timeframes, and on-site visits confirmed that the reforms are being put into practice.

Monaco and Bulgaria are likely to be the most relevant for our customers. Monaco was added in June 2024 and comes up often with private clients and holding structures, while Bulgaria had been listed since October 2023 and tends to appear in EU property and corporate matters. Côte d'Ivoire and the DRC will touch fewer files for most firms, although any case that does involve them will now be assessed differently.

The lists as of 30 October 2026

Call for action (blacklist)

The Democratic People's Republic of Korea, Iran and Myanmar, with no change at this plenary.

Increased monitoring (grey list)

Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK) and Yemen, making 18 jurisdictions in total.

Removed at this plenary

Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco. No jurisdictions were added.

Source: FATF, Jurisdictions under Increased Monitoring, 30 October 2026.

Vietnam and others to keep an eye on

No new names were added, but the FATF did single out jurisdictions whose progress has stalled. Vietnam is the most notable, with the FATF saying it will consider next steps if it doesn't see tangible improvement by the February 2027 plenary. Cameroon, Haiti and South Sudan have each reached the point where every deadline in their action plans has expired with work still outstanding, and the FATF described South Sudan's progress as limited.

If any of your clients have connections to these countries, it may be useful to know that now rather than after the February meeting.

Coming off the list isn't the same as being low risk

Removal means the FATF is no longer monitoring a country's action plan. That's a meaningful step for the country, but it says less about the risk of any individual client. Most firms treat grey list status as one factor in country risk, alongside measures like the Basel AML Index and their own knowledge of the client, and that doesn't change here.

In practice, a client connected to Monaco or Bulgaria won't trigger the grey list factor any more but could still come out as higher risk for other reasons. The EU high-risk third country list and national lists are also updated on their own schedules, so a country can stay on one of those for some time after leaving the FATF list. How all of this feeds into your risk scores, and when enhanced due diligence applies, is set by your own AML/CTF program.

First AML keeps the FATF lists up to date for you

With the FATF updating its lists in February, June and October each year, keeping track of the grey list by hand and remembering which rules depend on it is easy to get wrong. First AML maintains the call for action and increased monitoring lists centrally and updates them on the platform after each plenary, so there's nothing for you to edit or upload.

Our built-in jurisdiction rules check the client, beneficial owners and other parties on a case against the current lists. Once the October changes are in, a party whose only connection is to one of the four removed jurisdictions won't trigger the grey list rule, and the 18 jurisdictions still listed are treated as before.

If you're using Smart RA, which is currently in beta, the FATF questions in your risk assessment templates are answered from platform data. When the list changes, those answers update and a new risk assessment version is recorded against the First AML system, so you can see when and why it changed. You'll also get a notification if the overall risk level moves.

What we'd suggest doing after this update

It's worth making a note in your compliance register that you've reviewed the 30 October update, and looking at any clients linked to the four removed jurisdictions. Where enhanced measures are in place for those clients, consider whether they're still justified on other grounds before stepping them down.

If your AML/CTF program or enterprise-wide risk assessment names grey listed countries, it will need updating to match. And if your program also relies on the EU list or a national list, check whether those have changed as well.

The next plenary is in February 2027, and we'll update the lists again once the results are out. If you'd like to see which of your cases involve these jurisdictions, or you're interested in turning on Smart RA, your Customer Success Manager can help.