FATF Updates Its Grey List: Compliance Implications of the February 2026 Plenary

The Financial Action Task Force updated its lists of high-risk and monitored jurisdictions following its Plenary meeting in Mexico City from 11 to 13 February 2026.

The most visible change was the addition of Kuwait and Papua New Guinea to the list of jurisdictions under increased monitoring, commonly known as the FATF “grey list”.

No jurisdiction was removed from increased monitoring at the February meeting. However, FATF determined that Algeria and Namibia had substantially completed their respective action plans, allowing both jurisdictions to proceed towards on-site assessments. They remain on the grey list until the FATF completes that process and formally approves their removal.

The list of high-risk jurisdictions subject to a call for action—often referred to as the “black list”—continued to include:

• Democratic People’s Republic of Korea;
• Iran; and
• Myanmar.

Although these announcements are closely followed by banks, fintech companies, payment institutions and other regulated businesses, the compliance implications are often misunderstood.

A country’s addition to the grey list does not automatically mean that all customers connected with that jurisdiction should be rejected. Nor does removal from the list mean that all country-related risks have disappeared.

FATF expects institutions to apply a risk-based response, not a purely list-based one.

The February 2026 FATF Lists at a Glance

High-Risk Jurisdictions Subject to a Call for Action

As of 13 February 2026, FATF identified the following high-risk jurisdictions:

Jurisdiction	FATF response
Democratic People’s Republic of Korea	Countermeasures and enhanced due diligence
Iran	Countermeasures
Myanmar	Enhanced due diligence proportionate to the risks

The three jurisdictions appear in the same high-risk public statement, but the measures applicable to them are not identical.

For the Democratic People’s Republic of Korea and Iran, FATF calls for effective countermeasures.

For Myanmar, FATF calls for enhanced due diligence rather than countermeasures. However, FATF warned that it could consider countermeasures if Myanmar failed to demonstrate further progress by June 2026.

This distinction is important. Institutions should not treat every jurisdiction appearing in the high-risk statement as though the same restrictions apply.

Jurisdictions Under Increased Monitoring

The February 2026 grey list contained 22 jurisdictions:

• Algeria;
• Angola;
• Bolivia;
• Bulgaria;
• Cameroon;
• Côte d’Ivoire;
• Democratic Republic of the Congo;
• Haiti;
• Kenya;
• Kuwait;
• Lao People’s Democratic Republic;
• Lebanon;
• Monaco;
• Namibia;
• Nepal;
• Papua New Guinea;
• South Sudan;
• Syria;
• Venezuela;
• Vietnam;
• Virgin Islands (UK); and
• Yemen.

Kuwait and Papua New Guinea were the two new additions following the February Plenary.

What Does Being on the Grey List Actually Mean?

A jurisdiction under increased monitoring has strategic deficiencies in its framework for combating money laundering, terrorist financing or proliferation financing.

However, grey-listing also means that the jurisdiction has made a high-level political commitment to work with FATF or the relevant FATF-style regional body to address those deficiencies through an agreed action plan.

The grey list should therefore not be interpreted as a statement that every person, company or transaction connected to the jurisdiction is suspicious.

FATF explicitly states that it does not call for enhanced due diligence to be applied automatically to all grey-listed jurisdictions.

It also states that its standards do not envisage wholesale de-risking or the termination of entire categories of customer relationships.

Instead, FATF expects institutions and national authorities to consider the information in their risk assessments and respond in a manner proportionate to the actual risk.

This distinction is central to sound compliance practice:

Grey-listing is a country-risk indicator, not an automatic customer rejection rule.

What Changed in February 2026?

Kuwait Was Added Despite Significant Reform Progress

Kuwait’s addition may appear surprising because FATF also acknowledged that the country had made significant progress on the majority of the recommended actions arising from its mutual evaluation.

Kuwait had adopted a new national AML/CFT and proliferation financing strategy, improved parts of its targeted financial sanctions framework, strengthened its understanding of money laundering and terrorist financing risks, and expanded risk-based supervision and outreach.

Its remaining FATF action plan focused on areas including:

• Improving suspicious transaction reporting awareness among real estate agents and dealers in precious metals and stones;
• Ensuring the accuracy of beneficial ownership information;
• Applying effective sanctions for inaccurate ownership information; and
• Increasing money laundering investigations and prosecutions relating to cross-border movements of currency and bearer negotiable instruments.

This illustrates an important point for financial institutions.

A jurisdiction’s grey-listing does not necessarily mean its entire AML framework is ineffective. The relevant deficiencies may be concentrated in particular sectors, controls or enforcement outcomes.

Institutions should therefore review the reasons for listing rather than relying only on the country’s label.

For example, Kuwait-related exposure involving real estate, precious metals, cross-border cash movements or opaque ownership structures may warrant closer attention than an ordinary, transparent commercial relationship with no connection to those risk areas.

Papua New Guinea Entered With a Broader Action Plan

Papua New Guinea also made a high-level political commitment to strengthen its AML/CFT framework.

FATF acknowledged progress in areas such as strengthening the anti-corruption authority, developing a national risk assessment and improving the communication of United Nations sanctions updates.

However, its action plan covered a relatively broad range of issues, including:

• Improving its understanding of money laundering risks;
• Strengthening its national AML/CFT and proliferation financing strategy;
• Improving international cooperation to identify and trace criminal property;
• Strengthening risk-based supervision of banks, money transfer businesses, foreign exchange dealers and higher-risk non-financial sectors;
• Increasing money laundering investigations and prosecutions;
• Improving the freezing, seizure and confiscation of criminal assets;
• Strengthening implementation of proliferation financing sanctions; and
• Addressing deficiencies involving politically exposed persons and suspicious transaction reporting.

Financial institutions with Papua New Guinea exposure should consider whether these identified weaknesses affect their ability to verify ownership, assess source of funds, understand transaction purposes or rely on information produced by local counterparties.

Algeria and Namibia Moved Closer to Removal

FATF determined that Algeria and Namibia had substantially completed their action plans and were eligible for on-site assessments.

An on-site assessment is intended to verify that the required reforms have begun, are being implemented sustainably and continue to receive political and institutional support.

This does not mean that either jurisdiction was removed from the grey list in February 2026.

Until FATF formally approves removal at a future Plenary, institutions should continue to treat both jurisdictions according to their current listed status.

At the same time, their progress may be relevant when determining whether an internal country-risk rating should remain unchanged, be placed under review or be adjusted after formal delisting.

Does Grey-Listing Mean Customers Should Be Automatically Rejected?

No.

Automatic rejection based only on a customer’s connection to a grey-listed jurisdiction is generally inconsistent with FATF’s risk-based approach.

A person may be connected to a grey-listed jurisdiction because they:

• Were born there;
• Hold its nationality;
• Reside there;
• Own a company incorporated there;
• Conduct legitimate trade there;
• Have employees or suppliers there;
• Receive family remittances from there; or
• Use a financial institution located there.

These connections do not carry the same level of risk.

A transparent operating company with identifiable owners, credible commercial activities and payments supported by genuine invoices presents a different risk from a shell company with nominee ownership, unexplained international transfers and no clear economic purpose.

Institutions should assess the complete relationship rather than applying a country label in isolation.

Relevant factors may include:

• The customer’s country of residence;
• Country of incorporation;
• Principal place of business;
• Nationality of beneficial owners and controllers;
• Location of operating assets;
• Source of wealth and source of funds;
• Expected transaction corridors;
• Industries and products involved;
• Quality of corporate and beneficial ownership information;
• Use of intermediaries;
• Exposure to politically exposed persons;
• Sanctions and proliferation financing risks; and
• The specific deficiencies identified by FATF.

A higher-risk country connection may increase the overall risk score without necessarily making the relationship unacceptable.

When Should Enhanced Due Diligence Be Applied?

Enhanced due diligence should be applied where the identified risk is higher and additional information or controls are necessary to understand and manage that risk.

EDD may be required because of:

• A FATF call for enhanced due diligence;
• National legislation or regulatory requirements;
• The institution’s internal risk appetite;
• A combination of country, customer, product and transaction risks; or
• Specific concerns identified during onboarding or ongoing monitoring.

High-Risk Jurisdictions

For Myanmar, FATF expressly calls for enhanced due diligence proportionate to the risks arising from the jurisdiction.

FATF expects financial institutions to increase the degree and nature of monitoring applied to relevant business relationships in order to determine whether transactions or activities are unusual or suspicious.

For the Democratic People’s Republic of Korea and Iran, institutions must consider the countermeasures required by FATF, applicable United Nations sanctions and relevant national laws.

Depending on the jurisdiction and the institution’s regulatory obligations, these measures may include:

• Restricting or prohibiting certain relationships;
• Limiting transactions;
• Reviewing correspondent banking relationships;
• Increasing reporting requirements;
• Applying more intensive monitoring;
• Requiring senior management approval; or
• Refusing transactions that cannot be conducted lawfully or within risk appetite.

Grey-Listed Jurisdictions

Grey-listing alone does not create a universal FATF requirement to perform EDD on every customer or transaction.

However, EDD may still be appropriate where the customer has meaningful exposure to a grey-listed jurisdiction and other risk factors are present.

Examples include:

• Complex or opaque ownership structures;
• Difficulty verifying beneficial owners;
• Unexplained use of nominees or intermediaries;
• Significant cash activity;
• Transactions inconsistent with the customer’s profile;
• Payments involving higher-risk sectors;
• Unusual cross-border fund flows;
• Weak supporting documentation;
• Connections with politically exposed persons;
• Use of unregulated payment or virtual asset channels; or
• Exposure matching the weaknesses identified in the FATF action plan.

Possible EDD measures may include:

• Obtaining additional identification and ownership documents;
• Verifying information using independent sources;
• Establishing the reasons for the customer’s jurisdictional connections;
• Obtaining more detailed source-of-wealth and source-of-funds information;
• Understanding the commercial rationale for transactions;
• Reviewing expected counterparties and payment corridors;
• Requiring senior management approval;
• Applying more frequent customer reviews; and
• Increasing transaction monitoring.

EDD should have a defined purpose. Collecting more documents without understanding what risk they address does not necessarily improve compliance.

FATF Listing Is Not the Same as a Sanctions Designation

Financial institutions should avoid treating FATF lists and sanctions lists as interchangeable.

FATF identifies weaknesses in national systems for combating money laundering, terrorist financing and proliferation financing.

Sanctions regimes impose legal restrictions on designated countries, entities, vessels, individuals or activities.

A grey-listed jurisdiction is not automatically subject to comprehensive economic sanctions.

Similarly, removal from FATF monitoring does not remove sanctions that may apply under separate United Nations, national or regional regimes.

Country-risk assessment should therefore distinguish between:

• FATF status;
• United Nations sanctions;
• National sanctions;
• Terrorist financing exposure;
• Proliferation financing exposure;
• Corruption risk;
• Tax transparency;
• Political stability;
• Regulatory quality; and
• The institution’s own experience with customers and transactions from the jurisdiction.

Combining these factors into a single unexplained “high-risk country” label can produce inconsistent decisions.

How Should Institutions Update Their Country-Risk Ratings?

A FATF announcement should trigger a governed review of the institution’s geographic risk assessment.

It should not automatically produce the same risk-rating change for every listed jurisdiction.

1. Record the FATF Status Accurately

Institutions should distinguish between:

• Jurisdictions subject to countermeasures;
• Jurisdictions subject to enhanced due diligence;
• Jurisdictions under increased monitoring;
• Jurisdictions that have substantially completed an action plan but remain listed; and
• Jurisdictions formally removed from monitoring.

These statuses represent different levels of risk and different FATF expectations.

2. Review the Reasons Behind the Listing

The institution should examine the jurisdiction’s FATF statement and action plan.

The relevant weaknesses may involve:

• Beneficial ownership;
• Financial intelligence;
• Money laundering investigations;
• Asset confiscation;
• Terrorist financing;
• Proliferation financing;
• Virtual asset regulation;
• Supervision of banks;
• Supervision of company service providers;
• Casinos;
• Real estate;
• Precious metals and stones; or
• Non-profit organisations.

The institution can then determine whether those weaknesses are relevant to its customers, products and transaction flows.

3. Avoid a Purely Binary Model

Country risk should not be limited to “listed” or “not listed”.

A more useful methodology may include separate risk levels or weighted factors for:

• FATF countermeasures;
• FATF-required EDD;
• Increased monitoring;
• Recent removal from monitoring;
• Material action-plan progress;
• Sanctions exposure;
• Corruption and governance risks;
• Availability of reliable corporate information;
• Effectiveness of local supervision; and
• Quality of international cooperation.

This allows the institution to distinguish, for example, between Iran, Myanmar, Kuwait and a jurisdiction that has recently completed its FATF action plan.

4. Define the Geographic Connections That Affect Risk

Country risk should not be based solely on nationality.

Relevant connections may include:

• Residence;
• Incorporation;
• Business operations;
• Beneficial ownership;
• Source of wealth;
• Source of funds;
• Payment origin or destination;
• Counterparties;
• Correspondent banking relationships;
• Virtual asset exposure; and
• Location of assets.

Institutions should define which connections influence customer risk and how strongly each one is weighted.

5. Apply Changes to Both New and Existing Relationships

Updates should affect more than new customer onboarding.

Institutions should identify existing customers with material exposure to newly listed jurisdictions and determine whether further review is necessary.

This does not require every affected customer to undergo a full immediate refresh.

A proportionate approach may prioritise:

• Higher-risk customers;
• Customers with complex ownership;
• Correspondent banking relationships;
• Customers using higher-risk products;
• High-volume cross-border payment activity;
• Customers already subject to EDD; and
• Relationships involving sectors highlighted in the FATF action plan.

6. Document the Decision

The institution should record:

• The FATF update considered;
• The jurisdictions affected;
• The reasons for any rating change;
• The customer populations impacted;
• The controls to be applied;
• The implementation date;
• Any exceptions; and
• The date of the next review.

A documented decision is particularly important where the institution decides not to increase a rating despite a new FATF listing.

What Should Institutions Do After the February Update?

The addition of Kuwait and Papua New Guinea should trigger a structured change process.

Financial institutions may need to:

1. Update internal country-risk databases and screening rules;
2. Review customer and beneficial owner exposure to the two jurisdictions;
3. Identify relevant payment corridors and correspondent relationships;
4. Examine the specific FATF action plans;
5. Decide whether internal geographic risk scores should change;
6. Determine whether any customer segments require targeted review;
7. Update onboarding and EDD procedures where necessary;
8. Adjust transaction monitoring scenarios if the identified deficiencies are relevant;
9. Inform compliance, operations and relationship management teams; and
10. Record the rationale for the institution’s response.

Institutions should also note that Algeria and Namibia remained listed despite substantially completing their action plans.

Their status should not be changed to “removed” until FATF makes a formal decision following the on-site process.

Removal From the Grey List Does Not Eliminate Country Risk

When a jurisdiction is removed from increased monitoring, FATF has determined that it has addressed all or nearly all of its agreed action plan and demonstrated sufficient commitment to sustain reforms.

This is a significant positive development.

However, removal does not mean:

• Money laundering no longer occurs in the country;
• Corruption or sanctions risks have disappeared;
• All regulated sectors are equally effective;
• Beneficial ownership information is always reliable; or
• Every customer connected with the jurisdiction should become low-risk.

Institutions should review their country-risk rating after a removal, but the outcome should depend on the wider risk assessment.

Some institutions may reduce the FATF-related component immediately while retaining other risk factors.

Others may place the jurisdiction under observation for a defined period before making a larger change.

What matters is that the decision is reasoned, consistent and documented.

De-Risking Can Create Its Own Financial Crime Risks

Blanket restrictions on grey-listed jurisdictions can have unintended consequences.

Legitimate customers may lose access to regulated financial services. Businesses may turn to less transparent payment channels. Remittances may move through informal systems. Humanitarian organisations may experience difficulty delivering assistance.

These outcomes can reduce financial transparency rather than improve it.

FATF specifically warns against unnecessarily disrupting humanitarian assistance, legitimate non-profit activity and remittance flows.

A strong AML framework should identify and manage risk without treating entire countries or populations as inherently suspicious.

That requires better customer understanding, stronger data and more targeted controls—not simply broader rejection rules.

The Compliance Takeaway

The February 2026 update demonstrates why FATF announcements must be interpreted carefully.

The high-risk statement and the grey list are not identical. Even within the high-risk statement, the required response differs between jurisdictions.

The compliance implications can be summarised as follows:

• Democratic People’s Republic of Korea and Iran: Apply relevant countermeasures, sanctions controls and enhanced scrutiny.
• Myanmar: Apply enhanced due diligence proportionate to the risk; FATF had not yet called for countermeasures as of 13 February 2026.
• Grey-listed jurisdictions: Include the FATF information in the institution’s risk analysis, but do not automatically reject customers or impose EDD solely because of the listing.
• Kuwait and Papua New Guinea: Review customer, ownership, transaction and correspondent banking exposure following their addition.
• Algeria and Namibia: Recognise their progress, but continue treating them as listed until FATF formally approves removal.
• All jurisdictions: Consider the reasons for listing, not only the name of the country.

The central principle remains the same:

A FATF list should inform risk assessment, not replace it.

Institutions that apply FATF classifications as automatic rejection lists may create unnecessary exclusion without improving their understanding of financial crime risk.

Institutions that ignore the lists may fail to respond to material weaknesses in national AML/CFT systems.

The appropriate response lies between those extremes: a documented, proportionate and evidence-based approach that translates country-level developments into customer-level controls.

Main Sources

FATF — Outcomes of the FATF Plenary, 11–13 February 2026

https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-FATF-plenary-february-2026.html

FATF — Jurisdictions Under Increased Monitoring, 13 February 2026

https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html

FATF — High-Risk Jurisdictions Subject to a Call for Action, 13 February 2026

https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/Call-for-action-february-2026.html