What Changed at FATF’s October Plenary
On October 30, the Financial Action Task Force opened its first plenary under the United Kingdom’s presidency by redrawing the map that sits underneath every onboarding and screening decision a financial institution makes. Four jurisdictions came off the list of countries under increased monitoring, the roster the industry still calls the grey list: Bulgaria, Cote d’Ivoire, the Democratic Republic of the Congo, and Monaco, each after a successful on-site review. No new countries were added, leaving eighteen. The high-risk list that carries a call for action held steady at three: North Korea, Iran, and Myanmar.
For most compliance programs, none of that will register for weeks. The customer risk ratings built on the old map will keep running as though nothing moved. That gap, between when the map changes and when the program notices, is where avoidable risk quietly accumulates.
Country Risk Is Not a Field You Set Once
Geographic risk is one of the oldest inputs in anti-money-laundering work: where a customer is domiciled, where the money originates, where it is headed. In too many programs it is also one of the most static. A country receives a rating at onboarding, that rating lands in the customer risk score, and it sits there, often untouched until the relationship is reviewed a year or three later. The jurisdiction field gets treated like a date of birth: entered once, assumed permanent.
FATF does not treat the world that way. It revises its monitored-jurisdiction lists three times a year, at plenaries spaced roughly every four months, and those revisions reflect real movement in a country’s controls. Sanctions regimes move faster still, sometimes within a single afternoon. The map a program screens against has a shelf life measured in months. A risk rating set at onboarding and never refreshed is, by definition, screening against a map that expired two or three plenaries ago.
A customer onboarded as low risk last spring may sit in a grey-listed jurisdiction today, and the file would never know.
Removal Is a Risk Event Too
It is tempting to treat a grey-list removal as good news that asks nothing of you. Bulgaria, Monaco, and the others cleared their action plans; the pressure is off. But a program that keeps over-weighting a now-stale designation goes on generating enhanced due diligence, manual reviews, and transaction friction for customers and corridors the global standard-setter has just reassessed. That is wasted analyst time, needless customer abrasion, and alert volume that buries the alerts that actually matter.
The reverse failure is worse. When a jurisdiction is added, or a sanctions action lands, a program that does not propagate the change leaves exposed customers rated as though nothing happened. Both failures share one root cause: jurisdictional risk is being stored as a value instead of maintained as a feed. The direction of the error changes; the data-currency problem does not.
A Flag Is Not Context
There is a deeper limitation than staleness. Most programs reduce a jurisdiction to a single bit: grey or not grey, listed or clear. That binary throws away nearly everything FATF actually says. Behind each listing is a detailed statement about specific deficiencies, the sectors most exposed, the typologies of concern, and the progress a country has or has not made against a named action plan. A customer with no exposure to the weak sector in a grey-listed country is not the same risk as one operating squarely inside it. The flag cannot tell them apart. The context can.
That is the difference between knowing a country is on a list and understanding why, and what it means for the specific customer in front of you. The same plenary that trimmed the grey list adopted mutual evaluation reports for the United States and Mexico under FATF’s newest assessment round, a reminder that even home-jurisdiction expectations get reassessed and rewritten, not fixed in place. And the pressure is widening: the plenary agreed to accelerate implementation of the standards for virtual assets in markets with material activity, and named fraud and scam compounds among the fastest-evolving threats. The risk surface keeps expanding, so the data layer beneath it has to keep pace.
October 2026, at a glance: Four jurisdictions left the list of countries under increased monitoring (Bulgaria, Cote d'Ivoire, the Democratic Republic of the Congo, and Monaco); none were added, leaving eighteen. The call-for-action list held at three (North Korea, Iran, and Myanmar). FATF also adopted new-round mutual evaluations for the United States and Mexico, moved to accelerate virtual-asset supervision, and flagged fraud and scam compounds as a rising threat.
What Living Country Risk Looks Like
- Treat the list as a feed, not a file. Re-ingest FATF’s monitored-jurisdiction changes on every plenary, and sanctions changes continuously, instead of on an annual review cadence.
- Re-rate automatically. When a jurisdiction’s status changes, let it flow through to every affected customer risk score and enhanced-due-diligence trigger, without waiting for the next scheduled review.
- Capture the why, not just the whether. Record the specific deficiencies, exposed sectors, and action-plan status behind a listing, so an analyst sees materiality rather than a bare color.
- Reconcile the whole book. Ask which existing customers and counterparties sit in jurisdictions that just changed, in either direction, and resolve the over-rated and under-rated cases together.
- Keep the evidence. When an examiner asks why a customer carried a given rating on a given date, be able to show the jurisdictional data and context that drove it.
FAQs
The FATF reviews its list of jurisdictions under increased monitoring, known as the grey list, at each of its plenary meetings, which are held three times a year, in February, June and October. Each plenary can add jurisdictions, remove them or leave the list unchanged, so a country risk rating set at onboarding can be out of date within months
The FATF removes a jurisdiction after it completes its action plan and a successful on-site visit confirms the reforms. At the October 2026 plenary it removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco, and added none. For a bank, removal is a risk event too: customers still rated as grey-listed can trigger unnecessary reviews and alert noise until the rating is updated, so institutions should re-rate affected customers rather than leave the old flag in place.
The grey list names jurisdictions under increased monitoring that have committed to fix strategic anti-money-laundering deficiencies with the FATF. The black list, formally the call for action, names jurisdictions with serious deficiencies where the FATF calls on members to apply enhanced due diligence and, in the most serious cases, countermeasures. After the October 2026 plenary the call-for-action list was unchanged at North Korea, Iran and Myanmar
Treat the FATF list as a data feed rather than a field set once at onboarding. Re-rate customers automatically when the list changes, capture the reasons behind each listing instead of a simple grey or not-grey flag, reconcile the change against the full customer book, and keep audit evidence of what changed and when. The FATF’s published context on specific deficiencies, sectors and action plans is what lets a team judge how much a listing matters to a given customer
Vital4 provides sanctions and watchlist, PEP and adverse media data collected directly from primary sources in 240+ countries, with every result traceable to its source. Smart Monitoring alerts only on new or changed records, so changes surface without re-screening the whole customer book. Banks can access the data through an API, a web interface, or both, and can book a demo to see how it fits their program.