On October 30, 2026, the Financial Action Task Force (FATF) removed Bulgaria, Côte d’Ivoire, the Democratic Republic of Congo, and Monaco from its list of jurisdictions under increased monitoring, commonly called the “grey list.” The Financial Crimes Enforcement Network (FinCEN) also alerted U.S. financial institutions to the updated lists. For U.S. banks, the practical takeaway is to reassess geographic risk rather than automatically relax Bank Secrecy Act/anti-money laundering (BSA/AML) controls for every customer connected to a delisted country.

What Is FATF, and Why Do Its Lists Matter?

FATF is an intergovernmental body that establishes international standards for combating money laundering, terrorist financing, and the financing of weapons proliferation. Through country evaluations and ongoing monitoring, it assesses both compliance with those standards and the effectiveness of national financial-crime controls.

Its two public lists communicate different levels of concern. Grey-listed jurisdictions have strategic deficiencies but have committed to addressing them within agreed timeframes. The “blacklist,” formally titled “High-Risk Jurisdictions Subject to a Call for Action,” identifies jurisdictions with significant strategic deficiencies warranting enhanced due diligence and, in the most serious cases, countermeasures.

For banks, those classifications inform risk assessments, but the applicable U.S. requirements come from domestic law, regulations, and sanctions. The distinction matters: An FATF designation is not a substitute for determining which U.S. obligations apply to a particular relationship or transaction.

What Changed in October?

The four grey-list removals followed successful on-site visits and completion of the countries’ action plans. Bulgaria, Côte d’Ivoire, the Democratic Republic of Congo, and Monaco will continue working with their respective regional bodies to sustain those improvements. The October update announced removals, but no new grey-list additions.

The blacklist remained unchanged: Iran, the Democratic People’s Republic of Korea (North Korea), and Myanmar. FATF continues to call for countermeasures against Iran and North Korea. Myanmar remains subject to enhanced due diligence proportionate to the risks, but not countermeasures.

That distinction should not obscure Myanmar’s continuing risks. FATF highlighted extensive fraud and cyber-scam activity and warned that it would consider countermeasures if further progress is not made by February 2027. It also emphasized that enhanced controls should not disrupt humanitarian assistance, legitimate nonprofit activity, or remittances.

Banks should also watch Vietnam. FATF expressed significant concern about the pace of progress and stated that it expects tangible improvements by February 2027, or it will consider next steps.

What This Means for U.S. Banks

Under federal bank anti-money laundering (AML) program requirements, banks’ AML programs must include internal controls, independent testing, a designated compliance officer, training, and risk-based ongoing customer due diligence. That diligence includes understanding customer relationships, developing risk profiles, monitoring for suspicious transactions, and updating customer information on a risk basis.

Foreign correspondent banking warrants particular attention. Covered institutions must assess relevant risks, including the foreign institution’s business, the account’s purpose and anticipated activity, and the jurisdiction’s AML and supervisory regime. Appropriate controls and periodic review must address the resulting exposure.

Greylisting does not, by itself, require enhanced due diligence for every customer with a connection to the country. FATF expressly disclaims such a blanket requirement, while FinCEN emphasizes existing, risk-based correspondent-account obligations. Separate mandatory enhanced due diligence requirements nevertheless apply to specified foreign bank correspondent accounts.

Delisting likewise supports reassessment, not an automatic downgrade of every connected relationship. A bank should weigh the reasons for removal alongside customer-specific information and transaction activity.

Sanctions and special measures require a separate analysis. Restrictions involving Iranian and North Korean financial institutions include correspondent-account prohibitions. FATF status does not displace those requirements or applicable Office of Foreign Assets Control (OFAC) sanctions.

Practical Steps Banks Should Take

  • Refresh country-risk assessments. Update internal country classifications and document how the four delistings affect the bank’s assessment. Explain any decision to retain an elevated rating based on residual risks. Avoid treating list membership as the only input.
  • Identify actual exposure. Review affected customer relationships, ownership information, correspondent accounts, and payment activity. As a practical implementation measure, distinguish between direct country exposure and indirect exposure through intermediaries, rather than relying solely on a customer’s address.
  • Recalibrate due diligence and monitoring. Assess whether account reviews, monitoring scenarios, or escalation procedures need adjustment. Confirm that mandatory correspondent-account enhanced diligence remains in place where applicable. For Myanmar-related exposure, consider whether the controls adequately address the fraud and cyber-scam risks identified by FATF.
  • Keep sanctions controls separate. Review OFAC restrictions and FinCEN special measures independently of FATF classifications. Operationally, a grey-list removal should not automatically clear a sanctions restriction or override a prohibited correspondent relationship.
  • Evaluate suspicious activity on its merits. Apply the federal suspicious activity report requirements to the underlying facts. Country exposure may inform the analysis, but listing alone does not replace the applicable transaction, dollar-threshold, and knowledge-or-suspicion requirements. Document investigative conclusions rather than treating a country flag as the decision.
  • Document, train, and test. Assign responsibility for implementing changes, train relevant personnel, and incorporate the changes into independent testing. Explain the difference between targeted risk management and indiscriminate de-risking, which FinCEN cautions against.

FATF’s October update is an opportunity to make compliance more precise, not simply more restrictive or more permissive. Banks should recognize demonstrated improvements while preserving controls justified by actual exposure. The objective is a defensible, documented risk decision, not a reflexive response to a country label.