FATF Explained: Recommendations, Mutual Evaluations and Lists

Almost every anti-money laundering rule you meet, from customer due diligence to the lists of high-risk countries, traces back to one organisation: the Financial Action Task Force, or FATF. It makes no laws itself, yet its standards shape the regulations of more than 200 jurisdictions. This guide explains what the FATF is, what its 40 Recommendations cover, how countries are assessed, and what the black and grey lists mean in practice for firms in the UK and elsewhere. For the UK changes that rely on those lists, see our timeline of 2026 AML changes for accountants.

What the FATF is

The FATF is an intergovernmental body based in Paris. It was set up in 1989 at a G7 summit and sets global standards against money laundering, terrorist financing and the financing of proliferation. It has 40 members: 38 jurisdictions plus the European Commission and the Gulf Co-operation Council. Russia's membership has been suspended since 24 February 2023. Nine FATF-style regional bodies extend the network, and more than 200 jurisdictions have committed to the standards through them.

The FATF cannot impose penalties. Its standards become binding when countries put them into national law, which is why UK, EU and other regulations use similar language on risk assessments, beneficial ownership and suspicious activity reporting.

The 40 Recommendations

The Recommendations are the international standard. The current version dates from 2012 and has been updated since. They are grouped into seven areas, running from national policy and co-ordination, through criminalising money laundering and terrorist financing, preventive measures for banks and other regulated sectors, transparency of companies and trusts, and the powers of authorities, to international co-operation. Most of the practical detail sits in the Interpretive Notes that accompany them. The Recommendations that matter most to firms are those on customer due diligence, record keeping, politically exposed persons, correspondent banking, suspicious transaction reporting and the regulation of non-financial businesses and professions such as accountants.

How countries are assessed

Every member is reviewed by experts from other countries in a mutual evaluation. It tests two things:

• Technical compliance with the 40 Recommendations, rated compliant, largely compliant, partially compliant or non-compliant.
• Effectiveness across 11 "Immediate Outcomes", rated high, substantial, moderate or low.

The current, fifth round of evaluations began in 2024 and runs on a six-year cycle. Countries that do poorly are placed under follow-up and an action plan, and persistent failure can lead to listing.

The two lists

High-risk jurisdictions subject to a call for action (the "black list") are countries with serious strategic deficiencies in countering money laundering, terrorist financing and proliferation financing. The FATF urges all jurisdictions to apply enhanced due diligence, and in the most serious cases calls for counter-measures. At the FATF's update on 19 June 2026, the list had three countries: North Korea, Iran and Myanmar.

Jurisdictions under increased monitoring (the "grey list") are countries that are actively working with the FATF to fix strategic deficiencies and have committed to resolving them within agreed timeframes. At the 19 June 2026 update, there were 22: Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Côte d'Ivoire, the Democratic Republic of Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the British Virgin Islands and Yemen.

Both lists are issued three times a year, after the plenary meetings in February, June and October. The lists above were current at the June 2026 update, so check the FATF website for any change following the October 2026 plenary before you rely on them.

What the lists mean for your firm

The lists have no direct legal effect. Their impact comes through national law. In the UK, since 30 June 2026, mandatory enhanced due diligence applies to countries on the call for action list, and grey-list countries remain a geographic risk factor you must weigh in your risk assessment. Our guide to enhanced due diligence for accountants explains how that works in practice. The EU uses its own list for mandatory enhanced due diligence, so a firm with EU clients must check the EU list as well as the FATF's.

Three practical steps follow. Build the lists into your firm-wide risk assessment as a geographic risk factor. Check client addresses, directors, beneficial owners and payment routes against the lists at onboarding and at periodic reviews. And diary a check after each plenary, since countries move on and off the grey list.

Frequently asked questions

Is the FATF a regulator?

No. It sets standards and assesses countries. Regulators in each country apply the standards through national law.

Does being on the grey list mean a country is sanctioned?

No. It means the country has acknowledged deficiencies that it is working to fix. Sanctions are imposed separately by governments.

Where can I learn more about financial crime compliance?

See Learnsignal's CPD courses for finance professionals.