AML High-Risk Countries: FATF Grey List, Jurisdiction Risks, and Compliance Best Practices (2026)

Anti-Money Laundering/Counter-Terrorism Financing (AML/CFT) laws exist to protect businesses and their customers, as well as to maintain the integrity of financial systems. Under these laws, regulated entities must identify, assess, and understand the money laundering risks to which they may be exposed, including geographical risks. However, the strength and effectiveness of these rules vary by jurisdiction, and some countries are considered to have weaker AML/CFT frameworks than others, as reflected in designations such as the FATF grey list.

The Financial Action Task Force (FATF) is a recognized international watchdog that combats financial crime in more than 200 countries. The FATF identifies countries with significant deficiencies in their Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) regimes by conducting evaluations. They regularly publish the results, affecting each country’s reputation in the global financial system. 

The FATF publicly identifies higher-risk jurisdictions through its “high-risk” and “increased monitoring” lists, which help inform global AML/CFT risk assessments. However, it does not issue an official list of low-risk countries. Yet, this helps companies determine how to best deal with clients from certain jurisdictions, if at all. 23 countries are currently identified as having significant AML/CFT deficiencies, with three being designated as “high-risk” while a further 20 are subject to increased monitoring recommendations, according to the latest FATF report.

Let’s dig into how countries are assessed as high risk, the risks for businesses, and what you can do to stay safe.

What are AML high-risk countries? 

High-risk AML countries are countries that are considered to pose a high risk for money laundering activity. Countries may be designated high risk where it is believed that there are “significant strategic deficiencies” in their approach to preventing money laundering, according to the Financial Action Task Force (FATF). 

High-risk countries may also have serious deficiencies in relation to countering the financing of terrorism and proliferation of Weapons of Mass Destruction (WMD).

There are various governmental and international schemes for assessing and publicizing countries’ risks of money laundering and other forms of financial crime. The FATF “grey list” and “black list” are widely recognized around the world, while jurisdictions such as the EU and UK all produce their own high-risk country ratings.

The term “high-risk third countries” is commonly used in regulatory contexts to indicate jurisdictions requiring enhanced due diligence by financial institutions.

High-risk AML countries: What are the real risks?

Businesses that engage with customers in high-risk countries are at increased risk of issues, including:

• Facilitating financial crime. Where a jurisdiction lacks a robust AML/CFT framework, there is a higher risk that customers or counterparties may be involved in money laundering, terrorist financing, or related financial crime. Weak regulatory oversight can also make it more challenging to conduct effective customer due diligence, including the reliable verification of identities, beneficial ownership, and sources of funds.
• Breaching international sanctions. If a country is subject to international sanctions, dealing with customers in that country could result in a company being found in breach of those sanctions.
• Reputational damage. Political issues can mean that simply doing business in high-risk countries can damage a company’s reputation. However, if it is found that a company has breached money laundering regulations, international sanctions, or other laws or restrictions, this could cause very serious reputational harm.

Correspondent banking AML risks

Even if a business does not directly engage with customers in high-risk countries, it could still be at risk if it works with correspondent banks with connections to such countries. 

It is common practice for banks that do not have a presence in a particular country to work with banks that do in order to facilitate transactions to or from that country. This is known as ‘correspondent banking’.

Correspondent banks may not have the same standard of AML controls as the financial institutions they are partnering with, so those partners could be at greater risk of connection to financial crime.

Financial institutions should carry out appropriate due diligence on any correspondent banks to identify any risks of financial crime. They should then put in place effective controls to manage any risks identified.

How regulators classify high-risk jurisdictions

Different regulators and international bodies have their own methods for classifying high-risk jurisdictions, although most follow the lead of the FATF. In this section, we look at how the FATF and some leading jurisdictions identify high-risk jurisdictions for AML purposes.

How the FATF high-risk countries classification works

The FATF looks at various factors when deciding whether to review a country’s AML/CTF risk. A review may be triggered if a country:

• Does not participate in a FATF-style regional body (FSRB)
• Is nominated for review by a FATF member
• Has achieved a poor result on a mutual evaluation (i.e., an in-depth analysis of its AML/CTF regime by another FATF member)
• Does not facilitate the prompt publishing of the results of a mutual evaluation

The FATF review process is an investigation into a regime’s technical compliance and effectiveness, as well as any progress being made. Where deficiencies are uncovered, FATF will attempt to work with the jurisdiction to resolve these issues. 

If the deficiencies are serious enough, the country may be placed on the FATF “grey list”, indicating that there are problems, but the jurisdiction is engaging with the FATF to sort them out. 

However, if a country fails to engage with the FATF to resolve any failings in its AML/CTF regime, then it could be placed on the FATF “black list”. This means the country is deemed to be especially high risk.

How the EU identifies high-risk AML countries

The EU has its own process for identifying high-risk countries in addition to those listed by FATF. This process is made up of the following four stages:

1. Priority setting. Countries that require assessment are identified and prioritized based on criteria such as their impact on the integrity of the EU financial system, the strength of their ties to the EU economy, and whether a country is recognized as an international offshore financial centre.
2. Assessing. The European Commission evaluates countries’ effectiveness in AML/CTF based on their legal framework and how this is applied across eight key areas. These areas include criminalization of money laundering, Customer Due Diligence requirements, and the powers and procedures of ‘competent authorities’. 
3. Listing. Any countries deemed to be high risk are then placed on the EU’s high-risk countries list.
4. Follow-up. Listed countries are then continuously monitored for signs of any changes that could alter their risk profile.

How the UK determines which countries are high-risk

The UK closely follows the FATF AML lists when publishing advice to its regulated sector on which high-risk countries require Enhanced Due Diligence. Regulated entities in the UK are obliged to carry out EDD on high-risk third countries under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the “MLRs”).

How the US designates high-risk AML jurisdictions

The US Financial Crimes Enforcement Network (FinCEN) also follows the FATF lists. It advises US financial institutions to “consider the FATF’s stance” when “reviewing their obligations and risk-based policies, procedures, and practices”. Regulated financial institutions in the US have strict compliance obligations around due diligence for foreign financial institutions, including taking an appropriate risk-based approach to detect and prevent money laundering.

FATF black list and grey list explained

The FATF is an international body that identifies countries with strategic AML/CFT shortcomings. It compiles multiple lists, such as the High-Risk Jurisdictions Subject to a Call for Action and Jurisdictions under Increased Monitoring, which are updated three times a year. 

The FATF divides countries with strategic shortcomings in their AML/CTF regimes into two lists: High-risk Jurisdictions Subject to a Call for Action (“black list”) and Jurisdictions Under Increased Monitoring (“grey list”).

The FATF “black list”: High-risk jurisdictions subject to a call for action

When dealing with countries on this list, the FATF calls on all members to apply EDD measures to protect the international financial system from ML/TF risks. 

The FATF “grey list”: Jurisdictions under increased monitoring

When the FATF places a jurisdiction under increased monitoring, it means the country has committed to resolving its strategic shortcomings within agreed timeframes and is subject to increased monitoring. The FATF welcomes the progress made by “grey list” countries in combating money laundering and doesn’t impose tough sanctions on them. However, these countries may still face economic sanctions from institutions like the International Monetary Fund (IMF) and the World Bank and experience adverse effects on trade. In any case, regulated financial institutions, such as banks, need to be closely monitored in such countries.

Suggested read: The 10 Most Common AML Red Flags to Watch Out for in 2025

How the FATF high-risk countries lists are updated

Countries are regularly added to the FATF grey list and, less frequently, the black list, while those that successfully address their shortcomings are removed. The FATF publishes updates on which countries are on its lists three times a year, in February, June, and October.

As covered above, countries will be added to these lists following a review, which can be triggered by issues such as a country not participating in a FATF-style regional body (FSRB), being nominated by a FATF member, doing poorly in a mutual evaluation by another FATF member, or not enabling the timely publication of the results of a mutual evaluation.

As part of the process of adding a country to the grey list, deadlines will be agreed upon for the relevant authorities to remedy any deficiencies in their regimes. If a country meets the agreed objectives by these deadlines, then it should be removed from the list. If it fails to meet those objectives, it could remain on the grey list or even be moved to the black list. 

If a country wishes to be removed from the FATF black list, it would have to commit to working with the FATF to address the flaws in its AML/CTF regime. 

FATF grey list vs black list: A side-by-side comparison

Suggested read: Understanding the FATF Black and Grey Lists in 2024

What are the high-risk jurisdictions in 2026?

The following countries are currently ‘blacklisted’ by the FATF:

• Democratic People’s Republic of Korea
• Iran
• Myanmar

The following countries are ‘grey listed’ by the FATF:

• Algeria
• Angola
• Bolivia
• British Virgin Islands
• Bulgaria
• Cameroon
• Côte d’Ivoire
• Democratic Republic of Congo
• Haiti
• Kenya
• Lao People’s Democratic Republic
• Lebanon
• Monaco
• Namibia
• Nepal
• South Sudan
• Syria
• Venezuela
• Vietnam
• Yemen

Burkina Faso, Mozambique, Nigeria, and South Africa have all recently been removed from the FATF grey list as they are considered to have made sufficient progress in addressing the deficiencies in their regimes.

All in all, high-risk country ratings help businesses determine risks associated with customers, corporate customers, and transactions. In turn, this helps businesses take necessary precautions.

How to identify exposure to high-risk jurisdictions

Businesses can identify their AML risk exposure to high-risk jurisdictions by following these steps:

• Staying up to date on the latest lists of high-risk countries: e.g., the FATF lists or regional and national lists.
• Carrying out a business-wide review: to pick up any potential points of interaction with high-risk countries.
• Taking a risk-based approach: evaluating each customer to create a unique risk profile, then carrying out appropriate AML checks based on their individual level of risk.
•  Performing Enhanced Due Diligence: on any customers in a high-risk jurisdiction or with potential links to one.
• Checking partner businesses for connections to high-risk countries: e.g., when working with correspondent banks to gain or provide access to a particular jurisdiction.

AML compliance requirements for businesses

Regulated financial institutions are legally required to follow international and local AML/CTF standards. This means obtaining the full range of required information and identifying all relevant risk factors before commencing a business relationship—and applying additional CDD measures if needed.

It’s necessary to apply Enhanced Due Diligence (EDD) measures in business relationships and transactions involving high-risk third countries for AML compliance purposes. 

Enhanced Due Diligence is an in-depth verification procedure for high-risk situations (i.e., dealing with customers from high-risk countries, PEPs, cross-border correspondent relationships with a third country, high transaction amounts, etc.). It requires additional checks, such as verification of sources of wealth and funds.

This requirement is common for all high-risk AML countries. However, the scope of the EDD measures necessary may vary.

When companies deal with customers from high-risk third countries, they should be aware that:

• High-risk countries may be subject to financial sanctions, which require companies to take additional measures
• Regulators worldwide require companies to apply EDD measures in any transaction or business relationship with a person established in a high-risk third country

However, this doesn’t mean that customers from high-risk countries are automatically involved in criminal activities; rather, they indicate higher risk factors that warrant closer attention.

Also, companies are required to assess risk factors related to suspicious customer interactions from high-risk countries by:

• Applying a risk-based approach to determine whether Enhanced Due Diligence is required
• Screening sanctions lists, global watchlists, Politically Exposed Persons (PEPs) lists, adverse media, and other similar sources

Suggested read: Understanding the UN Sanctions

How to stay updated on FATF lists

The FATF publishes the latest version of its grey and black AML lists three times a year, in February, June, and October. You can find the latest versions of the FATF high-risk countries lists on their publications page by checking the filter for ‘High-risk and other monitored jurisdictions’. 

Automating AML screening and monitoring

AML screening and monitoring are both key components of an effective AML framework and are absolutely essential for managing risk exposure from high-risk jurisdictions.

AML screening allows companies to verify customers’ identities and check them against global watchlists, including for international sanctions and Politically Exposed Persons (PEPs). This can help to identify any potential links to high-risk jurisdictions, as well as other AML risk factors.

Ongoing monitoring of customer transactions is also crucial for identifying signs of financial crime. This is particularly important when dealing with customers from high-risk countries where the likelihood of financial crime is higher, as well as for customers with potential links to such countries.

Risk management for FATF-listed countries

When dealing with FATF lists, the paramount controls are customer verification and transaction monitoring, which allow businesses to apply different risk-based approaches depending on the jurisdiction. These measures help mitigate corresponding risks by requesting additional documents where applicable and reviewing transactions more carefully.

Sumsub’s automated Know Your Customer (KYC) and Transaction Monitoring solutions support a risk-based AML framework by enabling enhanced due diligence for high-risk jurisdictions. They make compliance processes faster and more reliable while reducing manual workloads and operational costs. With the flexibility to meet regulatory requirements across jurisdictions worldwide, our tools help simplify compliance and ensure you stay aligned with the latest FATF and local regulatory expectations.

FAQ

• What are AML high-risk countries?

  AML high-risk countries are countries that pose an elevated risk for money laundering activity due to significant deficiencies in their AML/CTF regimes.

• What is the FATF grey list?

  The FATF grey list (countries under increased monitoring) is an internationally recognized list of countries that have serious deficiencies in their AML/CTF regimes but are working with the Financial Action Task Force (FATF) to rectify these shortcomings.

• What is the difference between the FATF grey list and black list?

  The FATF grey and black lists both set out countries with significant problems with their AML/CTF regimes. However, countries on the grey list are working with FATF to resolve these issues, while those on the black list are not cooperating with FATF.

• Why are some countries considered high risk for AML?

  Countries may be considered high risk for Anti-Money Laundering (AML) purposes where there are serious flaws in their approach to preventing money laundering and terrorist financing. This means that companies working with customers in those countries are themselves at higher risk of involvement in financial crime.

• What countries are black listed for money laundering?

  The FATF’s black list includes:

  • Democratic People’s Republic of Korea
  • Iran
  • Myanmar

• What countries are low risk for AML?

  Any country that doesn’t fall into the black list and grey list—for example, Germany and Canada. Yet, to be certain, it’s essential to conduct risk assessments.

• How can businesses comply with AML regulations in high-risk countries?

  Businesses must ensure they understand the AML regulatory requirements in their own country and any countries where they operate when dealing with high-risk jurisdictions. They should carry out Enhanced Due Diligence as required, including on any correspondent banks they work with that may be operating in high-risk countries.

• How often does the FATF update its high-risk list?

  FATF continuously reviews countries for inclusion in or removal from its high-risk lists, publishing updates three times a year, in February, June, and October. A country will be reviewed for inclusion if certain trigger events occur, such as a FATF member nominating the country for review. A country can be removed from the grey list if it successfully implements the FATF’s suggestions for improvement. A country could be moved from the black list to the grey list if it began to engage with the FATF to address concerns about its AML/CTF regime.

• What are high-risk industries in terms of AML?

  Based on the FATF's guidance, certain industries are considered higher risk for money laundering and terrorist financing. While the FATF does not provide an explicit list of 'high-risk industries', it does highlight sectors that require enhanced due diligence and monitoring. Here are some of the industries generally considered high-risk in AML compliance:

  • Banking and financial services
  • Casinos and gambling
  • Precious metals and stones dealers
  • Real estate
  • Virtual assets and cryptocurrencies
  • Money services businesses, including currency exchanges and money transfer services
  • Legal and accounting services
  • Art and antiquities dealers
  • Non-profit organizations
  • High-value goods dealers