The FATF grey list October 2026 update is shorter than usual. At its meeting in Paris, which ended on 30 October, the Financial Action Task Force (FATF) took four countries off its grey list and added none. Its black list of the highest-risk countries stayed the same.

If you run a small firm with anti-money laundering (AML) obligations, you probably don’t need to overhaul anything. You do need to know whether any of your clients are linked to the countries that changed, and to keep a short record of what you checked. This guide explains the changes in plain English and gives you a checklist you can work through in an afternoon.

What Changed at the October 2026 FATF Meeting

The FATF publishes two lists after each of its three yearly meetings. Here is what moved on 30 October 2026:

  • Removed from the grey list: Bulgaria, Côte d’Ivoire (Ivory Coast), the Democratic Republic of the Congo and Monaco. Each completed an agreed action plan, and FATF assessors checked the progress on site.
  • Still on the grey list (18 countries): Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK) and Yemen.
  • Black list unchanged: North Korea (DPRK), Iran and Myanmar.
  • One warning: the FATF said it will consider next steps if Vietnam does not make real progress by its next meeting in February 2027.

Our June 2026 plenary summary covers the previous changes, when Iraq and Bosnia and Herzegovina were added.

What the Grey List and Black List Mean for Your Client Checks

The two lists are often mixed up, and the difference matters for what you do next.

Table explaining the FATF grey and black lists. Grey list (jurisdictions under increased monitoring): the country has gaps in its AML controls and has agreed a plan with the FATF to fix them; for you, a link to the country is a risk factor to consider, not a ban, and does not prove anything about your client. Black list (high-risk jurisdictions subject to a call for action): serious gaps, with the FATF calling on countries to apply enhanced due diligence and, for Iran and North Korea, countermeasures; for you, expect to apply enhanced checks and escalate, and some dealings may also be restricted by sanctions.

In Australia, lawyers, accountants, real estate professionals, and other Tranche 2 businesses became regulated under the AML/CTF Act during 2026, and must now consider country risk as part of customer due diligence. A client linked to a black-listed country is a trigger for enhanced customer due diligence under the Act. Grey-list status feeds into your own risk assessment. If you are unsure how this applies to the services you provide, check AUSTRAC’s guidance for your sector.

Coming off the grey list is good news for a country, but it is not a reason to clear a client’s risk rating overnight. You still look at the client as a whole.

A Five-Step Checklist for This Week

  1. Note the date. Record that you reviewed the FATF grey list October 2026 update and the black list, both dated 30 October 2026. A line in your compliance register is enough.
  2. Find any linked clients. Look for clients, and for company clients their beneficial owners (the people who ultimately own or control them), with a connection to the four removed countries, Vietnam or the three black-listed countries. Connections include where they live, where a company is registered and where money is coming from or going to.
  3. Review, don’t bulk-change. For clients linked to Bulgaria, Côte d’Ivoire, the DRC or Monaco, review their risk rating in line with your own AML/CTF program. Some may go down. Others may stay the same because of other risk factors.
  4. Escalate black-list links. If a client is linked to North Korea, Iran or Myanmar, apply enhanced checks, run up-to-date sanctions screening and get sign-off from whoever is responsible for AML in your firm before you proceed.
  5. Write down what you did. Keep a short note of who you reviewed, what you found and what you decided. If AUSTRAC or an auditor asks, this note is your evidence.

When a Simple Check Is Not Enough

A name screen tells you whether a person or company matches a sanctions, PEP (politically exposed person) or adverse media record. It does not tell you whether a transaction makes sense, where the money came from, or whether a complex ownership structure is hiding someone. If a client has links to a black-listed country, uses layered companies across several grey-listed countries, or can’t explain their source of funds, you need more than a quick check. Talk to your AML compliance officer or an adviser before going ahead.

How NameScan Can Help

NameScan lets you run PEP, sanctions and adverse media checks on individuals and companies on a pay-as-you-go basis, and download a report of each check for your records. That covers the screening part of steps 2 and 4 above. Your firm’s AML/CTF program still decides how country risk is scored and when enhanced due diligence applies.

To re-check clients linked to the countries above, start screening with NameScan. For more on what suspicious activity looks like in practice, read our guide to AML red flags.

Frequently Asked Questions

Which countries were removed from the FATF grey list in October 2026?

Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco. No countries were added, so 18 remain on the grey list.

Can I still work with a client from a grey-listed country?

Yes. The grey list is not a ban. It means you should treat the country link as a risk factor and decide, under your AML/CTF program, whether extra checks are needed for that client.

Do I need to re-check every client after each FATF meeting?

Usually not. For the FATF grey list October 2026 update, focus on clients linked to countries that were added, removed or warned. Ongoing screening of existing clients is a separate obligation your program should already cover.

Is Myanmar treated the same as Iran and North Korea?

Not quite. For Myanmar, the FATF calls for enhanced due diligence. For Iran and North Korea, it calls for countermeasures, which are stricter. The FATF said it may consider countermeasures for Myanmar if there is no progress by February 2027.

How often does the FATF update its lists?

Three times a year, after its meetings in February, June, and October. The next update is due in February 2027.