FATF Grey List October 2026: Country Risk Steps for UAE

The FATF grey list October 2026 update is shorter than the last one, and it still changes work for UAE compliance teams. Four jurisdictions left the list, none were added, and the FATF put Vietnam on notice. This guide explains what changed on 30 October 2026, which UAE rules turn those changes into obligations, and how to update your country risk ratings, EDD triggers and enterprise-wide risk assessment before your supervisor asks.

Last updated: 1 November 2026. Reviewed against the FATF statements of 30 October 2026, Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.

Quick Answer

The FATF grey list October 2026 update removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco. No country was added, so 18 jurisdictions remain under increased monitoring. Iran, the DPRK and Myanmar stay on the black list. UAE firms must reflect these changes in country risk ratings under Cabinet Resolution No. 134 of 2025.

Key Takeaways

Four countries left the grey list. Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco completed their FATF action plans and are no longer under increased monitoring.
No country was added. The FATF grey list October 2026 edition holds 18 jurisdictions, down from 22, including Kuwait, Iraq, Lebanon, Kenya, Vietnam and the Virgin Islands (UK).
The black list is unchanged. The FATF repeats its call for countermeasures against the DPRK and Iran, and Myanmar stays on the call-for-action list.
Vietnam is on a final warning. The FATF voiced significant concern at its pace and expects tangible improvements by February 2027.
Delisting does not mean low risk. A country leaving the list is one input to your rating, not an instruction to downgrade every linked customer.
Article 23 is the legal hook. Cabinet Resolution No. 134 of 2025 requires proportionate enhanced due diligence for business with high-risk countries and countries with AML/CFT/CPF deficiencies.
Inspectors look for the paper trail. A dated change record showing when you updated the country list, who approved it and which customers you re-rated is the evidence that counts.

Definition: FATF grey list

The FATF grey list is the public list of “jurisdictions under increased monitoring”. These countries have strategic deficiencies in their regimes against money laundering, terrorist financing and proliferation financing, have committed to an action plan, and report progress to the FATF at each plenary. It is separate from the black list of high-risk jurisdictions subject to a call for action.

What Changed on the FATF Grey List October 2026?

The FATF published its updated lists from Paris on 30 October 2026. The headline is a net reduction of four. The FATF found that each delisted country met the commitments in its action plan, and each is now expected to keep its improvements going with its FATF-style regional body.

Which countries were removed?

Jurisdiction	Deficiencies first identified	What the FATF credited	Follows up with
Bulgaria	October 2023	National AML/CFT strategy, accurate beneficial ownership register, better STR prioritisation, TF and PF sanctions gaps closed	MONEYVAL
Côte d’Ivoire	October 2024	Risk-based supervision of FIs and DNFBPs, beneficial ownership access, better use of financial intelligence	GIABA
Democratic Republic of the Congo	October 2022	National risk assessment and AML/CFT strategy, supervisors designated for all DNFBP sectors, stronger FIU, TF and PF sanctions in practice	GABAC and ESAAMLG
Monaco	June 2024	Better understanding of foreign tax fraud risk, more asset recovery requests abroad, sanctions for beneficial ownership breaches, stronger STR quality	MONEYVAL

For UAE firms, Monaco and Bulgaria matter most in private wealth, real estate and corporate structuring files. Côte d’Ivoire and the DRC show up more often in trade finance, gold and commodity flows, so dealers in precious metals and stones (DPMS) and trading companies should check their books first.

Which countries remain under increased monitoring?

Eighteen jurisdictions remain on the FATF grey list October 2026 version:

Region	Jurisdictions still on the grey list
Middle East and North Africa	Iraq, Kuwait, Lebanon, Syria, Yemen
Sub-Saharan Africa	Angola, Cameroon, Kenya, South Sudan
Asia-Pacific	Lao PDR, Nepal, Papua New Guinea, Vietnam
Americas and Caribbean	Bolivia, Haiti, Venezuela, Virgin Islands (UK)
Europe	Bosnia and Herzegovina

Five of the 18 sit in the Middle East and North Africa, and several are close UAE trading partners. Kuwait made its political commitment in February 2026 and the FATF says it has moved ahead of schedule on outreach to real estate agents and DPMS. Iraq and Bosnia and Herzegovina joined in June 2026. Bosnia and Herzegovina, Haiti, Iraq and Yemen chose not to report this cycle, so their June 2026 statements still apply.

What did the FATF say about Vietnam, Cameroon and Haiti?

The FATF expressed “significant concern” at Vietnam’s pace. All of Vietnam’s action plan deadlines expired in May 2025, and the FATF expects tangible improvements by February 2027 or it will consider next steps. Cameroon and Haiti have also run past every deadline. Treat these three as the jurisdictions most likely to see tougher FATF language next year, and rate them accordingly now.

What happened to the black list?

The call-for-action list did not change. The FATF reiterated its call for countermeasures against the Democratic People’s Republic of Korea and Iran, citing heightened proliferation financing risk, and Myanmar remains listed. For the DPRK, the FATF repeats three specific countermeasures: terminate correspondent relationships with DPRK banks, close any DPRK bank subsidiaries or branches, and limit business relationships and financial transactions with DPRK persons. Iran reported to the FATF in September 2026, and the FATF found only limited progress.

You can read both statements on the FATF increased monitoring page and the FATF call for action page.

Why Does the FATF Grey List Matter Under UAE Law?

The FATF lists have no direct legal force in the UAE. They matter because UAE law tells you to take country risk into account, and the FATF lists are the main public evidence of that risk.

Four provisions of Cabinet Resolution No. 134 of 2025, the executive regulations to Federal Decree-Law No. 10 of 2025, do the work.

Article 5: geography is a required risk factor

Article 5(1)(a) requires financial institutions, DNFBPs and virtual asset service providers to consider all relevant risk factors before setting their overall risk level. Country and geographic risk is named alongside customer, product, service, transaction and delivery channel risk. Article 5(1)(b) requires you to document how you assess these risks, keep the assessment up to date and provide it to the authorities on request. The FATF grey list October 2026 outcome is exactly the kind of change that should prompt an update.

Article 23: enhanced due diligence for high-risk countries

Article 23 sits in its own division, titled High-Risk Countries. It has two parts:

Firms must apply enhanced customer due diligence, proportionate to the level of risk, to business relationships and transactions with natural or legal persons from countries the National Committee identifies as high-risk, or from countries with deficiencies in their AML, CFT and proliferation financing systems.
Firms must apply countermeasures and any other measures the supervisory authority requires, whether on its own initiative or as determined by the National Committee.

Note the word “proportionate”. The law does not demand identical EDD for every country on the grey list. It asks you to match the depth of EDD to the risk, and to be able to explain the match. Our enhanced due diligence guide sets out the full EDD toolkit.

Article 20: reliance on third parties

Article 20(1) lets you rely on a third party for customer due diligence, but only after taking into account the countries identified by the National Committee as high-risk and countries with AML/CFT/CPF deficiencies. If your introducer, group entity or outsourced KYC provider sits in a grey-listed country, your reliance assessment needs a fresh look. The third-party reliance guide covers the conditions in detail.

Article 49(16): your supervisor will pass on National Committee decisions

Article 49(16) makes supervisory authorities responsible for making sure firms are notified of, and comply with, National Committee decisions on EDD measures, countermeasures and concerns about other countries’ AML/CFT/CPF systems. In practice, the CBUAE, the Ministry of Economy and Tourism, the DFSA, the FSRA, VARA and the other supervisors circulate updated lists after FATF plenaries. Your own supervisor’s list is the one you will be tested against.

Need help mapping your country risk obligations? ADZ’s compliance advisory team builds and updates enterprise-wide risk assessments, country risk methodologies and EDD procedures for UAE financial institutions, DNFBPs and VASPs. Talk to ADZ’s AML advisory team.

Does Removal From the Grey List Mean Lower Risk?

No. Delisting tells you the FATF is satisfied that a country has fixed the strategic deficiencies in its action plan. It does not tell you anything about a specific customer, transaction or counterparty from that country.

The FATF says Bulgaria, Côte d’Ivoire, the DRC and Monaco should continue to work with their regional bodies to sustain their improvements. A country can come off the list and still carry high exposure to corruption, organised crime or sanctions evasion in your sector. Monaco, for example, is a wealth centre, and private banking and high-value real estate files linked to it will often stay high risk on product and customer factors alone.

What changes is one input. If your country risk model gave a jurisdiction extra points for FATF increased monitoring, remove those points, re-run the score, and record the result. If the overall rating falls, you may be able to step down from EDD to standard CDD for some customers, but only after a documented review of each affected relationship.

What the FATF itself says about EDD and de-risking

The FATF statement makes three points UAE firms should keep in mind:

The FATF does not call for enhanced due diligence on grey-listed jurisdictions. That call is reserved for the black list.
The FATF Standards do not envisage de-risking, or cutting off entire classes of customers. They call for a risk-based approach.
Flows for humanitarian assistance, legitimate NPO activity and remittances should be neither disrupted nor discouraged, with reference to UN Security Council Resolution 2761 (2024).

Read that alongside Article 23. UAE law still requires proportionate EDD for countries with AML/CFT/CPF deficiencies. A grey-listed country is strong evidence of deficiencies, so most UAE firms apply EDD triggers to it. The FATF’s point is that the EDD must be risk-based, not a blanket refusal.

How Should UAE Firms Rate Country Risk After the FATF Grey List October 2026 Update?

A defensible country risk rating combines several public sources and scores them the same way every time. The FATF lists are the anchor, not the whole model. The UAE National Risk Assessment adds the local view of which foreign threats matter most to the UAE.

A simple country risk scoring model

Factor	Source	Example scoring
FATF call for action	FATF black list	Automatic prohibited or highest risk, apply countermeasures
FATF increased monitoring	FATF grey list	+3 points
National Committee or supervisor list	Your supervisor’s circular	+3 points, or automatic high risk if the supervisor says so
UN and UAE targeted financial sanctions exposure	UN Consolidated List, UAE Local Terrorist List	+2 to +3 points
Mutual evaluation results	Latest FATF or regional body report	+1 to +2 points for low effectiveness ratings
Corruption and organised crime indicators	Public indices and your own NRA findings	+1 to +2 points
Secrecy and beneficial ownership transparency	Mutual evaluation, public indices	+1 to +2 points

Set your bands in the methodology, for example 0 to 2 low, 3 to 5 medium, 6 and above high. The numbers matter less than consistency. An inspector will pick two countries and ask you to show how each reached its rating.

A worked example: Monaco before and after

Take a UAE real estate brokerage with a buyer resident in Monaco. Before 30 October 2026, Monaco carried 3 points for increased monitoring plus 2 points for secrecy indicators, a total of 5 and a medium-high band. After delisting, the FATF points fall away and the country score drops to 2.

The customer is not automatically low risk. A cash-rich buyer purchasing a high-value villa through a company still scores high on customer and product factors. The brokerage records the country change, re-runs the customer score, and keeps EDD if the combined score still demands it. It also notes in the file why the decision was taken.

Kuwait and Iraq: grey-listed neighbours

Kuwait and Iraq are both grey-listed and both have heavy trade, remittance and family links with the UAE. A blanket EDD rule for every Kuwaiti national would be disproportionate and would go against the FATF’s warning on de-risking. A better approach applies EDD triggers to higher-risk relationships, such as complex corporate structures, cash-intensive businesses, PEPs and cross-border transfers above your internal threshold, while standard CDD covers ordinary salaried residents.

What Should You Update This Month?

Work through these steps in order. Most firms can complete them within two to three weeks of a plenary, and inspectors increasingly ask how quickly the update happened.

Update the country list. Remove Bulgaria, Côte d’Ivoire, the DRC and Monaco from the grey list column. Keep the 18 remaining jurisdictions and the three call-for-action countries. Record the source and the date of change.
Check your supervisor’s list. Compare your list against the latest circular from the CBUAE, the Ministry of Economy and Tourism, the DFSA, the FSRA or VARA. Where the supervisor’s list is stricter, it wins.
Re-score affected countries. Run each changed jurisdiction through your scoring model and record the old and new ratings.
Pull the exposure report. List every customer, beneficial owner, counterparty and transaction route linked to a changed country. Include nationality, residence, place of incorporation and payment corridor.
Re-rate the affected customers. Review each one. Downgrade only where the combined score supports it, and keep EDD where customer or product risk still calls for it.
Recalibrate screening and monitoring. Update the jurisdiction tables in your screening and transaction monitoring rules so alerts follow the new list.
Review third-party reliance. Re-check any introducer, group entity or KYC provider in a listed country under Article 20.
Update the EWRA and policy. Note the change in the enterprise-wide risk assessment and, where needed, in the AML policy annex that lists high-risk countries.
Brief senior management. Record the update, the exposure numbers and any decisions in the compliance officer’s periodic report under Article 22(3).

Our AML business risk assessment guide shows how to fold country changes into the EWRA, and the AML compliance report guide covers the senior management record.

Keep your country lists current without spreadsheets. First Compliance screens customers against 1,800+ sanction lists and 5.5M+ PEP records, supports customer risk scoring and connects to goAML reporting. See how First Compliance works.

How Do the Grey List and Black List Affect goAML Reporting?

A country listing is not, by itself, a reason to file a suspicious transaction report. Suspicion must come from the facts of the case. Two reporting points still follow from the lists.

High Risk Country reports. Where your supervisor directs it, transactions and activity linked to jurisdictions the UAE treats as high risk are reported through goAML as HRC (transaction) or HRCA (activity) reports. The FATF call-for-action list is the usual starting point. Our goAML report types guide explains when each applies.
Suspicion still drives STRs. If a transaction linked to any country is suspicious, file an STR. Failing to report a suspicious transaction can lead to a fine of up to AED 5,000,000 under Federal Decree-Law No. 10 of 2025.

Proliferation financing deserves extra attention for DPRK and Iran exposure. Front companies, shell companies and complex ownership structures are the FATF’s named methods for DPRK sanctions evasion. Check these against your targeted financial sanctions controls as well as your country list.

What Do UAE Inspectors Expect to See?

Supervisors test country risk in three ways. They check that your list is current, that it matches the supervisor’s own list, and that the change actually reached the customer file.

Inspector question	Evidence that answers it
When did you update the high-risk country list after the October 2026 plenary?	Dated version history of the country list with approver name
How did you rate Monaco before and after?	Scoring sheet showing factors, points and band for both dates
Which customers were affected and what happened to them?	Exposure report and re-rating log with reasons for each decision
Did your screening tool pick up the change?	Screening configuration record or vendor release note with date
Did senior management know?	Compliance officer report and minutes recording management’s decisions

In June 2026 the CBUAE fined a foreign bank branch AED 20 million for AML and sanctions failures, and fined its head of compliance AED 300,000 personally.

Fines on legal persons convicted of money laundering range from AED 5 million to AED 100 million under Federal Decree-Law No. 10 of 2025. An examiner who finds a country list two plenaries out of date will usually write it up as a finding.

The UAE’s own FATF mutual evaluation is under way in 2026 under the fifth-round methodology, which weighs effectiveness and real outcomes. Assessors look at whether the private sector applies country risk in practice, so a clean, dated country risk process helps the national result as well as your own file. The FATF mutual evaluation guide covers what assessors test.

Which UAE Sectors Feel the October 2026 Changes Most?

Every regulated firm needs to update its list, but exposure differs by sector.

Exchange houses and payment service providers. Remittance corridors to Kenya, Nepal, Vietnam, Lebanon and Iraq remain grey-listed. Keep EDD triggers on high-value and unusual transfers, and avoid blanket corridor closures that cut off legitimate remittances.
DPMS and gold traders. The removal of the DRC and Côte d’Ivoire touches gold and commodity supply chains, but responsible sourcing and supply chain due diligence obligations still apply in full.
Real estate brokers and developers. Buyers from Monaco and Bulgaria may move to a lower country score, while buyers from Lebanon, Kuwait and Iraq stay under increased monitoring.
Corporate service providers and family offices. Check structures that use Virgin Islands (UK) entities, which remain grey-listed. The FATF’s open action items there include supervision of trust and company service providers and sanctions for beneficial ownership breaches.
VASPs. The FATF lists regulation of virtual assets and VASPs as an open item for Vietnam. Treat wallet and exchange flows linked to that jurisdiction with care.

Train your team on the new lists. Compliance 360 offers 32 KHDA-approved AML/CFT courses, including risk assessment and EDD modules for front-line and compliance staff. Explore Compliance 360 training.

Frequently Asked Questions

Which countries were removed in the FATF grey list October 2026 update?

Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco were removed on 30 October 2026 after completing their FATF action plans. No jurisdiction was added, so the grey list fell from 22 to 18 countries.

Is the UAE on the FATF grey list in 2026?

No. The UAE left the grey list in February 2024 and does not appear on the October 2026 list. Its fifth-round FATF mutual evaluation is under way in 2026, and the UAE holds the MENAFATF presidency this year.

Do UAE firms have to apply EDD to grey-listed countries?

Article 23 of Cabinet Resolution No. 134 of 2025 requires enhanced due diligence, proportionate to risk, for business with countries identified by the National Committee as high-risk or with AML/CFT/CPF deficiencies. Grey-listed countries usually meet that test, but EDD must be risk-based rather than blanket.

Can we downgrade customers from Monaco or Bulgaria now?

Only after a documented review. Delisting removes one country risk factor. Re-run the customer’s full risk score, including customer, product and channel factors, and record the reason for any change in the file before stepping down from EDD.

Which countries are on the FATF black list in October 2026?

The DPRK, Iran and Myanmar remain high-risk jurisdictions subject to a call for action. The FATF calls for countermeasures against the DPRK and Iran because of heightened proliferation financing risk.

How quickly should a UAE firm update its country list after a FATF plenary?

No fixed deadline appears in the regulations, but Article 5 requires risk assessments to be kept up to date. Most supervisors expect the change within weeks, documented with a date, an approver and a record of affected customers.

When is the next FATF plenary?

The next plenary is due in February 2027. The FATF has said it expects tangible improvements from Vietnam by then, so watch that statement and update your list again once it is published.