A country on the FATF grey list is hard to ignore, because the label travels quickly, appears in correspondent banking questionnaires and shapes how counterparties and payment corridors are viewed. Yet a country label tells a bank very little about the customers, ownership structures, products and payment routes that actually drive its exposure.
The FATF reviews its list three times a year. Its statement of 30 October 2026, issued at the close of its Paris plenary, removed four jurisdictions and left 18 on the list. Four of those 18 are in Africa: Angola, Cameroon, Kenya and South Sudan. Their action plans are not the same, and this article explains what the designation means, what it does not, and how an institution can turn country-level signals into decisions about its own customers and corridors.
What the grey list means, and what it does not
The FATF describes jurisdictions under increased monitoring as countries that have committed to resolve identified strategic deficiencies in their anti-money laundering and counter-terrorist financing regimes within agreed timeframes. The list is often called the "grey list", but it is a statement about a country's regime, not a verdict on any customer in that country.
The FATF is explicit about what the designation does not require. It does not call for enhanced due diligence measures to be applied to these jurisdictions, and the FATF Standards do not envisage de-risking or cutting off entire classes of customers, calling instead for a risk-based approach. Countries should also ensure that flows of funds for humanitarian assistance, legitimate non-profit activity and remittances are neither disrupted nor discouraged.
Those points are easy to lose in practice, and a bank that applies blanket enhanced checks to every customer from a listed country, or exits a category of business because of a country label, is not following the FATF's own guidance and is probably looking at the wrong risk.
Four African jurisdictions, four different action plans
Being on the list tells you that a country has strategic gaps, but not which gaps, or how far along the country is in closing them. The FATF statement shows how different the work is.
- Angola is addressing its remaining deficiencies in risk-based supervision of non-financial banking entities and DNFBPs. It also needs competent authorities to have adequate, accurate and timely access to beneficial ownership information.
- Cameroon still needs to enhance risk-based supervision of banks, implement effective supervision of non-bank financial institutions and DNFBPs, and put in place policies for seizing and confiscating the proceeds of crime. The FATF notes that all of its deadlines have now expired.
- Kenya is improving risk-based supervision of financial institutions and DNFBPs, and has taken steps including designating an authority for the regulation of trusts. Its remaining work includes remedial action for breaches of transparency requirements for legal persons and arrangements, and more money laundering investigations and prosecutions in line with risks.
- South Sudan needs a comprehensive legal framework to collect and verify beneficial ownership information for legal persons, and a fully functioning and independent financial intelligence unit. The FATF notes limited progress, with all of its deadlines now expired.
A bank that treats these four as one risk will get both its decisions and its evidence wrong. A gap in beneficial ownership transparency calls for different controls from a gap in supervision, and a country whose deadlines have expired is in a different position from one that is still moving through its plan.
The picture also changes, with Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco were removed from the list on 30 October 2026 after successful on-site visits, and Algeria and Namibia, which were on the list in February 2026, are no longer listed. Any analysis should be checked against the latest FATF statement on the day it is used.
From country signal to institutional risk
The useful question is not "Is this country on the list?" but "What does this country's position tell us about our own customers, products, corridors and counterparties, and what are we already doing about it?" The answer comes from the institution's own risk assessment, and in our view four steps make that practical.
- Build the risk picture from your own data. Look at customer types and beneficial ownership, products, geographies, payment corridors, counterparties and sector exposure.
- Find where country weaknesses meet your exposure. A beneficial ownership gap matters most where your customers hold complex structures and your payments pass through them.
- Choose proportionate controls. Set onboarding standards, enhanced checks where the risk justifies them, monitoring scenarios, sanctions controls and escalation thresholds.
- Record the decision and the evidence. Note the risks accepted, the reasons for accepting them, and who accepted them.
Measure effectiveness, not activity
A monitoring system can be busy and still weak, because alert volumes say little about whether the institution is finding the right things. Boards should look instead at:
- how many alerts lead to a meaningful outcome (alert precision)
- whether each risk in the institution's assessment has monitoring behind it (typology coverage)
- the outcomes of investigations and the quality of suspicious transaction reports
- exceptions and backlogs
- how many legitimate customers are delayed or excluded by controls
The last point deserves attention. The FATF asks countries to ensure that humanitarian, non-profit and remittance flows are neither disrupted nor discouraged, and friction on those flows is a risk in its own right that should be measured alongside detection.
A worked example
Consider a hypothetical trade-finance corridor. A bank finances imports of electronic goods from a supplier in Asia to a distributor in an African market, with payments routed through a correspondent bank in Europe. The corridor is not illegitimate, but the bank's risk assessment has identified three features: the distributor's ownership is complex, invoice values vary widely between shipments, and several counterparties are new.
A proportionate response is not to exit the corridor. Instead, the bank might verify the distributor's ownership and source of funds at onboarding, set a monitoring scenario that compares invoice values with a benchmark for the goods, require a documented review whenever counterparties change, and test the scenarios after three months against the alerts that followed. For each control, it records why the control was chosen, what it expects to find and what it will do if the control is not working. This example does not describe any real customer.
Questions for the board
- Which material corridors and customer groups are linked to a jurisdiction on the FATF list, and do we know why?
- Do we understand the beneficial ownership of our highest-risk customers, and how do we know?
- Which controls have we changed because of a country label, and what evidence supports each change?
- Are our controls reducing risk, or only reducing activity?
- Are legitimate customers, including remittance and non-profit flows, being delayed or excluded, and do we report on it?
A 90-day action plan
For most institutions with African exposure, the next quarter should cover four things: refreshing the risk assessment for African corridors and customer groups, checking the data that feeds monitoring and screening, testing monitoring scenarios against recent alerts and cases, and reporting the results to the board with the decisions that follow.
The grey list is a useful prompt, but it should not be the answer. Institutions that understand their own customers, ownership structures and payment corridors are better placed to manage risk, and to show boards and supervisors that their controls address it. Kompass draws on experience across the GCC, Europe and Africa to help institutions do exactly that.