FATF Grey List and Black List: What UK Firms Need to Know
In brief: The FATF grey list and black list are country-risk signals that should feed into a firm's AML risk assessment, but they do not replace UK sanctions checks, CDD, EDD, or case-by-case judgement.
Key points
- FATF calls the grey list jurisdictions under increased monitoring.
- FATF calls the black list high-risk jurisdictions subject to a call for action.
- UK firms should use FATF country risk as one input in their risk assessment, not as an automatic decision rule.
What are the FATF grey list and black list?
The FATF grey list is the common name for jurisdictions under increased monitoring. The FATF black list is the common name for high-risk jurisdictions subject to a call for action. For UK accountants and law firms, these lists are country-risk signals that should feed into client risk assessment, CDD, EDD, and ongoing monitoring.
FATF itself publishes the current high-risk and increased-monitoring jurisdictions on its official site: FATF high-risk jurisdictions and jurisdictions under increased monitoring.
Why it matters for UK professional firms
A country appearing on a FATF list can affect the risk profile of a client, beneficial owner, source of funds, source of wealth, counterparty, branch, supplier, or transaction. It does not automatically mean a client is suspicious. It does mean the firm should ask better questions and document the decision.
In practice, a FATF risk signal may lead to:
- Enhanced due diligence.
- Senior management approval for a higher-risk relationship.
- Stronger source-of-funds or source-of-wealth evidence.
- More frequent client reviews.
- Closer screening of connected parties.
- A decision to pause, decline, or exit where the risk cannot be understood.
FATF list vs UK sanctions list
FATF country risk and UK sanctions are not the same thing.
| Check | What it tells you |
|---|---|
| FATF grey or black list | Whether a jurisdiction has strategic AML/CFT deficiencies or is under monitoring. |
| UK sanctions list | Whether a person, entity, ship, or regime is subject to UK financial sanctions. |
| Firm risk assessment | How the country risk affects this specific client, matter, funds, and service. |
The UK financial sanctions regime is managed through the Office of Financial Sanctions Implementation. Firms should use official sources such as the UK sanctions list and OFSI consolidated list.
How to use FATF country risk in a client file
Do not write "FATF country = high risk" and stop there. Record the practical link to the client or matter:
- Which country is involved?
- Is it the client residence, incorporation country, trading location, source of funds, source of wealth, or counterparty location?
- What service is the firm providing?
- Does the risk affect beneficial ownership, control, funds, or sanctions exposure?
- What extra evidence or approval is needed?
- What review date or trigger should be set?
Example
A UK accountancy practice onboards a company with a UK registered office, but the ultimate beneficial owner lives in a jurisdiction under increased monitoring. The company trades internationally and receives funds from multiple countries.
A good file would not simply reject the client. It would document beneficial ownership, business activity, source of funds, source of wealth where needed, screening results, risk rating, approval, and review frequency.
Common mistakes
- Treating FATF lists as sanctions lists.
- Using old country-risk data without checking current FATF updates.
- Applying blanket decisions without recording the client-specific rationale.
- Ignoring country risk because the company itself is UK registered.
- Forgetting to reassess risk when ownership or funds change.
Official references
- FATF high-risk and monitored jurisdictions
- UK sanctions list
- OFSI consolidated financial sanctions list
This guide is general information for regulated firms and is not legal advice.