FATF Grey List and Black List: What UK Firms Need to Know
In brief: The FATF grey list and black list are country-risk signals that should feed into a firm's AML risk assessment, but they do not replace UK sanctions checks, CDD, EDD, or case-by-case judgement.
Key points
- FATF calls the grey list jurisdictions under increased monitoring.
- FATF calls the black list high-risk jurisdictions subject to a call for action.
- UK firms should use FATF country risk as one input in their risk assessment, not as an automatic decision rule.
What are the FATF grey list and black list?
The FATF grey list is the common name for jurisdictions under increased monitoring. The FATF black list is the common name for high-risk jurisdictions subject to a call for action. For UK accountants and law firms, these lists are country-risk signals that should feed into client risk assessment, CDD, EDD, and ongoing monitoring.
FATF itself publishes the current high-risk and increased-monitoring jurisdictions on its official site: FATF high-risk jurisdictions and jurisdictions under increased monitoring.
Why it matters for UK professional firms
A country appearing on a FATF list can affect the risk profile of a client, beneficial owner, source of funds, source of wealth, counterparty, branch, supplier, or transaction. It does not automatically mean a client is suspicious. It does mean the firm should ask better questions and document the decision.
In practice, a FATF risk signal may lead to:
- Enhanced due diligence.
- Senior management approval for a higher-risk relationship.
- Stronger source-of-funds or source-of-wealth evidence.
- More frequent client reviews.
- Closer screening of connected parties.
- A decision to pause, decline, or exit where the risk cannot be understood.
FATF list vs UK sanctions list
FATF country risk and UK sanctions are not the same thing.
| Check | What it tells you |
|---|---|
| FATF grey or black list | Whether a jurisdiction has strategic AML/CFT deficiencies or is under monitoring. |
| UK sanctions list | Whether a person, entity, ship, or regime is subject to UK financial sanctions. |
| Firm risk assessment | How the country risk affects this specific client, matter, funds, and service. |
The UK financial sanctions regime is managed through the Office of Financial Sanctions Implementation. Firms should use official sources such as the UK sanctions list and OFSI consolidated list.
How to use FATF country risk in a client file
Do not write "FATF country = high risk" and stop there. Record the practical link to the client or matter:
- Which country is involved?
- Is it the client residence, incorporation country, trading location, source of funds, source of wealth, or counterparty location?
- What service is the firm providing?
- Does the risk affect beneficial ownership, control, funds, or sanctions exposure?
- What extra evidence or approval is needed?
- What review date or trigger should be set?
Example
A UK accountancy practice onboards a company with a UK registered office, but the ultimate beneficial owner lives in a jurisdiction under increased monitoring. The company trades internationally and receives funds from multiple countries.
A good file would not simply reject the client. It would document beneficial ownership, business activity, source of funds, source of wealth where needed, screening results, risk rating, approval, and review frequency.
Common mistakes
- Treating FATF lists as sanctions lists.
- Using old country-risk data without checking current FATF updates.
- Applying blanket decisions without recording the client-specific rationale.
- Ignoring country risk because the company itself is UK registered.
- Forgetting to reassess risk when ownership or funds change.
Official references
- FATF high-risk and monitored jurisdictions
- UK sanctions list
- OFSI consolidated financial sanctions list
This guide is general information for regulated firms and is not legal advice.
Common questions
What is the difference between the FATF grey list and the black list?
The grey list is the informal name for jurisdictions under increased monitoring: countries that have committed to an action plan to fix identified deficiencies. The black list is the informal name for high-risk jurisdictions subject to a call for action, where FATF asks members to apply countermeasures. Grey-list countries call for enhanced scrutiny proportionate to risk; black-list countries call for the strongest response.
Does a client in a grey-list country automatically require EDD?
Not automatically. MLR 2017 Regulation 33 requires enhanced due diligence for business relationships with a high-risk third country as designated in UK law, and the UK list is not identical to the FATF grey list. Grey-list status is a risk factor to weigh alongside the client, product, and transaction, not a standalone trigger. The safest position is to document the decision either way.
Is the UK high-risk third country list the same as the FATF lists?
No, though they overlap heavily. The UK maintains its own list of high-risk third countries in schedule 3ZA to MLR 2017, and it is the UK list that carries the legal EDD obligation. FATF designations often precede changes to the UK list, so a firm should check the UK list for the obligation and the FATF statements for the risk picture.
How often does the FATF grey list change?
FATF reviews and publishes updated statements after each of its three plenary meetings a year, usually in February, June, and October. Countries are added and removed at those points, so a country-risk assessment that is more than a few months old may be out of date. Recording the date a list was checked is what evidences the assessment was current when the decision was made.