On October 30, 2026, the Financial Action Task Force closed its plenary by publishing its updated position on jurisdictions whose AML/CFT/CPF regimes carry strategic deficiencies. Four jurisdictions came off the list of Jurisdictions under Increased Monitoring, and the highest-risk list did not change at all. FinCEN published its own release the same day to make sure U.S. financial institutions saw the update, which is a useful signal in itself: jurisdictional risk is treated as an input into a program, not as background news.

The short answer for a compliance team is that this update creates work, but not a new obligation. No U.S. statute changed on October 30. What changed is the factual basis your geographic risk assessment was built on, which means the ratings, the rationale behind them, and the training your staff received all have a reason to be revisited. The rest of this article works through what was announced, how to read it, and what a defensible response looks like for a small or mid-sized institution.

What the FATF Does, and Why FinCEN Amplifies It

The FATF is an intergovernmental body that sets the international standards on anti-money laundering, countering the financing of terrorism, and countering proliferation financing. It does not regulate U.S. businesses and it does not issue enforcement actions. Its leverage comes from mutual evaluations, from the two jurisdiction lists it publishes after each plenary, and from the fact that financial institutions worldwide use those lists as a shared reference point for country risk.

FinCEN's role is different. When the FATF publishes an update, FinCEN typically issues a parallel communication reminding U.S. financial institutions of the risk factors involved, and its advisories are the kind of guidance examiners expect a program to have considered. That is why the announcement matters even when nothing in the underlying regulations moves: an institution that can show it reviewed the update, assessed its own exposure, and documented a conclusion is in a different position from one that cannot.

One distinction is worth holding on to for the whole article. There are four separate things that get blurred together in coverage of these updates: the FATF recommendation, the FinCEN communication, OFAC sanctions, and the enforceable requirements of your own AML program. They interact, but they are not interchangeable, and a program that treats them as one thing usually over-controls in some places and under-controls in others.

Four Jurisdictions Removed from Increased Monitoring

The October 30, 2026 update removed four jurisdictions from the list formally titled Jurisdictions under Increased Monitoring, which is what most of the industry calls the grey list:

• Bulgaria
• Côte d'Ivoire
• Democratic Republic of the Congo
• Monaco

Removal means the FATF concluded that the jurisdiction had substantially completed the action plan it agreed to, typically after an on-site visit and a review of the reforms it made. It is a meaningful signal about the maturity of a country's legal framework, its supervision, and its ability to cooperate internationally. It is also a narrow signal, and that is the part people misread.

What removal does not mean

Removal is not a risk rating for your institution. It says nothing about whether a specific customer, a specific wire, or a specific beneficial owner presents elevated risk. Four things keep their relevance after a country leaves the list.

Sanctions exposure is untouched. OFAC designations are made on entirely different grounds and do not track FATF list membership in either direction. A jurisdiction can leave the grey list and still be the location of a designated entity, a blocked person, or a sector under restrictions.

Corruption and fraud do not follow the list. A country can improve its AML framework and still have property fraud, trade-based value transfer, or a financial sector that is used as an intermediate stop. Typology risk is a separate axis from regime risk.

Supervisory practice lags legal reform. Passing a law and supervising to it are different achievements, and the FATF's own follow-up process keeps monitoring a jurisdiction after it exits the list. Your institution may reasonably still want additional scrutiny on high-value relationships in a recently removed jurisdiction for a period of time.

The list moves in both directions. Jurisdictions have been added back after removal. A rating built to change on every plenary is more useful than a binary "grey list or not" flag, because it survives the next update.

Why reassessing beats reclassifying

The lazy response to a removal is to drop the country a tier and move on. The better response is to reopen the geographic section of the risk assessment, record what the rating was, record what the FATF said, record what your own data says about the jurisdiction, and then set the rating with a written reason. If the rating stays the same, that decision should carry a rationale too, because "we left it at medium high because of the correspondent exposure we still have" is a defensible answer and a blank cell is not.

The same logic runs in reverse for a small number of institutions that had never rated these countries at all. If any of the four jurisdictions appear in your customer base, your payment corridors, your vendor list, or the ownership chain of a business customer, that exposure existed before October 30 and still needs a rating, regardless of what the list says today.

The High-Risk List Did Not Change

The FATF statement on High-Risk Jurisdictions subject to a Call for Action, often called the black list, is unchanged. That continuity matters more than the removals, because this is the list where the FATF asks jurisdictions to take action against other countries rather than to look more closely at them.

Iran: a continued call for countermeasures

Iran remains subject to a call for effective countermeasures, and the FATF continues to list four specific measures for members and other jurisdictions to apply:

1. Refuse the establishment of subsidiaries, branches or representative offices of financial institutions and virtual asset service providers from Iran, or otherwise take into account that the institution comes from a country without adequate AML/CFT systems.
2. Prohibit financial institutions and virtual asset service providers from establishing branches or representative offices in Iran, or otherwise take into account that the branch would be located in a country without adequate AML/CFT systems.
3. On a risk basis, limit business relationships or financial transactions, including virtual asset transactions, with Iran or with persons in Iran.
4. Prohibit new correspondent relationships with financial institutions and virtual asset service providers in Iran, and require a risk-based review of existing correspondent relationships.

The FATF also notes that Iran has not completed the majority of the action plan it committed to, and that the reservations Iran has made to the Palermo and Terrorist Financing Conventions are assessed as overly broad. The statement includes an expectation that flows for humanitarian assistance, food and health supplies, diplomatic operating costs and personal remittances are handled on a risk basis rather than cut off indiscriminately.

Democratic People's Republic of Korea: countermeasures, plus targeted financial sanctions

The DPRK remains subject to a call for countermeasures, framed around proliferation financing risk and the illicit activities the FATF has cited for more than a decade. The countermeasures the FATF calls for are specific: terminate correspondent relationships with DPRK banks, close any subsidiaries or branches of DPRK banks located in the jurisdiction, and limit business relationships and financial transactions with DPRK persons. The FATF also calls for robust implementation of targeted financial sanctions consistent with UN Security Council resolutions, and warns that front companies, shell companies, joint ventures and opaque ownership structures are used to work around controls.

Burma: enhanced due diligence, not countermeasures

Burma, referred to by the FATF as Myanmar, sits in a different category. The FATF calls for enhanced due diligence measures proportionate to the risks arising from the jurisdiction, and explicitly not countermeasures. In practical terms that means increasing the degree and nature of monitoring of the business relationship to determine whether activity appears unusual or suspicious, rather than applying the structural restrictions described above. The FATF has also signaled that countermeasures could be considered if progress on the action plan stalls, and it has asked jurisdictions to avoid disrupting humanitarian flows and legitimate non-profit activity.

Enhanced due diligence and countermeasures are not the same thing

The distinction is often collapsed in summaries, and it matters operationally. Enhanced due diligence is an intensity setting inside your existing program. You ask more questions, verify more, monitor more closely, escalate sooner, and approve at a higher level. Countermeasures are structural. They restrict what kinds of relationships may exist at all: no new correspondent relationships, no subsidiaries, no branches. A program that responds to the Iran call by simply marking the customer high risk and applying EDD has not applied countermeasures, and an examiner reading the file can tell the difference.

Both sit on top of a third layer that has nothing to do with the FATF. U.S. persons are already subject to separate OFAC sanctions requirements, and for Iran and the DPRK those restrictions are considerably broader than the FATF call. Complying with OFAC screening and escalation is not optional risk management. It is a legal requirement with its own evidentiary expectations. Our existing analysis of the intersection of OFAC sanctions and AML obligations is a reasonable primer if your team needs the boundary explained in plain language.

What This Means for U.S. Financial Institutions and Other Covered Businesses

The effect of a list update is never uniform, because jurisdictional exposure is not uniform. What follows is how the change tends to land in the sectors most represented among U.S. businesses with AML program obligations. None of these are new legal duties created by the FATF. They are the parts of an existing program that the update gives you a reason to look at again.

Banks and credit unions

Depository institutions carry the broadest exposure because correspondent banking, trade finance and the payment corridors that pass through intermediaries are where high-risk jurisdictions actually show up. The items to revisit are the country risk ratings for the four removed jurisdictions, the correspondent relationship inventory, the due diligence file on any foreign respondent bank that clears through one of them, and the monitoring scenarios that fire on those corridors. If your system has a hard coded rule that escalates every transaction involving a grey list country, that rule now produces noise for four countries and may need a rating based trigger instead.

Money services businesses and money transmitters

MSBs are exposed through remittance corridors and agent networks rather than correspondent relationships. The practical questions are which corridors touch the four removed jurisdictions, whether any agent, subagent or counterparty is located there, and whether the geographic risk adjustment in your transaction monitoring still reflects reality. A remittance corridor is not automatically higher risk because a country was listed, and it does not become low risk because a country was removed. The volume, the customer profile and the typologies observed matter more than the flag.

Residential mortgage lenders and originators

Mortgage exposure usually appears through the borrower or the funds rather than the property location. A borrower resident in a recently removed jurisdiction, a gift from a relative abroad, an entity borrower with foreign principals, or a third-party payor whose account sits in a high-risk country are all points where the country question enters a loan file. Reassessing the geographic rating does not change what staff should do with those files, but it may change how the file is escalated and how the source of funds is documented. The mortgage lenders and brokers industry page covers the broader program context for non-bank lenders.

Precious metals, precious stones and jewelry dealers

Dealers face a specific combination of risks: high value, portability, and customers who buy in person or through intermediaries. The jurisdiction question tends to appear in the customer's residence, the origin of funds, and the shipping or delivery address. Removal from increased monitoring does not change what a dealer should do with a first-time customer paying in cash-adjacent instruments above the relevant threshold. It may change how the dealer rates the country in its risk assessment and how it documents that rating.

Cryptocurrency and digital asset businesses

Digital asset businesses have the most direct reason to read the FATF statements closely, because the Iran countermeasures explicitly reference virtual asset service providers and virtual asset transactions. That language is not decorative. It means the countermeasure framework contemplates restrictions on VASP relationships and virtual asset activity with Iran, not only on bank relationships. For exchanges, custodians and payment processors, the review items are the geographic distribution of counterparties, the VASP due diligence file, the wallet and chain analytics rules that flag exposure to high-risk jurisdictions, and the escalation path when a counterparty traces to a country on the call for action list.

Other businesses with applicable obligations

Real estate professionals, title and escrow companies, insurance intermediaries, and other businesses that fall within a covered category face the same conceptual question at a smaller scale: where does geography enter our risk assessment, and is the answer current. Not every business has identical requirements, and the correct program for a title agency looks nothing like the correct program for a money transmitter. What they share is the expectation that the risk assessment reflects the world as it is, with a date and a rationale attached.

Where the line sits between required and recommended

It is worth being precise here, because fear-based framing is common in this space. Your institution is legally required to maintain a risk based AML program with the elements your regulator expects, and to conduct customer due diligence and suspicious activity reporting as applicable. Updating a geographic risk assessment after a public list changes is a recommended practice that supports those requirements. It is not a separately codified obligation, and no regulator issued a deadline on October 30. The reason to do it is that the underlying requirement is to assess risk, and an assessment built on stale facts is hard to defend when someone asks how it was produced.

Five Compliance Actions Worth Considering

The appropriate response depends on your exposure and your obligations, so treat this as a sequence to evaluate rather than a checklist to complete. For most organizations the whole exercise is a few hours of work with a written record at the end.

1. Review and update the geographic risk assessment. Open the country section, note the October 30 changes, and set a rating for each affected jurisdiction with a written rationale. Record the review date and who approved it. If you use a scoring model, check whether list membership is a hard input or a weighted factor; a hard input will cause an automatic shift that may not reflect your actual exposure.
2. Evaluate customer and counterparty exposure. Run a search across your customer base, agent network, vendor list, and beneficial ownership records for the removed jurisdictions and for the countries on the high-risk list. The output should tell you how many relationships are affected, how material they are, and whether any were previously escalated. If the honest answer is that you cannot run that search, that is the finding.
3. Review enhanced due diligence and monitoring controls. Confirm that the triggers still match the risk. Look for scenarios that key off a country list and ask whether they should key off a rating instead, since a list based trigger will keep firing on stale assumptions and will miss countries that never appear on a list at all.
4. Confirm sanctions screening and escalation procedures. Screening coverage should include parties beyond the customer: beneficial owners, counterparties, payors, and where relevant vessels or addresses. Check that a potential match routes to a named person with authority, that decisions are documented either way, and that the escalation path is reachable outside business hours.
5. Document the changes and train on them. Update the risk assessment, note the decisions in the compliance file, and give staff a short brief on what changed. The training record should show who received it and when. This last step is the one most often skipped, and it is also the cheapest to complete.

Why Training and Documentation Matter After a List Update

Staff awareness is where international developments actually fail to land. A loan officer or a teller is not reading FATF publications, and there is no reason they should be. What they know comes from the last training session they attended, which means their working mental model of country risk is only as current as that session. If the last update they heard about was two plenaries ago, they may still be treating a jurisdiction as a listed country when it has been off the list for months, or assuming a country is fine because they never heard it mentioned.

The fix is small and procedural. A short brief when the lists change, a note in the procedure that says where the current list lives, and a periodic refresher that includes a live example. What makes it defensible is the record: who was briefed, on what content, when, and how understanding was checked. Completion tracking and certificates are not bureaucratic decoration. They are the difference between being able to answer "show me" and explaining that the training probably happened.

This is also the point where a training platform earns its keep rather than just existing. Soflo Consulting's training is video based and covers customer due diligence, suspicious activity reporting, OFAC and role-specific content, with progress tracking, completion records and downloadable certificates. Each certificate carries a unique barcode that a third party can verify independently through the site's Verify a Certificate tool, which matters most at the moment a banking partner or examiner wants confirmation that a named employee completed the training rather than appearing on a spreadsheet.

Training remains one element of a program and not a substitute for the rest. Policies, a designated compliance officer, customer due diligence and independent testing all have to be in place alongside it. A team that has been trained to a high standard but works without written procedures does not have a stronger program. It has a well informed team working without a framework.

How Soflo Consulting Supports AML Compliance

Soflo Consulting runs as an AML/BSA compliance platform plus professional services, which means the pieces can be taken in stages rather than all at once. For an institution working through a jurisdiction update, the relevant capabilities are these.

• AML program development and documentation, including written policies and procedures that describe what the organization actually does rather than what a template says it should do.
• Business-specific AML risk assessments, including the geographic component, with the scoring rationale and the review history recorded so a later question about a rating has an answer.
• AML training and compliance education, video based, covering customer due diligence, suspicious activity reporting, OFAC and role-specific content, delivered in English and Spanish.
• Independent AML program reviews, where applicable, conducted by someone who does not run the program day to day.
• Centralized training administration, with completion tracking, reporting and verifiable certificates that can be produced on request.

Plans are structured as Training Only, Training + Review, Training + Creation, and Banking Partner Readiness for companies preparing to answer counterparty diligence questions. The free tools are worth mentioning because they are genuinely useful before any purchase decision: the BSA/AML Audit Simulator asks questions across the five BSA pillars and produces a scored gap report, the AML Red Flag Library holds more than 427 verified red flags across 13 industries with source citations, and the 24 item AML compliance checklist is a fast way to see which element is thinnest in your program.

Primary next step: the AML compliance solutions overview sets out how the platform and the professional services fit together. Secondary next step: if the gap is specifically training and records, the AML training and certification page and the plans and pricing page show what each option includes. The team can be reached at (737) 258-8804.

No training product and no consulting engagement guarantees an examination outcome or a regulator's approval. What a structured program does is make the work visible, repeatable and documented, which is the part within anyone's control.

Where to Start This Week

If the October 30 update is the trigger for a review, the most useful first move is not a policy rewrite. Run the free simulator and see which of the five pillars is currently your weakest, then open the geographic section of your risk assessment and confirm it has a date, a rationale and a named approver. That combination gives you a documented baseline and a specific place to begin, which is a better position than a general sense that the lists changed and someone should probably look at it.

This article is general educational information about FATF jurisdiction updates and AML/BSA program considerations. It is not legal advice, and it does not determine whether your business is a covered institution or how any specific transaction or relationship should be treated. Coverage and obligations depend on your business model, licensing and regulator, and requirements change. Confirm your obligations with your own legal or compliance advisors, and confirm current sanctions requirements directly with OFAC materials.