Who the FATF is
The Financial Action Task Force is an intergovernmental body that sets international standards for combating money laundering, terrorist financing and the financing of weapons proliferation. Its standards, known as the FATF Recommendations, are the reference point for national laws in most countries. Canada is a founding member.
The FATF does not make law. It assesses how well countries implement its standards through a peer review process called mutual evaluation, and it works with a network of regional bodies that carry out similar assessments for their members. A mutual evaluation looks both at whether a country has the right laws and at whether those laws actually work in practice.
Where an evaluation finds serious weaknesses, the country may be referred to the FATF's process for identifying high-risk and other monitored jurisdictions. That process produces the two public lists most people know as the black list and the grey list. Neither name is official, but both are widely used.
The two lists
The FATF publishes two documents after each plenary meeting:
- High-Risk Jurisdictions subject to a Call for Action, often called the black list. These are jurisdictions with significant strategic deficiencies in their regimes to counter money laundering, terrorist financing and proliferation financing.
- Jurisdictions under Increased Monitoring, often called the grey list. These are jurisdictions that are actively working with the FATF to address strategic deficiencies, and have committed to resolve them within agreed timeframes.
The difference is not just one of degree. A grey-listed jurisdiction has made a high-level political commitment and agreed an action plan, and the FATF is monitoring its progress. A black-listed jurisdiction has deficiencies serious enough that the FATF calls on its members, and all other jurisdictions, to take specific protective steps.
This article does not name the jurisdictions on either list. The lists change, and any list printed here would go out of date. The current versions are published on the FATF's website after each plenary.
What a call for action means
For jurisdictions on the call for action list, the FATF asks all jurisdictions to apply enhanced due diligence to business relationships and transactions involving them. For the most serious cases, it calls on countries to apply countermeasures to protect the international financial system.
Countermeasures can go further than enhanced due diligence. Depending on what a country decides, they may include restrictions on opening branches or subsidiaries of financial institutions from the listed jurisdiction, enhanced reporting of transactions, limits on business relationships, or a requirement to review correspondent relationships.
In practice, many payment providers treat the call for action list as a near or complete prohibition for new business. Correspondent banks are often unwilling to process payments to or from these jurisdictions at all, which can make a payment impossible to route even if the provider itself were willing. Clients with genuine connections to such a jurisdiction should expect very detailed scrutiny and should not assume that any provider will be able to help.
What increased monitoring means
The grey list works differently. The FATF does not call for enhanced due diligence to be applied to jurisdictions under increased monitoring. It does encourage its members to take the information into account in their own risk analysis.
Financial institutions do exactly that. A connection to a grey-listed jurisdiction is a risk factor that a provider weighs alongside everything else it knows about a client: the sector, the structure, the transaction pattern and the quality of documents. It may push a relationship into a higher risk rating, or it may not, depending on the overall picture.
Some regulators go further than the FATF. Certain jurisdictions maintain their own lists of high-risk third countries, drawing on the FATF's work, and require enhanced due diligence for relationships connected with listed countries. Where a payment passes through institutions subject to those rules, their requirements will affect what information is needed.
A jurisdiction's presence on the grey list is often temporary. Many jurisdictions have been listed, completed their action plans and been removed after an on-site visit confirmed the reforms.
How and when the lists change
The FATF holds plenary meetings three times a year, typically in February, June and October. The lists are reviewed at each plenary and the updated versions are published shortly afterwards.
A jurisdiction can move in several ways. It can be added to the grey list following a weak mutual evaluation and an observation period. It can be removed from the grey list once the FATF is satisfied that it has substantially completed its action plan, usually after an on-site visit. In rarer cases, a jurisdiction that fails to make progress can face stronger action.
Because changes are announced on fixed dates, providers plan for them. Compliance teams review the plenary outcomes, update their country risk ratings, and identify which clients, beneficial owners and counterparties are affected. Clients may receive questions or document requests in the weeks after a plenary for that reason.
How Canada responds
In Canada, FINTRAC publishes information for reporting entities following FATF plenaries, reminding them of the updated lists and of their obligations. Reporting entities are expected to reflect the lists in their risk assessments and to apply enhanced measures where the risk is high.
The Proceeds of Crime (Money Laundering) and Terrorist Financing Act also gives the Minister of Finance power to issue ministerial directives. A directive can require reporting entities to take specific measures in respect of transactions originating from or bound for a named foreign jurisdiction or entity, such as treating every such transaction as high risk, verifying identity in all cases, or reporting all such transactions to FINTRAC regardless of amount. Directives have been used for jurisdictions that the FATF has identified as subject to a call for action.
Ministerial directives are binding on reporting entities, and they are separate from sanctions. A transaction can be permitted under sanctions law and still be subject to directive requirements.
What the lists mean for onboarding
A provider looks for connections to listed jurisdictions throughout the onboarding file. Relevant connections include:
- The client entity being incorporated or tax resident in a listed jurisdiction.
- A director, signatory or beneficial owner being resident in, or a national of, a listed jurisdiction.
- The client's main operations, customers or suppliers being located there.
- Expected payment flows to or from the jurisdiction.
A grey list connection usually leads to more questions rather than a refusal. The provider will want to understand why the connection exists, how material it is, and what evidence supports the source of funds. A call for action connection is a much higher bar, and many providers will decline new relationships with material links to those jurisdictions.
A connection is not the same as wrongdoing. Many people and businesses in listed jurisdictions are entirely legitimate. The lists describe weaknesses in a country's system, not in individual citizens or companies.
What the lists mean for payments
For existing clients, list changes show up in payments. A payment to or from a newly grey-listed jurisdiction may attract questions that the same payment did not attract a month earlier. A provider may ask for the invoice, the contract or the identity of the ultimate recipient.
Intermediary and receiving banks apply their own risk appetites. Some will process grey list payments with additional checks, others will not process them at all, and correspondent appetite can tighten without notice. That can mean longer processing times, requests for information from banks further down the chain, or in some cases a payment being returned.
An illustrative case: a client's long-standing supplier is located in a country that is added to the grey list at a June plenary. The provider updates its country risk ratings. The client's next payment to the supplier is reviewed by an analyst, who asks for the latest invoice and confirmation that the supplier's ownership is unchanged. The client sends both the same day, and the payment proceeds. Future payments are monitored more closely, but the relationship continues.
FATF lists are not sanctions lists
The FATF lists are often confused with sanctions, but they do different jobs. A sanctions regime is law: it prohibits specific dealings with listed people, entities or countries. The FATF lists are assessments of a country's anti-money laundering system, and they drive risk-based measures rather than prohibitions, except where a country has chosen to impose countermeasures or a directive.
A jurisdiction can be on an FATF list without being subject to any sanctions, and a sanctioned country may or may not be on an FATF list. Providers check both separately. A payment therefore needs to clear sanctions screening on its own terms, and then be assessed for risk, including FATF-related risk.
The FATF lists are also distinct from tax lists, such as lists of jurisdictions regarded as non-cooperative for tax purposes, and from the country risk ratings that individual providers build for themselves. A provider's own rating usually draws on several sources at once, including FATF statements, mutual evaluation results, sanctions exposure, corruption indicators and its own experience of payments to and from a country. A jurisdiction absent from both FATF lists can still be rated higher risk by a provider for other reasons.
Before you act
This article is general information about the FATF lists. It is not legal advice and does not describe the status of any particular jurisdiction. Always check the current lists published by the FATF, and any relevant ministerial directives, before relying on a jurisdiction's status.
If your business or structure has connections to jurisdictions under FATF review, the compliance page explains how CCYFX assesses country risk, and our guide to enhanced due diligence describes how to prepare.
