FATF Grey List 2026: What Canadian MSBs Need to Review After the Latest Update

On 19 June 2026, FATF concluded its June plenary and updated its list of jurisdictions under increased monitoring, commonly called the FATF grey list, adding Bosnia and Herzegovina and Iraq and removing Algeria and Namibia. FINTRAC followed on 15 July 2026 with an advisory to Canadian reporting entities restating FATF's position and Canada's own measures on higher-risk jurisdictions. For a Canadian MSB with cross-border customers or transaction corridors, these updates are not just international news; they are inputs that belong in the business's geographic risk assessment, customer risk ratings and ongoing monitoring. This guide covers what the FATF grey list actually is, what changed in June 2026, how it differs from FATF's high-risk "call for action" list, and what a Canadian MSB should specifically review after FINTRAC's latest advisory.

What Is the FATF Grey List?

The FATF grey list is the common name for what FATF itself calls "Jurisdictions under Increased Monitoring." These are jurisdictions FATF has identified as having strategic deficiencies in their frameworks to counter money laundering, terrorist financing and proliferation financing, and that have committed to work with FATF, or their regional FATF-style body, to address those deficiencies within an agreed timeframe. Grey-list status is not a sanction, and it does not mean a jurisdiction has no functioning AML regime; it means FATF has flagged specific gaps and is tracking the country's progress in closing them. FATF publishes an updated statement on this list, alongside a separate statement on high-risk jurisdictions subject to a call for action, after each of its three plenary meetings a year, in February, June and October.

Which Countries Are on the FATF Grey List in 2026?

Following the June 2026 update, 22 jurisdictions are under increased monitoring:

Source: FATF, Jurisdictions under Increased Monitoring – 19 June 2026. Verify against the current FATF statement before relying on this list, as it is updated at each plenary.

What Changed in the June 2026 FATF Update?

FATF added Bosnia and Herzegovina and Iraq to the grey list at the June 2026 plenary, and removed Algeria and Namibia following successful on-site visits confirming progress on their action plans. Removal from the list means a jurisdiction is no longer subject to FATF's increased-monitoring process; it is not a declaration that the country is now low risk. It does not mean every customer connected to Algeria or Namibia automatically becomes low risk, that existing risk ratings must automatically change, or that any enhanced measures already in place must automatically stop. An MSB should reassess its own exposure to these jurisdictions using its documented risk methodology, rather than applying either an automatic downgrade or an automatic upgrade based on the list change alone.

FATF Grey List vs FATF Black List: What Is the Difference?

The grey list (jurisdictions under increased monitoring) and the FATF blacklist (formally, high-risk jurisdictions subject to a call for action) are different categories with different implications. Grey-listed jurisdictions are actively working with FATF on an agreed action plan. The blacklist identifies jurisdictions with the most serious, unaddressed deficiencies. As of the June 2026 statement, the FATF blacklist includes the Democratic People's Republic of Korea (DPRK), Iran and Myanmar. Treatment is not identical across these three: FATF calls for countermeasures against DPRK and Iran, and for enhanced due diligence measures proportionate to the risk arising from Myanmar specifically, rather than countermeasures. A grey-listed jurisdiction should not be described as a high-risk jurisdiction subject to a call for action; the two lists, and the expected response to each, are distinct.

Does FATF Grey Listing Automatically Require Enhanced Due Diligence?

No, not simply because a jurisdiction appears on the increased-monitoring list. FATF's own position is that it does not call for blanket enhanced due diligence to be applied to grey-listed jurisdictions as a class, and its standards support a risk-based approach rather than automatic de-risking of entire classes of customers based on grey-list status alone. Grey-list exposure is one geographic-risk input into an MSB's overall risk-based assessment. Enhanced measures may still become appropriate, or mandatory, where the customer's overall risk profile is high for other reasons, where a specific Canadian legal requirement applies, where a Ministerial Directive is in effect, where sanctions exposure exists, or where the customer's activity otherwise warrants it. For the broader mechanics of when and how enhanced due diligence applies, see our dedicated guide.

What Does FINTRAC's July 2026 Advisory Mean for Canadian MSBs?

FINTRAC republishes an advisory after each FATF plenary because Canadian reporting entities are expected to factor FATF's statements into their own risk assessments, even though FATF has no direct enforcement power in Canada. Following the July 2026 advisory, a Canadian MSB should review:

• its geographic-risk methodology, to confirm it reflects the current 22-jurisdiction grey list
• customer-risk ratings for clients with a genuine connection to a newly added or newly removed jurisdiction
• active customer relationships and transaction corridors touching Bosnia and Herzegovina or Iraq
• onboarding rules and ongoing monitoring settings that reference country lists
• escalation procedures for geographic-risk changes
• whether relevant Ministerial Directives, particularly those on Iran, DPRK and Russia, are correctly reflected in procedures
• staff guidance and training materials that reference specific countries
• any policy that hard-codes a country list rather than referencing the current FATF and FINTRAC sources

Not every item on this list requires the same action for every MSB; the appropriate response depends on whether the business actually has exposure to the jurisdictions concerned.

How Should an MSB Use the FATF Grey List in Its Risk Assessment?

A country list should be one input into a risk assessment, not the entire methodology. Alongside FATF status, a Canadian MSB's geographic-risk analysis can reasonably draw on applicable Canadian Ministerial Directives, Canadian sanctions measures, Canada's National Risk Assessment, the business's own customer base and exposure, transaction corridors, products and services, observed transaction behaviour, ownership and control information, and other reliable jurisdiction-risk sources. There is no universal numerical weighting that applies across all MSBs; a documented, business-specific approach to how each factor is weighed is what matters, not a fixed formula that treats every grey-listed country as an automatic fixed number of risk points.

What Should You Do When a Customer or Transaction Has Grey-List Exposure?

Consider a Canadian remittance MSB that discovers an existing customer regularly sends funds to a jurisdiction recently placed under increased monitoring. The practical process is to identify the exposure, understand why it exists, reassess the customer's and transaction's risk in light of the change, review activity against what is reasonably expected for that customer, check whether any Canada-specific requirement applies to the jurisdiction, apply controls proportionate to what the reassessment shows, and document the reasoning. Grey-list exposure alone is not proof of suspicious activity and does not automatically require enhanced due diligence, an STR, or ending the relationship.

Does a Grey-Listed Country Automatically Trigger an STR?

No. FATF grey-list status does not itself satisfy Canada's suspicious-transaction reporting threshold. A Suspicious Transaction Report decision should be based on the facts, context, applicable indicators and transaction behaviour surrounding the specific transaction, assessed against the reasonable-grounds-to-suspect standard, rather than on a jurisdiction's list status alone.

How Should Transaction Monitoring Change?

Geographic exposure can inform what monitoring looks for, without dictating a blanket rule. Relevant signals can include a new corridor appearing for a customer, activity to an unexpected jurisdiction, a material increase in activity involving a monitored jurisdiction, transaction patterns inconsistent with the customer's expected profile, or transactions involving a jurisdiction subject to a specific Canadian requirement. Not every transfer to a grey-listed country should generate an alert; monitoring rules should stay risk-based and tied to what is actually unusual for that customer. For the mechanics of building and tuning a monitoring program, see AML transaction monitoring.

What About Algeria and Namibia After Their Removal From the Grey List?

Both jurisdictions were removed after FATF-confirmed on-site visits found their action plan commitments had been completed; each will continue working with its regional FATF-style body, MENAFATF for Algeria and ESAAMLG for Namibia, to sustain those improvements. Removal should trigger a reassessment, not an automatic switch to "low risk." An MSB should weigh its own historic experience with customers connected to these jurisdictions, customer-specific factors, any current Canadian sanctions or directives that might still apply, and its own documented risk assessment, rather than reclassifying every related customer as low risk purely because the FATF listing changed.

Canada's Specific Measures on DPRK, Iran, Myanmar and Russia

FINTRAC's July 2026 advisory also restates Canada-specific measures that go beyond FATF's own statements and should not be confused with ordinary grey-list country risk. A Ministerial Directive published in the Canada Gazette requires every financial transaction originating from, or bound for, Iran to be treated as high-risk regardless of amount, and requires such transactions to be reported to FINTRAC; a comparable high-risk treatment applies to DPRK-connected transactions. Myanmar is treated differently: it remains subject to FATF's call for enhanced due diligence proportionate to risk rather than countermeasures, and FINTRAC's advisory asks reporting entities to factor Myanmar into their geographic-risk assessment, apply enhanced due diligence where warranted, and consider whether an STR is required, without treating every Myanmar-connected transaction as automatically high-risk the way Iran and DPRK transactions must be. Russia does not appear on FATF's June 2026 grey list or call-for-action list at all — its own FATF membership remains suspended — but a separate Canadian Ministerial Directive applies high-risk treatment to Russia-connected transactions regardless. FATF's country lists and Canada's Ministerial Directives are related but separate legal instruments, and an MSB needs to track both rather than assuming one implies the other.

What Canadian MSBs Should Review Now

• Confirm any internal FATF-reference country list reflects the current 22-jurisdiction FATF grey list (review step)
• Identify any active exposure to Bosnia and Herzegovina and Iraq (review step)
• Review how customers connected to Algeria and Namibia are currently rated (review step)
• Check whether policies incorrectly describe every grey-listed country as automatically requiring EDD (accuracy check)
• Confirm DPRK, Iran, Myanmar and Russia are handled under the correct Canada-specific framework, not as ordinary grey-list countries (required where the applicable Ministerial Directive applies)
• Confirm relevant Ministerial Directives are reflected in current procedures (required where applicable)
• Review active transaction corridors for geographic-risk relevance (good practice)
• Review high-risk customer ratings tied to country exposure (good practice)
• Check that monitoring rules remain risk-based rather than list-triggered (good practice)
• Update staff guidance and training materials referencing specific countries (good practice)
• Document changes made to the risk assessment as a result of this review (supports the documented risk assessment required under the PCMLTFA)

Bottom Line

The FATF grey list is an important country-risk input, not a universal customer-rejection list. Canadian MSBs should understand what changed in June 2026, what did not, which jurisdictions are grey-listed versus subject to a call for action, where Canada has additional Ministerial Directive requirements on top of FATF's own statements, and how all of this should feed into their own documented risk framework rather than a fixed, list-based rule. Where an existing risk assessment or policy set needs updating to reflect this, AML advisory support or a refreshed AML compliance program build-out can help.

Frequently Asked Questions

Is Canada on the FATF grey list in 2026?

No. Canada is not among the 22 jurisdictions under increased monitoring following the June 2026 update, and is not on the high-risk call-for-action list.

How quickly should an MSB update its country-risk information after a FATF list change?

There is no universal statutory number of days for reflecting a FATF list change specifically. What is required is that an MSB maintain a current, documented risk assessment under the PCMLTFA. As a matter of prudent practice, that means reviewing country-risk information reasonably promptly after a material external change, such as a FATF plenary update, rather than letting a country list go stale. Where a specific Canadian legal deadline applies to a related obligation, such as a Ministerial Directive, that deadline governs.

What if an MSB's third-party country-risk provider has not yet reflected the latest FATF update?

A third-party country-risk tool can support a risk assessment, but using one does not transfer the MSB's own compliance responsibility. A business should not knowingly rely on data it has reason to believe is out of date. Where a discrepancy is identified, checking FATF and FINTRAC's own sources directly, and using that information in the interim, is a reasonable step regardless of whether the business otherwise uses a third-party provider.

Does indirect exposure to a FATF grey-listed country matter?

Geographic risk is not limited to a customer's stated residence or nationality. Depending on the business, relevant exposure can include beneficial ownership connections, counterparties, payment destinations, transaction corridors, or the source or destination of funds tied to a grey-listed jurisdiction. Indirect exposure should not be automatically classified as high risk; it should be identified and assessed in context alongside the customer's other risk factors.

Should an MSB review existing customers when their country is newly added to the FATF grey list?

A newly added jurisdiction can justify a risk-based reassessment of existing relationships or corridors with a genuine connection to it. That reassessment does not automatically require enhanced due diligence, an STR, account closure, or an automatic high-risk rating. The appropriate response depends on the customer's overall risk profile, the nature of the exposure, any applicable Ministerial Directive or sanctions consideration, and the customer's transaction behaviour.

Sources Referenced

• FATF — Jurisdictions under Increased Monitoring, 19 June 2026
• FATF — High-Risk Jurisdictions subject to a Call for Action, 19 June 2026
• FATF — Outcomes of the FATF Plenary, 17–19 June 2026
• FINTRAC — Advisory: Financial transactions related to countries identified by the Financial Action Task Force, 15 July 2026