FATF Mutual Evaluations and the Grey and Black Lists

1. Why This Topic Matters

The Financial Action Task Force (FATF) is the global standard-setter for anti-money laundering (AML), countering the financing of terrorism (CFT) and counter-proliferation financing (CPF). It has no treaty powers, no courts and no police force, yet its Mutual Evaluation process and its two public lists shape national legislation, supervisory priorities, correspondent banking decisions and customer risk ratings around the world. For the CAMS exam, this topic sits at the heart of the International AFC Standards and Authorities domain. You are expected to know what a Mutual Evaluation is, how a country ends up on the grey or black list, what the practical consequences are for financial institutions, and how a risk-based compliance programme should react. Questions in this area are rarely pure memorisation; they usually test whether you can distinguish the two lists and apply the correct institutional response.

2. The FATF in Brief (Context You Need)

The FATF was created in 1989 by the G7 and is headquartered at the OECD in Paris. Its core output is the FATF Recommendations (the 40 Recommendations, consolidated and revised in 2012 to absorb the former 9 Special Recommendations on terrorist financing). The Recommendations are soft law: they bind nobody directly, but FATF enforces them through peer pressure, and the two main instruments of that peer pressure are (a) the Mutual Evaluation process and (b) public identification of jurisdictions with strategic deficiencies. Membership includes around 40 jurisdictions and two regional organisations (the European Commission and the Gulf Cooperation Council). Beyond its direct members, FATF standards are extended worldwide through nine FATF-Style Regional Bodies (FSRBs), such as MONEYVAL (Council of Europe), the Asia/Pacific Group (APG), GAFILAT (Latin America), the Caribbean FATF (CFATF), MENAFATF, ESAAMLG, GIABA, GABAC and the Eurasian Group (EAG). Together this is called the Global Network, covering more than 200 jurisdictions.

3. What a Mutual Evaluation Is

A Mutual Evaluation (ME) is a peer review in which a team of assessors from other member countries, supported by the FATF or FSRB secretariat, examines how well a jurisdiction has implemented the FATF Recommendations. The outcome is a Mutual Evaluation Report (MER), which is adopted by the relevant plenary and then published. The word mutual is important: countries evaluate each other, which is what gives the process its legitimacy and its political weight.

Since the 2013 Methodology (used in the fourth round), every MER measures two separate things:

(a) Technical Compliance - Does the country have the laws, regulations and institutional framework the Recommendations require? Each of the 40 Recommendations receives one of four ratings:
- C - Compliant
- LC - Largely Compliant (minor shortcomings)
- PC - Partially Compliant (moderate shortcomings)
- NC - Non-Compliant (major shortcomings)

(b) Effectiveness - Do those measures actually work in practice? Effectiveness is assessed against 11 Immediate Outcomes (IOs), covering areas such as understanding of ML/TF risk and national coordination (IO.1), international cooperation (IO.2), supervision (IO.3), preventive measures by financial institutions and DNFBPs (IO.4), beneficial ownership transparency (IO.5), use of financial intelligence (IO.6), ML investigation and prosecution (IO.7), confiscation (IO.8), TF investigation and prosecution (IO.9), TF preventive measures and targeted financial sanctions (IO.10) and proliferation financing sanctions (IO.11). Each IO receives one of four ratings:
- HE - High level of effectiveness
- SE - Substantial level
- ME - Moderate level
- LE - Low level

The introduction of the effectiveness dimension was the single biggest change of the fourth round. A country can have excellent laws on paper and still be rated poorly if it produces few prosecutions, confiscates little, or if its supervisors do not actually inspect and sanction firms. Exam questions sometimes test this distinction by describing a jurisdiction with a strong legal framework but weak results and asking which component of the MER would reflect that.

4. How the Mutual Evaluation Process Works

Step 1 - Scheduling and preparation. Each FATF member and FSRB member is evaluated on a rolling schedule. The country completes detailed questionnaires on technical compliance and provides statistics and case studies on effectiveness.

Step 2 - Desk review. The assessment team (typically legal, financial and law enforcement experts from other countries) analyses the submissions and drafts preliminary technical compliance findings before travel.

Step 3 - On-site visit. Assessors spend roughly two weeks in the country meeting the financial intelligence unit (FIU), supervisors, prosecutors, police, customs, the private sector (banks, money service businesses, casinos, lawyers, accountants, real estate agents) and self-regulatory bodies. This is where effectiveness is genuinely tested.

Step 4 - Drafting and discussion. The draft MER is exchanged with the assessed country, reviewed by other members, and then debated and adopted at the plenary meeting. Ratings may be changed in plenary.

Step 5 - Publication and follow-up. The MER is published. The country then enters one of two follow-up tracks:
- Regular follow-up - for countries with good results; they report back periodically (generally every three years).
- Enhanced follow-up - for countries with significant weaknesses (for example, many PC/NC ratings or several low or moderate effectiveness ratings); they report more frequently, typically annually, and may seek technical compliance re-ratings as laws are amended.

Countries with the poorest results can be referred to the International Co-operation Review Group (ICRG), which is the gateway to the grey and black lists (see section 6).

Step 6 - Fifth round. FATF has begun a fifth round of evaluations with a shorter cycle (around six years rather than roughly ten), a sharper focus on effectiveness and on the specific risks of each country, and faster follow-up. For exam purposes, the structural ideas (technical compliance versus effectiveness, peer review, follow-up, ICRG referral) remain the same.

5. The Two Public Lists

FATF publishes two statements after each of its three plenaries each year (February, June and October). Candidates often know them by their informal names, but you should also recognise the official titles.

5.1 The Grey List - Jurisdictions under Increased Monitoring

These are countries that have strategic deficiencies in their AML/CFT/CPF regimes but that have committed to an action plan agreed with FATF and are actively working to fix the problems within agreed timeframes. FATF describes them as being under increased monitoring. Key features:
- The country has made a high-level political commitment to resolve the deficiencies.
- FATF reviews progress at every plenary and publishes an updated statement listing what has and has not been completed.
- FATF does not call for enhanced due diligence or countermeasures against grey-listed countries. Instead it encourages its members and all jurisdictions to take the information into account in their risk analysis.
- Being grey-listed nonetheless has real consequences: higher country risk scores in bank models, increased scrutiny from correspondent banks, possible de-risking, reputational damage, higher borrowing costs and inclusion on related lists such as the EU list of high-risk third countries.
- Removal (delisting) occurs when the country substantially completes its action plan, verified by an on-site visit by FATF. Examples of countries that have been listed and later removed include Pakistan, Mauritius, Botswana, Malta, Cayman Islands, Panama, Albania, Jamaica, Turkey, the UAE and Nigeria (lists change constantly, so exam questions test concepts, not the current composition).

5.2 The Black List - High-Risk Jurisdictions subject to a Call for Action

These are countries with serious strategic deficiencies that have not made sufficient progress or have refused to engage. FATF calls on all members and urges all jurisdictions to take action. There are two tiers of response within the call for action:
- Enhanced due diligence proportionate to the risk arising from the jurisdiction (applied, for example, to Myanmar after its listing in October 2022, with FATF noting that humanitarian and legitimate flows should not be disrupted).
- Countermeasures to protect the international financial system, applied in the most serious cases. The two long-standing countermeasures jurisdictions are Iran and the Democratic People's Republic of Korea (DPRK / North Korea).

Countermeasures are described in the interpretive note to Recommendation 19 and may include: requiring enhanced due diligence on all relationships and transactions; introducing systematic reporting of transactions involving the country; refusing to establish subsidiaries or branches of institutions from that country; prohibiting domestic institutions from relying on third parties located there; reviewing, limiting or terminating correspondent relationships; increasing supervisory examination of branches and subsidiaries located there; and requiring institutions to limit business relationships or transactions with the jurisdiction entirely.

5.3 The Old NCCT List (Historical)

Between 2000 and 2006 FATF ran the Non-Cooperative Countries and Territories (NCCT) initiative, publicly naming jurisdictions that failed to cooperate. It was criticised as blunt and was replaced by the ICRG process in 2007 onward. If an exam question refers to the NCCT list, recognise it as the historical predecessor of today's grey and black lists.

6. How a Country Gets Onto (and Off) the Lists: The ICRG Process

The ICRG reviews jurisdictions that are either nominated by a FATF member or that meet thresholds based on their MER results. Broadly, a country enters the review pool if its MER shows, for example:
- 20 or more NC/PC ratings for technical compliance, or
- NC or PC on three or more of the core Recommendations (R.3 on criminalising ML, R.5 on criminalising TF, R.6 on TF targeted financial sanctions, R.10 on customer due diligence, R.11 on record-keeping, R.20 on suspicious transaction reporting), or
- a low or moderate effectiveness rating on nine or more of the 11 Immediate Outcomes, or a low rating on six or more.

Historically FATF prioritised jurisdictions with larger financial sectors (a financial sector assets threshold of around USD 5 billion), and in 2023 it adjusted the approach so that the least developed countries are generally not prioritised unless they pose a significant ML/TF/PF risk, reflecting criticism that grey-listing harmed poorer economies.

Once in the pool, the country has a one-year observation period to address the deficiencies. If it does not, FATF agrees an action plan with the country, and the jurisdiction is publicly listed as under increased monitoring (grey list). If a country refuses to engage, or fails persistently, it can be escalated to the call-for-action statement (black list). Progress is reviewed at every plenary, and delisting from the grey list requires substantial completion of the action plan confirmed by an on-site visit.

7. What Financial Institutions Must Do: Recommendation 19 and the Risk-Based Approach

Recommendation 19 (Higher-risk countries) requires financial institutions to apply enhanced due diligence, proportionate to the risks, to business relationships and transactions with natural and legal persons from countries for which FATF calls for this. It also requires countries to apply countermeasures when FATF calls for them, and allows countries to apply countermeasures independently of any FATF call. In practice, a compliance programme should:
- Incorporate the FATF statements into the country risk assessment and geographic risk factors in customer risk rating models, updating after each plenary.
- For black-listed countermeasures jurisdictions (Iran, DPRK): apply mandatory EDD, restrict or prohibit business as required by national law and sanctions regimes, review and typically terminate correspondent relationships, and expect national regulators to have issued directives.
- For black-listed EDD jurisdictions (such as Myanmar): apply enhanced due diligence while ensuring legitimate humanitarian and remittance flows are not needlessly blocked.
- For grey-listed jurisdictions: there is no automatic requirement to apply EDD or to exit customers. The institution should take a risk-based approach: consider the listing alongside other factors (product, channel, customer type, transaction patterns), potentially increase monitoring thresholds or review frequency, and document the rationale. Wholesale de-risking of an entire country is generally discouraged by FATF and by many regulators.
- Keep in mind that other lists operate alongside FATF's: the EU list of high-risk third countries (largely mirroring FATF but formally adopted by the Commission and triggering mandatory EDD under EU law), FinCEN Section 311 special measures in the US, OFAC and other sanctions programmes, and national regulators' own lists. Sanctions prohibitions always take precedence over a risk-based judgement.

8. Common Points of Confusion

- Grey list versus black list: grey means cooperating under an action plan with no FATF call for EDD; black means a call for action, either EDD or full countermeasures.
- FATF versus national law: FATF statements are not legally binding by themselves. They become binding when national authorities translate them into regulation or sanctions. But examiners and regulators expect institutions to reflect them in risk assessments regardless.
- Mutual Evaluation versus listing: a poor MER does not automatically mean grey-listing. The MER is the diagnostic; the ICRG process decides whether a country is publicly identified. Many countries with mediocre MERs simply go into enhanced follow-up.
- Technical compliance versus effectiveness: laws on paper versus results in practice.
- FATF versus FSRBs: FSRBs conduct MERs for their own members using the same methodology; they can nominate members to the ICRG, but only FATF publishes the grey and black lists.
- Sanctions versus FATF lists: a country can be heavily sanctioned (for example, Russia, which was suspended from FATF membership in 2023) without appearing on the FATF black list; conversely, grey-listing is not a sanction.

9. Exam Tips: Answering Questions on FATF Mutual Evaluations and the Grey and Black Lists

Tip 1 - Learn the official names and map them to the nicknames. Grey list = Jurisdictions under Increased Monitoring. Black list = High-Risk Jurisdictions subject to a Call for Action. If an answer option uses the official wording, do not be thrown off.

Tip 2 - Anchor on the key distinguishing feature: cooperation and action plan. If a scenario describes a country that has committed to an action plan and is making progress, it is grey-listed. If it describes a country that refuses to engage or has serious deficiencies with no progress, it is black-listed. Build your answer from that anchor.

Tip 3 - Match the response to the list. Grey list = risk-based consideration, not automatic EDD, not automatic exit. Black list with countermeasures = mandatory EDD plus restrictions such as terminating correspondent relationships. Black list without countermeasures = EDD. Exam options that say a bank must immediately close all accounts linked to a grey-listed country are almost always wrong because they ignore the risk-based approach.

Tip 4 - Remember FATF has no enforcement power. Options describing FATF fining a country, imposing sanctions or prosecuting institutions are incorrect. FATF works through peer review, public identification and the pressure that follows. National regulators and sanctions authorities do the enforcing.

Tip 5 - Know Recommendation 19 by number and by content. It is the Recommendation on higher-risk countries, EDD and countermeasures. Also be ready to connect it with Recommendation 10 (CDD) and Recommendation 13 (correspondent banking), because questions about black-listed jurisdictions often involve correspondent relationships.

Tip 6 - Distinguish technical compliance from effectiveness. If a question says a country has comprehensive legislation but very few convictions or confiscations, the correct description is good technical compliance with low effectiveness. Know the four rating scales (C/LC/PC/NC and HE/SE/ME/LE) and that there are 40 Recommendations and 11 Immediate Outcomes.

Tip 7 - Understand the process sequence. MER published, follow-up (regular or enhanced), possible ICRG referral, one-year observation period, action plan, grey-listing, progress review every plenary, on-site verification, delisting. Or, if no cooperation, escalation to the call for action. Sequencing questions are common.

Tip 8 - Do not memorise current list membership as the primary strategy. The lists change three times a year, and exam writers avoid questions that would go stale. Instead, know the two enduring countermeasures examples (Iran and DPRK), recognise Myanmar as an EDD-tier black list example, and understand that a wide range of countries have moved on and off the grey list.

Tip 9 - In scenario questions, choose the answer that reflects risk-based, documented, proportionate action. Typical best answers include updating the country risk assessment, applying enhanced monitoring where risk warrants, escalating to senior management or the board, and documenting the rationale. Typical wrong answers are extreme (terminate everything), passive (ignore until the regulator requires action) or misattribute authority (wait for FATF to instruct the bank directly).

Tip 10 - Watch for distractors involving other bodies and lists. Know that the EU high-risk third country list, FinCEN 311 measures, OFAC sanctions, Basel Committee guidance, the Wolfsberg Group and the Egmont Group are all different from FATF's grey and black lists. If a question asks who publishes the list of jurisdictions under increased monitoring, the only correct answer is FATF, not an FSRB, the IMF, the World Bank or the UN.

Tip 11 - Historical references. If you see NCCT, recognise it as the 2000 to 2006 predecessor programme. If you see 40 plus 9 Recommendations, recognise the pre-2012 structure now consolidated into the 40 Recommendations.

10. Quick Revision Summary

- FATF: founded 1989, Paris, standard-setter, 40 Recommendations, soft law enforced by peer pressure.
- Mutual Evaluation: peer review producing an MER; assesses technical compliance (C/LC/PC/NC on 40 Recommendations) and effectiveness (HE/SE/ME/LE on 11 Immediate Outcomes); on-site visit; followed by regular or enhanced follow-up.
- ICRG: reviews poor performers; one-year observation period; leads to action plan and public listing.
- Grey list: Jurisdictions under Increased Monitoring; strategic deficiencies plus committed action plan; updated at each plenary (February, June, October); FATF does not call for EDD; institutions apply risk-based consideration.
- Black list: High-Risk Jurisdictions subject to a Call for Action; EDD required, and countermeasures for the most serious cases (Iran, DPRK); Myanmar at the EDD tier.
- Recommendation 19: higher-risk countries, EDD and countermeasures.
- For the exam: identify the list from the cooperation and action plan cue, match the response to the list, remember FATF cannot enforce directly, and always favour the risk-based, documented answer.