top of page

What and who is the FATF?

Author: Rhiannon Davies, Associate at AML Sorted


ree


How does the FATF Influence Australia?


The FATF last visited Australia in 2014, and they concluded that Australia has a mature regime for combatting money laundering and terrorist financial, but that certain key areas remained unaddressed. 


Three of the areas that were non-compliant related to Designated Non-Financial Businesses and Professions (DNFBPs) which are businesses that are not traditional financial institutions but are still vulnerable to financial crime i.e. law firms, accountants, real estate agents etc...


The non-compliances boiled down to those types of businesses not being regulated for anti-money laundering and counter-terrorism financing. If you think about it, there is a lot of money that goes through law firms, and whilst the sector is not regulated, it means that the authorities don’t have intel on suspicious activity. 


Therefore, the action on the back of this was to bring DNFBPs into scope for certain types of work that are at a high risk for a criminal to want to use your firm to launder their criminal money. Otherwise, Australia could have ended up on the FATFs High-Risk Country and Jurisdictions Under Increased Monitoring Lists


The FATF will be visiting Australia again 2026 to review progress.


What are the FATFs High-Risk Country and Jurisdictions Under Increased Monitoring Lists?


The FATF has two important lists which are split as follows:


Black List - High-Risk Jurisdictions subject to a Call for Action


This list is sometimes known as the “black list”. This list shows countries that the FATF have identified as high-risk due to having strategic deficiencies in their regime to counter money laundering, terrorist financing and the financing of proliferation.


At the last review in October 2025, the countries on this list are:

  • Democratic People’s Republic of Korea (DPRK)

  • Iran

  • Myanmar


Grey List - Jurisdictions under Increased Monitoring


This list is sometimes known as the “grey list”. This list also shows countries that the FATF have identified as high-risk due to having strategic deficiencies in their regime to counter money laundering, terrorist financing and the financing of proliferation. 


However, the difference here is that these countries are actively working with the FATF to address deficiencies.


At the last review in October 2025, the countries on this list are:

  • Algeria

  • Angola

  • Bolivia

  • Bulgaria

  • Cameroon

  • Côte d’Ivoire

  • Democratic Republic of the Congo

  • Haiti

  • Kenya

  • Lao PDR

  • Lebanon

  • Monaco

  • Namibia

  • Nepal

  • South Sudan

  • Syria

  • Venezuela

  • Vietnam

  • Virgin Islands (UK)

  • Yemen


What Do I Have To Do If I Encounter One of These Countries During a Matter?


In a nutshell, you need to apply enhanced customer due diligence when encountering countries on the black list. 


To give you more insight, the FATF says that when dealing with countries on the black list, you need to apply enhanced customer due diligence. When dealing with countries on the grey list, the FATF says that it does not call for the application of enhanced due diligence measures to be applied, but does require the application of a risk-based approach and to take into account the information they have provided on each country in their risk analysis. 


AUSTRAC Guidance for Tranche 2 entities is along the same lines and says that you must conduct enhanced customer due diligence if any of the following are physically present in, or formed in, a high-risk jurisdiction that the Financial Action Task Force (FATF) has called for enhanced CDD to be applied (i.e. the black list):


  • your customer

  • any beneficial owner of the customer

  • any person on whose behalf the customer is receiving the designated service, such as a beneficiary of a trust or foreign equivalent

  • any person acting on behalf of the customer. 


However, AUSTRAC Guidance also says that they expect you to apply a high-risk rating to countries on the FATF grey AND black lists. Now, a high-risk country rating doesn’t necessarily mean that Enhanced CDD will be required; it will depend on other risk factors. For example (but not limited to)


  • Where you have rated your customer risk as high, Enhanced CDD is required. 

  • Where you are required to submit a Suspicious Matter Report and intend to continue acting, Enhanced CDD is required. 

  • Where there is a transaction that has no economic or legal purpose, Enhanced CDD is required.


How often do the lists change


The FATF has plenary meetings three times a year in February, June and October where they review both of these lists. 


Once reviewed, the FATF decide if there are any countries to be added or removed to the grey or black list, and this is then communicated......



How does this Impact Your Firm's Risk Assessment and AML/CTF Policies and Procedures?


It is really important that your initial Firm Risk Assessment identifies what risk these countries pose to your firm, along with the steps you are going to take to mitigate this risk. If you never encounter a country on the grey or black list, the risk may be low and minimal actions may be required such as just identifying and documenting the countries involved for each matter. 


However, if you frequently encounter countries on the grey and black list, it is going to pose a much bigger risk in terms of money laundering and therefore you are going to need more actions such as applying enhanced customer due diligence, weekly review of matter by the firm’s Anti-Money Laundering Compliance Officer (AMLCO), only partner-level lawyers able to take on these types of matters etc…


Your AML Policies and Procedures then need to document the above and explain to your staff how they are to comply with the firm’s requirements for example, how to conduct enhanced customer due diligence, who to refer matters like this too, additional file notes that need to be added etc…


On an ongoing basis, we recommend that each time the lists change, you document in your Firm Risk Assessment that you have reviewed the updated lists, along with any actions you are going to be taking as a result of the changes which may involve updating your AML Policies and Procedures. Don’t forget to let staff know if there have been any changes. 


As always, if you have any questions, please feel free to email me.


Rhiannon






bottom of page