Grey Lists Are Not Rules, They Are Answers Banks Give

Written against the position as at the FATF plenary of 17–19 June 2026. These lists are revised two or three times a year, and any file built on them should be re-run against the current statements rather than against this piece.

A family with exposure to a newly grey-listed jurisdiction is told, within weeks, that an account cannot be opened, that an existing relationship is being reviewed, or that a transfer requires documentation nobody asked for last year. The natural inference is that a law changed.

Usually no law changed. The distinction between what a grey-listing does legally and what it does commercially is the whole of this subject, and it is the thing most commentary gets backwards.

What the June plenary did

At the plenary held in Paris on 17–19 June 2026, the FATF added Bosnia and Herzegovina and Iraq to its list of jurisdictions under increased monitoring, and removed Algeria and Namibia following successful on-site visits, both having completed their action plans within the agreed timeframes. Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco received an initial determination of substantial completion and were cleared for on-site visits — the step that precedes removal.

The separate list of high-risk jurisdictions subject to a call for action was unchanged: Iran, the Democratic People's Republic of Korea and Myanmar. The FATF indicated that if no further progress is made on Myanmar by October 2026 it will consider countermeasures, and that if Iran ratifies and implements the Palermo and terrorist financing conventions in line with the standards it will decide on next steps, including whether to suspend countermeasures.

The plenary also updated Recommendation 6 so that sanctions measures do not block funds, assets, goods and services needed for humanitarian assistance and basic human needs, incorporating the humanitarian exemption in Security Council resolutions 2664 and 2761, alongside 2615. The Recommendations are now published as amended June 2026. Mutual evaluations of Canada and of Türkiye were adopted for publication after quality review. The presidency passed to the United Kingdom, under Giles Thomson, from 1 July 2026.

The legal position is narrower than assumed

Here is the provision that matters, and it does not say what people expect.

Regulation 33 of the Money Laundering Regulations 2017 sets out when enhanced due diligence is mandatory. One of its limbs concerns a country identified by the FATF — and the term it uses is a FATF call for action country, defined as a country named on the list of High-Risk Jurisdictions subject to a Call for Action published by the FATF, as that list has effect from time to time.

Read that carefully. The statutory trigger attaches to the call-for-action list. It does not attach to the list of jurisdictions under increased monitoring. Grey-listing a country does not, of itself, impose a mandatory enhanced due diligence obligation under those regulations.

Two consequences follow, and they point in opposite directions.

The first is that a great deal of what is done in the name of grey-listing is not legally compelled. It is a firm's own risk decision, taken under its own policies, and capable of being discussed on that basis rather than treated as immovable.

The second is more interesting and less noticed. Because the definition binds to the FATF list as it has effect from time to time, a change to the call-for-action list changes United Kingdom statutory obligations without any United Kingdom instrument being made. A plenary in Paris alters the scope of a mandatory duty in domestic law on the day it publishes. There is no transposition, no commencement order and no notice period, and a firm that reviews its country ratings annually will be out of compliance for up to a year without anything having appeared in a statutory instrument.

What grey-listing actually changes

If not the law, then what.

It changes the risk assessment a firm is separately obliged to maintain, and therefore the policies and controls calibrated to it. It changes correspondent banking appetite, which is where the effect is usually felt first and is entirely commercial. It changes the questions asked at onboarding and the documentation sought to answer them. It changes how long a review takes, which for a family with a transaction pending is often the operative harm rather than a refusal.

And it changes the default answer. That is the honest description of the mechanism: a relationship manager who would previously have escalated a marginal case for consideration now declines it, because the cost of the escalation has risen and the cost of the refusal has not. Nobody made that decision as policy. It is the aggregate of many individual decisions responding to the same signal.

Which is why the practical exposure is asymmetric. Removal from the list — as Algeria and Namibia have just experienced — does not reverse the commercial position at the same speed it was acquired. Systems are updated on a cycle, country ratings lag, and the file that was declined last year is not automatically revisited.

What this implies for a file

The work is unglamorous and it is dated. Country risk ratings need re-running against the June statements rather than against whatever was current when the framework was built. Existing relationship reviews need re-running for jurisdictions that moved in either direction, including removals, since a rating that is now too conservative is a cost being paid unnecessarily. Onboarding files that were assembled under one classification need to be legible under another. And the distinction between what is legally required and what is a firm's own risk appetite should be recorded, because they are negotiable on entirely different terms.

Nothing here is a comment on any listed jurisdiction, its government or its institutions. The lists are published facts with dates on them, and the only claim made above is about how a published fact travels into a private decision — through a statute for one list, and through a thousand unrecorded judgements for the other.