FATF Mutual Evaluation and the Grey/Black List

The FATF Standards and the Evaluation Cycle

The Financial Action Task Force (FATF), established by the G7 at the 1989 Paris Summit, is an inter-governmental body of 40 members (38 jurisdictions plus the European Commission and Gulf Cooperation Council) that sets global standards on anti-money laundering (AML), counter-financing of terrorism (CFT), and counter-proliferation financing (CPF). Its authority derives from the 40 Recommendations (last consolidated revision February 2012, amended most recently in November 2023 to strengthen Recommendation 25 on beneficial ownership of legal arrangements). The Recommendations are not a treaty; they are soft-law standards whose binding force is generated by peer review, market discipline, and downstream incorporation into instruments such as the EU's Sixth Anti-Money Laundering Directive (Directive 2018/1673) and the U.S. Bank Secrecy Act regulations at 31 C.F.R. Chapter X.

Compliance is assessed through the Mutual Evaluation Report (MER), conducted on a roughly 10-year cycle. The current Fourth Round (2014–2025) introduced a dual-track assessment: technical compliance (whether laws and institutions exist on paper, scored Compliant / Largely Compliant / Partially Compliant / Non-Compliant against each of the 40 Recommendations) and effectiveness (whether the system delivers results, scored against 11 Immediate Outcomes as High / Substantial / Moderate / Low). The Fifth Round, launched in 2024, shortens the cycle to six years and places greater weight on risk and effectiveness.

Assessment Mechanics

MERs are conducted by assessor teams drawn from FATF members and the nine FATF-Style Regional Bodies (FSRBs) — including MONEYVAL (Council of Europe), GAFILAT (Latin America), and the Middle East and North Africa FATF (MENAFATF). The process runs roughly 14 months: scoping, on-site visit (typically two weeks), draft report, face-to-face discussion, and plenary adoption. Adopted reports trigger one of three follow-up tracks:

Regular follow-up for jurisdictions with predominantly Compliant/Largely Compliant ratings and Substantial/High effectiveness.
Enhanced follow-up for weaker performers, requiring written progress reports at least every 18 months.
International Co-operation Review Group (ICRG) referral when a jurisdiction is rated Non-Compliant or Partially Compliant on 20+ Recommendations, or Low/Moderate on 9+ Immediate Outcomes, or scores Low on three core Immediate Outcomes (IO.1 risk understanding, IO.2 international cooperation, or IO.11 proliferation financing sanctions).

The ICRG operates four regional Joint Groups (Africa/Middle East, Americas, Asia/Pacific, Europe/Eurasia). A referred jurisdiction enters a one-year observation period, during which it negotiates an action plan with the relevant Joint Group. Failure to make sufficient progress results in public listing at the next plenary (held three times yearly: February, June, October).

The Two Public Documents

FATF issues two public statements after each plenary. The first — formally titled "Jurisdictions under Increased Monitoring" and universally known as the grey list — names countries that have committed to action plans and are working actively with FATF. As of the October 2024 plenary, the list included jurisdictions such as Bulgaria (added October 2023), Croatia (June 2023), Kenya (February 2024), Nigeria (February 2023), South Africa (February 2023), and Vietnam (June 2023). The second document — "High-Risk Jurisdictions Subject to a Call for Action", the black list — currently contains only the Democratic People's Republic of Korea (listed continuously since February 2011 with countermeasures) and Iran (listed June 2016, full countermeasures reactivated February 2020 following Tehran's failure to ratify the Palermo and Terrorist Financing Conventions). Myanmar was added in October 2022 with a call for enhanced due diligence but without full countermeasures.