FATF List Country Checker
Check Country Status
Enter a country name to see its current FATF designation and compliance requirements.
Current FATF Designations
Blacklisted Countries
Greylisted Countries (June 2025)
Non-Listed Countries
Countries not currently on either FATF watchlist. Standard AML/CDD requirements apply.
Compliance Requirements by Designation
| FATF Designation | Due-Diligence Level | Transaction Controls | Reporting Frequency | Penalties |
|---|---|---|---|---|
| Blacklisted | Enhanced Due Diligence (EDD) | Automatic blocking of inbound/outbound crypto flows | Immediate SAR/CTF filing | Fines up to US$10 million, license revocation |
| Greylisted | Increased Monitoring (augmented KYC + source-of-funds checks) | Transaction review trigger; may proceed after manual approval | Periodic (monthly) reporting of flagged transactions | Fines up to US$5 million, increased supervisory scrutiny |
| Non-listed | Standard Customer Due Diligence (CDD) | Standard AML screening | Annual AML compliance report | Regulatory warning, remedial action plans |
Quick Take
- FATF’s greylist now includes 25 jurisdictions; crypto firms must tighten monitoring for any transactions involving them.
- Blacklist countries (North Korea, Iran, Myanmar) trigger full transaction blocking and the strictest Enhanced Due Diligence (EDD).
- Greylist nations require increased monitoring, source‑of‑funds verification, and extra reporting, but not outright bans.
- June2025 saw Bolivia and the Virgin Islands (UK) added - update your screening tables today.
- Non‑compliance can cost billions in lost capital and damage banking relationships.
What the FATF Is and Why Its Lists Matter
When you hear FATF is the Financial Action Task Force, an inter‑governmental body that sets global standards against money laundering, terrorist financing and related threats. Its two watch‑lists - the blacklist and a set of jurisdictions deemed to pose the highest AML/CTF risk and the greylist (officially “Jurisdictions Under Increased Monitoring”) which signals a country is working to fix strategic deficiencies.
For cryptocurrency businesses, these designations dictate how much scrutiny you must apply to customers, wallets and blockchain addresses linked to a given country. Ignoring the lists can trigger sanctions, frozen assets, or loss of banking partners.
Current FATF Greylist (June2025)
The most recent update adds Bolivia and the Virgin Islands (UK) while removing Croatia, Mali and Tanzania. The full slate now reads:
- Algeria
- Angola
- Bolivia
- Bulgaria
- Burkina Faso
- Cameroon
- Côte d’Ivoire
- Democratic Republic of the Congo
- Haiti
- Kenya
- Laos (Lao People's Democratic Republic)
- Lebanon
- Monaco
- Mozambique
- Namibia
- Nepal
- Nigeria
- South Africa
- South Sudan
- Syria
- Venezuela
- Vietnam
- Virgin Islands (UK)
- Yemen
Each of these nations is under a FATF‑approved action plan with deadlines for closing AML/CTF gaps.
Crypto‑Specific Implications: Blacklist vs Greylist
Virtual Asset Service Providers (VASP is a any entity that conducts exchange, transfer, custody or other services for digital assets) must adjust their compliance frameworks based on the country category.
| FATF Designation | Due‑diligence Level | Transaction Controls | Reporting Frequency | Typical Penalties for Breach |
|---|---|---|---|---|
| Blacklist | Enhanced Due Diligence (EDD) | Automatic blocking of inbound/outbound crypto flows | Immediate SAR/CTF filing | Fines up toUS$10million, license revocation |
| Greylist | Increased Monitoring (augmented KYC + source‑of‑funds checks) | Transaction review trigger; may proceed after manual approval | Periodic (monthly) reporting of flagged transactions | Fines up toUS$5million, increased supervisory scrutiny |
| Non‑listed | Standard Customer Due Diligence (CDD) | Standard AML screening | Annual AML compliance report | Regulatory warning, remedial action plans |
The key difference: blacklisted jurisdictions face outright bans, while greylisted ones are monitored closely but can still transact after satisfying extra checks.
How Crypto Firms Should Adapt Their Programs
Below is a practical checklist that any crypto exchange, wallet provider or DeFi aggregator can copy‑paste into their SOPs.
- Integrate the latest FATF list feed (official CSV or API) into your transaction monitoring system.
- Tag every wallet address with a country‑risk score; for greylist countries add a “review required” flag.
- For blacklisted customers, trigger automatic transaction freeze and generate a Suspicious Activity Report (SAR) within 24hours.
- Require enhanced verification (passport, utility bill, proof of source of funds) for any user whose IP or KYC indicates a greylist jurisdiction.
- Maintain a separate audit log for all greylist‑related reviews - regulators often request evidence of manual checks.
- Train compliance analysts on the nuances of each jurisdiction; for example, Bolivia’s high‑risk political exposure vs. the Virgin Islands’ offshore‑service focus.
- Run quarterly simulations of a mass‑transfer from a greylist country to test system resilience and reporting timelines.
Real‑World Risks of Ignoring FATF Designations
History provides stark numbers. Pakistan’s 2008 greylisting cost an estimated $38billion by 2021 through capital flight and limited access to global banking. More recently, South Africa’s 2024 inclusion coincided with a 12% drop in foreign crypto inflows as institutional partners tightened their AML gates.
Corruption amplifies the danger. A 2023 Afrobarometer poll showed 82% of South Africans believed corruption had worsened, correlating with the country’s greylist status. When public officials are complicit, enforcement gaps allow illicit crypto flows to slip through even sophisticated monitoring tools.
Future Outlook: Travel Rule, DeFi and CBDCs
The FATF is already drafting a crypto‑specific amendment to the Travel Rule, demanding that VASPs share originator and beneficiary details even for cross‑border DeFi swaps. Expect tighter data‑format standards (ISO20022) and mandatory real‑time checks for any transaction involving a greylist or blacklisted jurisdiction.
Central Bank Digital Currencies (CBDCs) will also reshape assessments. Countries launching CBDCs are required to embed FATF‑compatible AML modules, meaning a future greylist assessment could factor in how well a state‑run digital currency monitors illicit flows.
In short, compliance will move from “check the list once a year” to “continuous, automated risk scoring” - and the stakes keep climbing.
Frequently Asked Questions
What happens if a crypto exchange processes a transaction with a blacklisted country?
The transaction must be blocked immediately, and a Suspicious Activity Report (SAR) has to be filed with the relevant financial intelligence unit within 24hours. Continuing to process the trade can lead to multi‑million‑dollar fines and loss of the exchange’s banking relationships.
Do greylist countries face the same level of scrutiny as blacklisted ones?
No. Greylist jurisdictions require “increased monitoring,” meaning enhanced KYC and source‑of‑funds checks, plus periodic reporting. Blacklisted countries demand full Enhanced Due Diligence (EDD) and automatic transaction blocking.
How often does the FATF update its lists?
Updates are typically released at the end of each plenary meeting, roughly twice a year. However, emergency additions can be issued any time, as seen with Bolivia and the Virgin Islands (UK) in June2025.
Can a VASP rely on third‑party AML providers to stay compliant?
Yes, but the VASP remains ultimately responsible. Regulators assess the effectiveness of the provider’s screening engine and will audit the VASP’s internal controls if a breach is detected.
What’s the best way to future‑proof compliance against new FATF crypto guidelines?
Adopt a modular compliance stack that can ingest real‑time FATF list feeds, supports ISO20022 messaging for the Travel Rule, and integrates blockchain analytics capable of linking wallet addresses to jurisdictions. Regularly audit the stack against the latest FATF draft recommendations.
Patrick MANCLIÈRE
January 20, 2025 AT 13:43FATF's greylist is more than just a spreadsheet – it shapes how we design KYC flows. Every time a new jurisdiction lands on the list, our monitoring rules need a tweak. I’ve seen swaps stall because the compliance engine missed a greylisted flag. If you integrate the feed directly into the transaction scanner, you avoid those nasty manual catches. Bottom line: treat the list as a live data source, not a yearly report.
Brooklyn O'Neill
January 25, 2025 AT 01:43Totally agree, it’s a live data source.
Carthach Ó Maonaigh
January 29, 2025 AT 13:43Yo, the blacklisted trio is a nightmare for any VASP trying to stay afloat. North Korea is basically a ghost town – any address tied to it gets auto‑frozen. Iran’s crypto scene is booming, but the AML heat makes every transfer a gamble. And Myanmar? It’s on the watchlist for a reason – you don’t want to be the one to slip up. So keep those filters locked tight.
Marie-Pier Horth
February 3, 2025 AT 01:43While the blacklists are indeed high‑risk, the real operational pain lies in keeping up with the greylist churn. Countries like Bolivia and the Virgin Islands just joined, meaning you need fresh source‑of‑funds checks for a whole new batch of users. In practice, that means updating your AML vendor’s rule set, retraining analysts, and re‑testing the whole pipeline. If you miss a single flag, regulators can drop a heavy fine – we’ve seen $5 million fines for incomplete monitoring. My advice: automate the country‑risk tagging and set up daily alerts for any list changes so you’re never caught off guard.
Gregg Woodhouse
February 7, 2025 AT 13:43Got to say the list updates are a pain, but they’re not impossible to handle.
F Yong
February 12, 2025 AT 01:43Honestly, the biggest hurdle is the sheer volume of transactions that suddenly need manual review when a country flips to grey. Your system might be fine for low‑volume firms, but scaling that review process without blowing up costs is the real challenge. Some teams outsource the review, but that introduces latency and privacy concerns. It’s a balancing act between compliance and user experience.
Sara Jane Breault
February 16, 2025 AT 13:43For anyone starting a new crypto exchange, I’d embed the FATF list API right from day one. It saves a ton of retro‑fit work later.
Iva Djukić
February 21, 2025 AT 01:43The importance of embedding the FATF list API into your compliance stack cannot be overstated. First, it guarantees that every incoming transaction is automatically tagged with the correct jurisdiction risk level, eliminating human error at the data entry stage. Second, by pulling updates in real‑time, you avoid the dangerous lag that occurs when teams rely on monthly PDF releases; those PDFs are often outdated by the time you process them. Third, an API-driven approach lets you integrate risk scores directly into your transaction monitoring engine, so flagged transactions can be routed for manual review without manual intervention. Fourth, it enables you to generate compliance reports on demand, satisfying regulator audits that demand proof of continuous monitoring. Fifth, developers can build dashboard widgets that visualize the proportion of grey‑listed versus non‑listed activity, giving senior management a clear risk overview. Sixth, you can set up automated alerts for any jurisdiction that moves onto the greylist, prompting an immediate policy revision. Seventh, many third‑party AML providers already expose list feeds as part of their SaaS offerings, meaning you can often piggyback on an existing subscription rather than building the feed yourself. Eighth, the API typically includes metadata such as the date of designation, which helps you establish a timeline for any compliance investigations. Ninth, by keeping your system’s risk model up to date, you protect your banking relationships, as banks increasingly demand proof that you’re not transacting with high‑risk regions. Tenth, you reduce the risk of hefty fines – the FATF has shown that non‑compliance can lead to penalties in the millions, which could cripple a startup. Eleventh, programmatically linking wallet addresses to country risk enables more granular analytics, like spotting clusters of activity tied to a single grey‑listed jurisdiction. Twelfth, an API can be versioned, ensuring backward compatibility as the FATF refines its classifications. Thirteenth, using a standardized feed simplifies cross‑border collaboration with other VASPs, as everyone references the same source of truth. Fourteenth, it frees compliance analysts to focus on higher‑value tasks, such as investigating suspicious patterns, rather than manually updating spreadsheets. Lastly, embracing an API‑first mindset signals to regulators that your organization takes compliance seriously and is committed to continuous improvement.
Joyce Welu Johnson
February 25, 2025 AT 13:43Great points, especially about the real‑time alerts!
Ally Woods
March 2, 2025 AT 01:43Alerts are cool but don’t forget to train the team on what to do when they fire.
Kristen Rws
March 6, 2025 AT 13:43Nice overview.
Fionnbharr Davies
March 11, 2025 AT 01:43I’d add that keeping documentation of every policy change helps when auditors ask for the evolution of your compliance program.
Narender Kumar
March 15, 2025 AT 13:43Esteemed colleagues, let us consider the gravitas of the FATF’s deliberations. The formal pronouncements, though cloaked in bureaucratic language, exert a profound influence upon the global financial architecture. When a jurisdiction ascends to the greylisted echelon, it is not merely a statistical footnote but a clarion call for heightened vigilance. One must diligently recalibrate KYC protocols, ensuring that each client’s provenance is scrutinized with scholarly rigour. Moreover, the interplay between sovereign regulatory frameworks and the FATF’s guidelines engenders a complex tapestry of compliance obligations. It is incumbent upon us, as custodians of digital asset integrity, to navigate this labyrinth with both prudence and foresight. Accordingly, I propose a systematic audit of all transactional pathways, accompanied by a detailed risk‑assessment matrix.
Michael Ross
March 20, 2025 AT 01:43Agreed – a risk matrix is essential.
Deepak Chauhan
March 24, 2025 AT 13:43Yo, the graylist changes faster than my Wi‑Fi on a rainy day. Keep your monitoring stack on auto‑update, or you’ll get slapped with fines. Also, don’t forget to tell your users why extra KYC is coming – transparency wins.
Aman Wasade
March 29, 2025 AT 01:43Transparency is key, indeed.
bhavin thakkar
April 2, 2025 AT 13:43The crypto world loves to tout decentralization, yet we’re still bound by nation‑state regulations. When FATF adds a country to the greylist, it’s a reminder that geopolitical risk is ever‑present. Every exchange must therefore treat compliance as a dynamic, not a static, process. My experience shows that the moment a jurisdiction flips status, transaction volumes from that region can drop dramatically, often by 30‑40 %. That dip isn’t just a numbers problem; it impacts liquidity, market depth, and ultimately user trust. To mitigate this, I recommend a tiered monitoring approach: start with automated risk scoring, then flag borderline cases for human review. Additionally, maintain a backup compliance vendor so you can switch providers if your current partner lags on list updates. Finally, keep an eye on the political climate – sometimes a country’s domestic policy shift precedes FATF action, giving you a heads‑up. This proactive stance can protect your platform from sudden compliance shocks and preserve your reputation in the ecosystem.
Thiago Rafael
April 7, 2025 AT 01:43Spot on. Proactive monitoring beats panic‑mode reactions every time.
dennis shiner
April 11, 2025 AT 13:43Nice summary, short and sweet.
Krystine Kruchten
April 16, 2025 AT 01:43Thanks! Just trying to keep it clear.
WILMAR MURIEL
April 20, 2025 AT 13:43When I first dealt with the FATF greylist, I thought it was just another compliance checkbox. Turns out, it’s a full‑blown operational overhaul. First, I had to rewrite every KYC form to capture additional source‑of‑funds details for users from greylisted nations. Second, our AML engine needed new rule sets to trigger manual reviews for any transaction involving those jurisdictions. Third, the compliance team set up a daily sync with the FATF’s official CSV feed, which reduced lag from days to minutes. Fourth, we built a reporting dashboard that aggregated monthly flagged transactions, making regulator audits a breeze. Fifth, we trained our support staff to explain the extra steps to customers in a friendly way, which helped preserve user satisfaction. Sixth, we renegotiated contracts with our banking partners, providing them with evidence of our enhanced controls, and they agreed to keep the relationship alive. Seventh, we conducted a tabletop exercise simulating a sudden blacklisting of a major market, which revealed gaps in our incident response plan. Eighth, we added a “risk‑score” column to our user database, allowing us to prioritize high‑risk accounts for deeper investigation. Ninth, we instituted a policy that any change in a country’s status triggers an automatic email to the compliance lead. Tenth, we documented all these processes in a living compliance manual, ensuring new hires can get up to speed quickly. All of these steps together transformed a perceived bureaucratic nuisance into a competitive advantage: our platform gained a reputation for robust compliance, attracting institutional partners who value regulatory certainty.
carol williams
April 25, 2025 AT 01:43Impressive work. The institutional edge you mentioned is a real win.
Maggie Ruland
April 29, 2025 AT 13:43Greylisted countries are just a mild inconvenience.
jit salcedo
May 4, 2025 AT 01:43When you call them an inconvenience, you ignore the hidden complexities of cross‑border crypto flows. The graylist isn’t just a list; it’s an orchestra of political risk, regulatory pressure, and illicit activity vectors. Each jurisdiction brings its own legal nuances, which means your compliance stack must be both flexible and deep. Ignoring those subtleties can lead to massive fines, reputational damage, and even forced shutdowns in extreme cases. So, treat the graylist as a strategic factor, not a peripheral admin task.
Lisa Strauss
May 8, 2025 AT 13:43Stay optimistic – updating your compliance can actually improve user trust.
Darrin Budzak
May 13, 2025 AT 01:43Absolutely! When users see you’re on top of regulations, they feel safer and stay longer.
Patrick MANCLIÈRE
May 17, 2025 AT 13:43Final thought: always keep an eye on FATF’s draft travel‑rule updates; they’ll soon dictate real‑time data sharing for DeFi too.