Jurisdictional Risk Reference

FATF Grey List

21 jurisdictions under increased monitoring as of the February 2026 Plenary (Mexico City). Plus 3 Black List jurisdictions requiring counter-measures. Every VASP compliance team needs this reference.

Timeline Visualization

Grey List Evolution 2010–2026

Hover any jurisdiction to see when it was added and specific VASP implications. Note the October 2026 assessment deadline approaching.

FATF GREY LIST EVOLUTION21 jurisdictions under increased monitoring (Feb 2026 Plenary)201020122014201620182020202220242026SyriaVenezuelaBurkina FasoHaitiSouth SudanMaliDemocratic Republi…MozambiqueCameroonNigeriaSouth AfricaAlgeriaAngolaCôte d'IvoireKenyaNamibiaCroatiaMonacoBulgariaLebanonNepalUAE REMOVEDBYBIT $1.46BOCT 2026 DEADLINEHigh RiskMediumRecent

21 Jurisdictions Under Increased Monitoring

Grey List — February 2026

Jurisdiction Added VASP Implication
AlgeriaOct 2023EDD required for all VASP counterparties
AngolaOct 2023EDD required
BulgariaOct 2024EDD; EU CASP licensing gap
Burkina FasoFeb 2021EDD required
CameroonFeb 2023EDD required
Côte d'IvoireFeb 2024EDD required
CroatiaJun 2024EDD; EU member — MiCA gap
DR CongoOct 2022EDD required
HaitiJun 2021EDD required; high remittance corridor
KenyaFeb 2024EDD required; M-Pesa corridor
LebanonOct 2024EDD required; banking sector stress
MaliFeb 2022EDD required
MonacoJun 2024EDD; high-value client concentration
MozambiqueOct 2022EDD required
NamibiaFeb 2024EDD required
NepalOct 2024EDD required; remittance corridor
NigeriaFeb 2023EDD; highest Africa P2P volume
South AfricaFeb 2023EDD; grey-listed VASP licensing active
South SudanJun 2021EDD required
SyriaFeb 2010Near-prohibition; highest risk
VenezuelaOct 2020EDD; Petro history; sanctions overlap

Highest Risk

FATF Black List — Prohibition Required

The bottom line: Three jurisdictions require counter-measures. No VASP transactions permitted.

  • North Korea — $1.46B ByBit theft (Feb 2026). State-sponsored crypto theft program. Total prohibition.
  • Iran — Counter-measures required. No virtual asset services may be provided.
  • Myanmar — Counter-measures required. Military regime, no AML framework.

Notable Change

UAE Removal — What It Means for Crypto

The big picture: The UAE's removal from the Grey List in 2024 was a watershed moment for the crypto industry.

  • VARA (Dubai) — Virtual Asset Regulatory Authority now seen as a model framework
  • Crypto hub status — Binance, Bybit, and major exchanges relocated or expanded UAE operations
  • For VASPs — UAE-based counterparties no longer trigger automatic EDD requirements