FATF Grey List October 2026: DRC, Monaco, Bulgaria, and Côte d’Ivoire Removed

DRC, Monaco, Bulgaria, and Côte d’Ivoire Removed from FATF Grey List Countries, 30th October 2026

The FATF concluded its October 2026 Plenary in Paris on 30 October 2026. The Democratic Republic of the Congo (DRC), Monaco, Bulgaria, and Côte d’Ivoire were removed from the grey list, bringing the list of jurisdictions under increased monitoring to 18. The FATF blacklist remained unchanged. This page sets out the full country lists and what UAE regulated entities need to update.

Key takeaways: FATF Plenary October 2026

Added to the grey list: None
Removed from the grey list: DRC, Monaco, Bulgaria, and Côte d’Ivoire
Grey list now has 18 jurisdictions (22 before the October 2026 Plenary)
Blacklist (call for action): No change
First Plenary under UK President Giles Thomson (term 1 July 2026 to 30 June 2028)
Additional risk signals: the FATF expressed concern about Vietnam’s pace of progress and warned that Myanmar could face countermeasures if progress remains insufficient by February 2027. Neither statement changes the October country counts.
Next scheduled plenary and working-group meetings: 22–26 February 2027

Outcome of the FATF Plenary, October 2026

The FATF removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco from its grey list on 30 October 2026. No countries were added. The number of jurisdictions under increased monitoring fell from 22 to 18. The FATF’s separate call-for-action list remains Iran, North Korea and Myanmar.

The FATF announced the changes at its Plenary in Paris from 28 to 30 October 2026. For UAE-regulated entities, the immediate task is to check whether the removals affect existing geographic risk ratings, customer due diligence, and internal country-risk controls. Removal from the grey list does not mean you must classify every related customer as low risk.

What changed on the FATF grey list in October 2026

The October 2026 Plenary removed four jurisdictions from the grey list: DRC, Monaco, Bulgaria, and Côte d’Ivoire. No jurisdictions were added.

Countries added to the FATF grey list on 30 October 2026

None

Countries removed from the FATF grey list on 30 October 2026

DRC, Monaco, Bulgaria, and Côte d’Ivoire completed their action plans within the agreed timeframe, and on-site visits confirmed the reforms are being implemented. They will continue to work with their FATF-style regional bodies to strengthen their AML/CFT/CPF regimes.

FATF grey list countries in full, as of 30 October 2026

The FATF grey list (officially, “Jurisdictions under Increased Monitoring”) now contains 18 jurisdictions:

1. Angola
2. Bolivia
3. Bosnia and Herzegovina
4. Cameroon
5. Haiti
6. Iraq
7. Kenya
8. Kuwait
9. Lao People’s Democratic Republic

10. Lebanon
11. Nepal
12. Papua New Guinea
13. South Sudan
14. Syria
15. Venezuela
16. Vietnam
17. Virgin Islands (UK)
18. Yemen

FATF blacklist countries in full, as of 30 October 2026

The FATF blacklist (officially, “High-Risk Jurisdictions subject to a Call for Action”) lists jurisdictions with serious strategic deficiencies:

Iran and DPRK: the FATF calls on members to apply countermeasures.
Myanmar: the FATF calls for enhanced due diligence proportionate to the risk, without disrupting humanitarian aid or remittance flows.

What the grey list and blacklist mean for UAE firms

	Grey list	Blacklist
Official name	Jurisdictions under Increased Monitoring	High-Risk Jurisdictions subject to a Call for Action
Status	Cooperating with the FATF on an action plan	Serious, unresolved strategic deficiencies
UAE expectation	Apply proportionate EDD where Article 23 of Cabinet Resolution No. 134 of 2025 applies, together with any National Committee or supervisory requirements	Apply proportionate EDD for Myanmar and countermeasures for Iran and DPRK, together with any additional UAE National Committee or supervisory requirements
goAML reporting	Submit STR/SAR where suspicion or reasonable grounds for suspicion exist; assess any additional HRC/HRCA duties under current UAE requirements.	Apply HRC/HRCA requirements for the relevant UAE-designated jurisdictions and in-scope transactions or activities, alongside STR/SAR duties where applicable

Grey-listing is not a sanction, and FATF does not itself call for enhanced due diligence solely because a jurisdiction is grey-listed. UAE-regulated entities must still comply with Article 23 of Cabinet Resolution No. 134 of 2025, which requires proportionate enhanced customer due diligence for relevant relationships or transactions involving persons from countries identified by the National Committee as high-risk or from countries with AML/CFT/CPF deficiencies. Additional National Committee and supervisory measures also apply.

What else did the FATF decide at the October 2026 plenary?

The October plenary was about more than country listings. Under the UK Presidency of Giles Thomson, FATF advanced work on virtual assets, fraud and scam compounds, a more proportionate risk-based approach, and country assessments. These developments matter for UAE financial institutions, DNFBPs and VASPs, but none of the initiatives below should be described as a new UAE legal obligation merely because FATF announced it.

What is changing for virtual assets and VASPs?

FATF agreed to a targeted review and accelerated follow-up for jurisdictions with materially important virtual asset activity. The review will assess implementation gaps against FATF standards for virtual assets and virtual asset service providers. FATF expects to publish initial results in June 2027 and further results in October 2027. UAE VASPs and other regulated firms with virtual asset exposure should monitor developments and review their existing risk assessments, travel-rule controls, counterparty checks and relevant legal requirements. The plenary announcement itself does not impose a new universal deadline on individual UAE VASPs.

Why did fraud and scam compounds receive special attention?

FATF approved a report examining illicit financial flows linked to scam compounds and the criminal networks supporting them. As of 31 October 2026, FATF announced it would publish the report the following week; it should not yet be described as a published final report. The practical lesson is to examine networks, payment routes, intermediaries, and virtual asset exposure rather than looking only for individual suspicious transactions. Any alert decisions and reporting must still follow applicable UAE rules.

What changed in mutual evaluations and the risk-based approach?

FATF adopted new-round mutual evaluation reports for Mexico and the United States, with publication expected in December 2026 after quality and consistency review. These assessments will be accompanied by time-bound roadmaps for key recommended actions. FATF also agreed to more tailored assessments for certain low-capacity countries and further work on improving risk-based supervision and resource prioritisation. A FATF forum on these issues is scheduled for 1–2 December 2026. These are forward-looking initiatives, not revisions to the October grey list.

Other plenary context: Barbados, Namibia and Thailand participated under the Guest Initiative. FATF confirmed that Russia’s membership suspension remains in place. Source: FATF, Outcomes of the Plenary, 28–30 October 2026

Did every grey-listed jurisdiction provide an updated report in October?

No. FATF said Bosnia and Herzegovina, Haiti, Iraq, and Yemen did not submit progress updates for this cycle, so it carried forward their previously published statements. This does not, by itself, establish that their position improved or deteriorated. It means the public wording for those four jurisdictions may not reflect every development since the previous statement. Compliance teams should distinguish a carried-forward statement from a newly reviewed country update.

Why were the four countries removed?

FATF confirmed that each jurisdiction made sufficient progress in addressing its agreed action plan and that successful on-site visits supported the decision to end increased monitoring. The jurisdictions will continue working with their FATF-style regional bodies to sustain improvements.

Country-by-country reasons below are drawn from FATF’s 30 October 2026 jurisdiction statements. All four jurisdictions completed their agreed action plans and passed on-site visits. These were verified AML/CFT/CPF improvements, not declarations that financial crime risk had disappeared.

Why was Bulgaria removed from the FATF grey list?

Bulgaria was removed on 30 October 2026 after completing the FATF action plan it had agreed to following its October 2023 grey-listing. A successful on-site visit confirmed progress in implementing the reforms.

FATF recognised implementation of Bulgaria’s national AML/CFT strategy, risk-based supervision of postal money operators, currency exchange providers and real estate agents, and stronger market-entry controls for virtual asset service providers. Bulgaria also improved the accuracy of beneficial ownership information, automated prioritisation of suspicious transaction reports, money laundering investigations involving corruption and organised crime, asset confiscation, and terrorist- and proliferation-financing sanctions controls.

Why was Côte d’Ivoire (Ivory Coast) removed from the FATF grey list?

Côte d’Ivoire was removed on 30 October 2026 after completing the action plan agreed when it entered increased monitoring in October 2024. FATF confirmed successful on-site verification of its progress.

The country improved international cooperation in money laundering and terrorist financing cases, introduced stronger risk-based supervision of financial institutions and designated non-financial businesses and professions, and improved verification and access to beneficial ownership information. FATF also recognised more effective use of financial intelligence, a sustained increase in relevant investigations and prosecutions, and improvements to targeted financial sanctions.

Why was the Democratic Republic of the Congo (DR Congo) removed from the FATF grey list?

The Democratic Republic of the Congo (DRC) left the grey list on 30 October 2026 after completing the action plan that followed its October 2022 listing and passing FATF’s on-site assessment.

The DRC finalised its national money laundering and terrorist financing risk assessment and adopted a national AML/CFT strategy. It designated supervisors across DNFBP sectors, developed a risk-based supervision plan, increased the resources and analytical capabilities of its financial intelligence unit, strengthened investigative and prosecutorial capacity, and demonstrated effective implementation of targeted financial sanctions relating to terrorist and proliferation financing.

Why was Monaco removed from the FATF grey list?

Monaco was removed on 30 October 2026 after completing its action plan following its June 2024 grey-listing. FATF’s successful on-site visit confirmed the progress of its AML/CFT reforms.

FATF recognised Monaco’s stronger understanding of money laundering risks linked to foreign tax fraud, increased requests to overseas authorities to identify and seize criminal assets, and tougher enforcement of AML/CFT and beneficial ownership requirements. Monaco also strengthened its financial intelligence unit, improved the quality and timeliness of suspicious transaction reporting, increased judicial and prosecution resources, and expanded the seizure of suspected criminal property.

How did FATF verify that the four countries were ready for removal?

FATF did not remove the countries simply because they passed new legislation. Its process first evaluates whether countries have completed all or nearly all action-plan commitments, then uses an on-site review to confirm that reforms are being implemented and that political commitment and institutional capacity exist to sustain them. FATF confirmed that successful on-site visits preceded the four October 2026 removals.

This distinction matters. An improved law is an important step, but effective AML supervision also depends on operational evidence: usable financial intelligence, investigations, sanctions implementation, beneficial ownership information and appropriate enforcement. The four countries completed different action plans, so their reforms should not be described as identical.

Source:

What can other countries learn from the four successful action plans?

A comparison of the FATF findings reveals five recurring features, although not every item was present in every country: risk-based supervision that reaches the relevant professions and firms; beneficial ownership information that authorities can access and verify; financial intelligence that is used, not just collected; financial-crime investigations and confiscation activity; and implementation of targeted financial sanctions.

For example, Bulgaria improved automated prioritisation of suspicious transaction reports and controls over certain regulated sectors. Côte d’Ivoire strengthened international cooperation, beneficial ownership verification and the use of FIU intelligence. The DRC designated DNFBP supervisors, adopted a risk-based supervisory plan and strengthened FIU capacity. Monaco improved outbound asset-recovery requests, STR reporting and the resources available to investigators and prosecutors. FATF recognised these improvements in its individual removal statements.

AML UAE interpretation: a practical reform programme needs an evidence trail linking legal changes to supervisory inspections, access to ownership records, FIU analysis, investigations and actual outcomes. This is an analytical lesson drawn from the FATF statements, not a new FATF requirement or a ranking of the four countries.

How long were Bulgaria, Côte d’Ivoire, the DRC and Monaco on the FATF grey list?

The countries entered increased monitoring in different plenary cycles and therefore followed different reform timetables. The durations below are approximate elapsed months between the relevant listing and removal announcements, not a FATF assessment of relative performance.

Jurisdiction	First monitored	Removed	Approx. period
Bulgaria	October 2023	30 October 2026	36 months
Côte d’Ivoire	October 2024	30 October 2026	24 months
DR Congo	October 2022	30 October 2026	48 months
Monaco	June 2024	30 October 2026	28 months

A shorter period on the grey list does not necessarily mean a country implemented stronger controls or faced less serious weaknesses. Its starting deficiencies, action-plan commitments, institutional context and assessment timetable all differ.

Source: FATF October 2026 delisting statements

What does delisting mean for customers, banks and businesses in these four countries?

Removal ends FATF-increased monitoring. It may support a reassessment of country-related risk and compliance processes, but it does not automatically remove existing customer due diligence, sanctions screening, or other obligations. Financial institutions should still consider the individual customer, transaction, sector, exposure, and applicable local rules.

Does removal make international transfers, banking or trade easier?

Removal ends FATF’s increased monitoring of the country and may prompt banks, correspondent institutions, trade counterparties, and compliance teams to review their country-risk settings. Whether a particular payment, account opening, or transaction becomes easier depends on the institution and the full relationship risk. FATF does not require banks to lower fees, approve transfers, or relax controls after delisting.

A person or business based in one of the four removed jurisdictions may still face source-of-funds questions, beneficial ownership checks, sanctions screening, adverse media reviews, or higher-risk treatment for unrelated reasons. The same applies to transactions involving another high-risk jurisdiction. Readers should therefore distinguish a country-level regulatory development from a decision about their own account or transfer.

What does FATF delisting not change?

It does not remove any UN, UAE, or other applicable sanctions restrictions.
It does not automatically reduce a customer, shareholder, supplier, or payment to low risk.
It does not guarantee access to a bank account, correspondent banking service, investment product or international payment channel.
It does not mean the country no longer has any money laundering or terrorist financing risks. The relevant regional body continues its follow-up work.
It does not cancel a UAE-regulated entity’s risk-based CDD, EDD, transaction monitoring, or reporting duties.

What remains to be done after the four countries leave increased monitoring?

Bulgaria and Monaco will continue working with MONEYVAL; Côte d’Ivoire with GIABA; and the DRC with GABAC and ESAAMLG. FATF expressly called on the countries to sustain improvements. Delisting is therefore a milestone in the monitoring process, not the end of AML/CFT/CPF oversight.

For organisations monitoring these countries, useful developments to follow include subsequent mutual evaluation or follow-up reports, supervisory enforcement, beneficial ownership data quality, financial-intelligence outcomes and changes to national or international sanctions requirements. These indicators are more informative than repeatedly treating the original FATF status as the only country-risk factor.

What warning did FATF issue to Vietnam in October 2026?

Vietnam remains on the grey list. FATF expressed significant concern about the pace of progress on Vietnam’s action plan and said it would consider next steps if Vietnam does not make tangible improvements by the next plenary. That is a warning, not an announcement that Vietnam has been moved to the blacklist. Firms should monitor FATF’s subsequent decisions and assess Vietnam-linked exposures under their existing country-risk and supervisory requirements.

Did the FATF blacklist change in October 2026?

No. Iran and North Korea remain subject to the FATF’s call for countermeasures. Myanmar remains subject to a call for enhanced due diligence measures proportionate to the risks, rather than countermeasures. FATF reiterated concerns about Myanmar’s fraud and cyber-scam risks and warned it could face countermeasures if its progress is insufficient by February 2027.

UAE AML compliance: what regulated entities should do now

Under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, financial institutions, DNFBPs and VASPs must keep their risk assessments current and apply measures proportionate to geographic risk. After this update:

Update your Enterprise-Wide Risk Assessment (EWRA) so the geographic risk factor reflects the removal of DRC, Monaco, Bulgaria, and Côte d’Ivoire.
Revise your high-risk country list in your AML/CFT policy and customer risk assessment methodology, and record the date of change.
Re-rate affected customers. Identify customers, UBOs, counterparties and transactions linked to the delisted countries and refresh their risk rating, reviewing whether enhanced measures are still justified.
Recalibrate screening and transaction monitoring rules, thresholds and country lists so alerts fire correctly from day one.
Check goAML reporting triggers. Consult the current UAE FIU, National Committee and applicable supervisory requirements to determine whether HRC/HRCA reporting and any transaction-holding period apply. Submit STRs/SARs when suspicion or reasonable grounds for suspicion arise.
Brief staff and senior management through targeted training and a documented board or MLRO update.

Does the FATF grey list affect UAE customer onboarding?

Yes, but not as a blanket ban. Firms should assess the customer’s geographic exposure and apply the EDD required by Article 23 of Cabinet Resolution No. 134 of 2025 and any relevant National Committee or supervisory requirements. FATF does not call for cutting off entire classes of customers solely because of grey-list status. For delisted countries, review the remaining legal requirements and customer-specific risks before changing enhanced measures; removal from the FATF list does not automatically remove them.

Does the October 2026 delisting change EDD for customers linked to the four countries?

FATF states that it does not call for EDD solely because a jurisdiction is grey-listed. For UAE regulated entities, Article 23 of Cabinet Resolution No. 134 of 2025 must also be considered. It requires enhanced customer due diligence proportionate to the risks arising from relevant relationships or transactions involving persons from specified high-risk countries or jurisdictions with AML/CFT/CPF deficiencies. Any additional National Committee or supervisory measures must be respected.

The compliance position therefore depends on the applicable UAE rules, the jurisdiction and the risk presented by the particular customer or transaction. A FATF removal does not cancel separate sanctions restrictions or other country risk indicators.

What should readers watch after the October 2026 plenary?

Monitor:

The next FATF statement on Vietnam and Myanmar
Any subsequent UAE National Committee or supervisory directions on high-risk jurisdictions
Publication of the scam-compound report
Publication of the targeted VASP review results in June and October 2027, and
Publication of the Mexico and United States mutual evaluations expected in December 2026. These developments have different effective dates and should not be treated as changes to the current 18-country grey list.

FATF’s event calendar currently schedules the next plenary and working-group meetings for 22–26 February 2027. This is a meeting schedule, not an advance decision on which jurisdictions will be added or removed.

FAQs on the FATF grey list update, October 2026

No countries were added to the FATF grey list at the Plenary that concluded on 30 October 2026.

DRC, Monaco, Bulgaria, and Côte d’Ivoire were removed after completing their FATF action plans and passing on-site visits.

As of 30 October 2026, 18 jurisdictions are under increased monitoring.

Grey-listing is not a sanction, and FATF does not itself require EDD solely because of grey-list status. UAE firms must also apply Article 23 of Cabinet Resolution No. 134 of 2025 and any relevant National Committee or supervisory requirements. Where those rules require EDD, its extent must be proportionate to the risk.

FATF’s next plenary and working-group meetings are scheduled for 22–26 February 2027. Check FATF’s official statements at the conclusion of the meetings for any changes to the lists.

No. A bank, DNFBP, or VASP should review the person’s circumstances and the applicable law. Delisting can change one geographic-risk input, but it does not cancel obligations arising from customer behaviour, ownership complexity, sanctions, higher-risk products or directions of the competent regulator.

No. All three remain subject to a call for action; the applicable FATF responses differ by jurisdiction.

Check the firm’s actual exposure to the four delisted countries, review geographic-risk inputs, and document any resulting changes to customer ratings, policies, and controls before approving implementation.

No. FATF removed Monaco on 30 October 2026. It had been listed since June 2024.

No. FATF removed Bulgaria on 30 October 2026. It had been listed since October 2023.

No. FATF removed it on 30 October 2026. It had been listed since October 2024.

No. FATF removed DRC on 30 October 2026. It had been listed since October 2022.

Yes. FATF said it will consider next steps if Vietnam does not make tangible improvements by the next plenary.

Need support updating your compliance framework for the October 2026 FATF changes?

We assess the impact of the grey list changes on your business and update your EWRA, policies, customer risk methodology and screening settings.

Share via :

goAML Registration Guide – Dubai, UAE

goAML registration guide

Published On: 06/18/2026

Protect your business with reliable and effective AML strategies with AML UAE.

Last Reviewed On: 10/23/2026 | Last Updated On: 10/23/2026

goAML Registration Guide: Key Facts

goAML is the official online reporting platform used by the UAE Financial Intelligence Unit (FIU) to collect and disseminate suspicious financial transactions related to money laundering, terrorism financing, and proliferation financing.
Who must register: Financial Institutions, Designated Non-Financial Businesses and Professions (DNFBPs) and Virtual Assets Service Providers (VASPs)
Purpose: Submitting Suspicious Activity Reports (SAR), Suspicious Transaction Reports (STR), other AML compliance-related filings such as HRC, HRCA, and TFS related filings such as CNMR and PNMR
goAML Registration Cost: Registration on goAML is free of charges
Registration Process: goAML registration is a two-step process
- SACM Registration
- goAML Portal Registration
Regulator: UAE Financial Intelligence Unit
Penalty for goAML reporting failure: Regulated Entities will be subject to fines/penalties and/or imprisonment.

What is goAML in UAE?

goAML is an official reporting platform used by the UAE FIU to collect and disseminate suspicious activity and transaction reports from regulated entities, related to ML/TF or PF.

The goAML is a software application used by the UAE’s Financial Intelligence Unit (FIU) to curb money laundering and terrorist financing. The ownership of goAML lies with the United Nations Office on Drugs and Crime (UNODC). It is one of the UNODC’s strategic responses to money laundering and terrorist financing.

The goAML portal takes care of data collection, management, analytical, document management, workflow, and statistical needs of the UAE’s Financial Intelligence Unit.

goAML is used by the UAE FIU to:

Receive Suspicious Activity and Transaction Reports (SARs/STRs)
Monitor, disseminate, and analyse SARs/STRs filed
Support AML/CFT and CPF investigations
Ensure compliance with UAE AML/CFT/CPF and TFS laws.
Article 46 of the Cabinet Resolution No. 134 of 2025 empowers the UAE FIU to receive reports from regulated entities, including FIs, DNFBPs, and VASPs.

What is goAML registration?

goAML registration is nothing but the registration with the goAML portal maintained by the UAE FIU. Once the entities fulfil AML registration requirements, they get an email from the FIU regarding their successful Anti-Money Laundering registration.

Regulated entities in UAE must perform this anti-money laundering registration to report suspicious activities and transactions to the FIU.

Why should you register on UAE FIU goAML portal?

Is goAML registration mandatory?

No AML/CFT matters can be reported to the FIU or the regulatory authorities without registration on the goAML Portal. To ensure timely reporting of the following reports with the FIU and the concerned supervisory authority, the regulated organizations must register themselves on the goAML Portal:

Suspicious Activity Report (SAR)
Suspicious Transaction Report (STR)
Additional Information File without Transaction (AIF) 
Additional Information File with Transaction/s (AIFT) 
Request for Information without Transactions (RFI) 
Request for Information with Transaction/s (RFIT) 
Dealers in Precious Metals and Stones Report (DPMSR)
Real Estate Activity Report (REAR)
Confirmed Name Match Report (CNMR)
Partial Name Match Report (PNMR)
High-Risk Country Transaction Report (HRC)
High-Risk Country Activity Report (HRCA)

Who should register with goAML system in UAE?

In order to curb financial crimes, some businesses in the UAE are required to perform anti-money laundering registration. goAML Dubai is a state-of-the-art platform utilized by regulated entities in Dubai to fight money laundering and ensure regulatory compliance. The regulated organizations subject to the latest AML regulations in the UAE are required to carry out goAML reporting, including Suspicious Activity Report (SAR) and Suspicious Transaction Report (STR), to the FIU and the regulatory authorities. Accordingly, all the following AML-regulated organizations must register on the UAE FIU’s goAML Portal:

Financial Institutions
Virtual Asset Service Providers (VASPs)
Designated Non-Financial Businesses and Professions (DNFBPs)
- Dealers in Precious Metals and Stones
- Real Estate Agents and Brokers
- Trust and Corporate Service Providers
- Lawyers, Notaries, and independent legal professionals
- Independent Accountants and Auditors

UAE goAML Registration Deadline

For the regulated organization that existed as on 31st March 2021, the deadline prescribed by the Ministry of Economy for the UAE FIU registration on the goAML portal was 31st March 2021. The date was later extended to 30th April 2021.

The regulated organisations which did not register then as per the deadline mentioned above can still register with the goAML UAE.

The companies newly incorporated in the UAE post the given deadline must register on the goAML system in UAE once they receive their Commercial or Trade License.

What are the documents required for goAML registration in UAE?

The following documents are required for goAML registration in UAE:

The organisation’s Authorisation Letter (Click to download goAML Registration Authorisation Letter template) in favour of the designated AML/CFT Compliance Officer
A copy of the passport, resident visa, and Emirates ID of the Compliance Officer
A copy of the organization’s commercial or trade license

In addition to the documents, the organization must also download the ‘Google Authenticator’ application on the mobile of the registered contact number.

How much does it cost to register for goAML?

The goAML registration does not involve any charges, and it is free for all DNFBPs, VASPs, and Financial Institutions.

UAE goAML Registration Type

The goAML Portal offers three types of goAML registration, as prescribed by the UAE’s Financial Intelligence Unit:

Reporting Entity
Stakeholder
Supervisory Body

Financial Institutions (FIs), VASPs, and DNFBPs must register on the goAML Portal with Registration Type “Reporting Entities”.

What are the steps to register on the goAML Portal in UAE?

Regulated Entities must adhere to the steps enumerated in the goAML System Registration Guide published by the Ministry of Economy and Tourism.

The goAML registration is a two-stage process enabling you to obtain the goAML login in UAE:

Stage 1: Register in the Service Access Control Manager (SACM) system of the UAE FIU to get Username and the Secret Key for accessing Google Authenticator.

Stage 2: Registration on the UAE FIU’s  goAML Portal, furnishing information about the organization and the Compliance Officer.

Stage 1 of goAML Registration: SACM Registration and Obtaining the Secret Key

The first stage is registering the entity to get the username and the SECRET CODE to access the Google Authenticator application on the mobile device.

a. Access https://services.uaefiu.gov.ae/sacm/registration.php and complete this form, attaching the documents mentioned above.

b. goAML Pre-registration Phase Guide – Key considerations to be taken care of while performing SACM Registration:

Mandatory fields marked with (*) must be completed
Select “Registration Type” as Reporting Entity
Appropriate Supervisory Authority must be selected
Under “ID Number/Reg. No.” captures the License Number as mentioned in the Trade License
Phone number and email address must be entered accurately to receive OTPs
Attachment of the supporting documents is allowed as PDF only
The documents to be uploaded – Authorization Letter, Trade/Commercial License, copy of Passport, Emirates ID and Residence Visa – must be merged and uploaded as a single pdf file
Do not forget to TICK the acceptance of the “goAML Portal Service Terms and Conditions” block
Ensure that the e-mail IDs are whitelisted – [email protected] and [email protected]

Upon submission of this form, you will receive an email on the registered email ID, capturing the Email OTP and URL to access the username and the Secret Key for setting up the Google Authenticator application.

The OTP is valid for 24 hours only.

c. Set up Google Authenticator

Install the Google Authenticator application on the mobile, with a contact number registered on the SACM.

Now create an account on the application, capturing the following details:

Capture the Account Name as “goAML Portal”.
Under Your Key field, enter the Secret Key received via email.

Stage 2 of goAML Registration: Completing goAML Registration

Now, complete the goAML registration.

a. SACM Portal Login https://services.uaefiu.gov.ae/goaml/ and log in using the username received post-SACM registration and a 6-digit code on the Google Authenticator as a Password.

b. Upon Sign In, you will be directed to the goAML homepage.

c. Initiate the registration by clicking “Register as a New organization”.

d. goAML Registration Phase Guide – Key considerations to be taken care of while registering on FIU’s goAML Portal:

Select “Registration Type” as Reporting Entity
Mandatory fields marked with (*) must be completed
Accurately furnish organizational details and the details about the Compliance Officer
If you face any issues while registering, you can write to us at [email protected] and in case of any Portal related issue, write to [email protected]

e. Wait for email confirmation about the approval of your registration application, and you will get a unique “Org ID”, which is each organization’s unique goAML identity number.

UAE FIU goAML Registration Approval

The registration applications submitted on UAE the FIU’s goAML Portal are approved by the organization’s Supervisory Authorities in the UAE. Some of the examples of such supervisory authorities include:

Central Bank of the UAE
Ministry of Economy and Tourism
Ministry of Justice
Capital Market Authority
Virtual Assets Regulatory Authority
Dubai Financial Services Authority
Financial Services Regulatory Authority
General Commercial Gaming Regulatory Authority

What should I do if I do not receive an email OTP for my goAML Pre-registration request?

Firstly, confirm whether email ID – [email protected] has been whitelisted by your IT team. Also check your spam or junk emails.

If not received, write an email to [email protected], with a request to resend the email OTP for the purpose of SACM login on the goAML Platform.

What if a business in UAE fails to Register in goAML?

Is goAML registration mandatory?

All Financial Institutions, VASPs and DNFBPs must register on the UAE FIU’s goAML Portal.

The failure to register on goAML Portal is a failure on the part of the regulated organization to implement necessary procedures to detect and “Report” suspicious transactions related to money laundering or terrorism financing.

What is the penalty for failure to register on the goAML portal?

Failure to register on the goAML portal, the FIU’s electronic reporting system, is an administrative violation. The fine is between AED 50,000 and AED 200,000.

This is set out in Cabinet Resolution No. 71 of 2024 (Violation 23), which gives effect to the registration obligation under Article 17(1) of Federal Decree-Law No. 10 of 2025 and Article 20(2) of Cabinet Resolution No. 134 of 2025. The fine can be doubled for repeat violations, and it does not prevent the supervisory authority from imposing further measures such as licence suspension.

Note that registering on goAML is separate from registering on the EOCN sanctions screening system, which carries its own penalty of AED 50,000 to AED 1,000,000.

Anti Money Laundering Registration and Subsequent Access to UAE goAML Portal

How do you log in to the goAML portal in the UAE?

Once registered successfully, you can access the UAE FIU goAML portal for your reporting purposes by navigating to the goAML Login URL: https://services.uaefiu.gov.ae/goaml/

Sign-in to this pop-up using the username received post-SACM registration, and your Password would be the 6-digit code appearing on the Google Authenticator.

How to register as a “Person” on the UAE goAML Registration Portal?

Once the regulated organization is registered on the goAML Portal, new users can be added. For this, the person intending to access the organisation’s goAML Portal must first register on the goAML Portal.

Registration on goAML Portal as a “New User”

Following the below-mentioned steps for registering on the goAML Portal as a new user:

1. The new user must register on the SACM Portal by navigating https://services.uaefiu.gov.ae/sacm/registration.php

2. Upon approval of the SACM application or goAML pre-registration, the user will get an email for Username and Security Key

3. Download the Google Authenticator application on the mobile device and set up the app using Secret Key received

4. Access https://services.uaefiu.gov.ae/goaml/

5. Upon Sign In, you will be directed to the goAML homepage.

6. Initiate the registration by clicking “Register as a New Person”.

7. The application for accessing the goAML Portal as a “new user” will be sent to the Compliance Officer of the organization (an ADMIN user for the organization’s goAML Portal access), who shall approve the new user request.

Key considerations to be taken care of while registering on FIU’s goAML Portal as a “New Person”:

Capture the “Organization ID” accurately to access your organization’s goAML Account
Mandatory fields marked with (*) must be completed

Approval of the “New User” Request by the Compliance Officer on the goAML Portal

Upon accessing goAML Portal, the Compliance Officer will be directed to the homepage.

1. Login https://services.uaefiu.gov.ae/goaml/

2. The Compliance Officer shall navigate the “ADMIN” menu and select “User Request Management” from the dropdown list.

3. The “User Change Request” page shall be displayed, and the Compliance Officer should click “Preview“ to verify the details

4. The Compliance Officer can approve or reject the new use request and may also add the comments for rejection, if any.

5. Upon finalisation of the request by the Compliance Officer, the user will get an email notification on the registered email ID.

Setting Access Rights for Users on the UAE goAML Portal for registered Reporting Entity?

The Compliance Officer of the reporting entity can specify the roles (as ADMIN or as USER) of various users on the goAML Portal, as under:

a. Login https://services.uaefiu.gov.ae/goaml/

b. Navigate the “ADMIN” menu and select “User-Role Management” from the dropdown list.

c. Select the user from the available list and specify the role for the person

The Compliance Officer can also create more roles, apart from ADMIN and USER, if required, by selecting “Role Management” option from the “ADMIN” menu.

Now, the Compliance Officer can add any new roles for the users and specify the corresponding access rights by clicking on “Add a new role for this entity” button.

How to disable an active user on the UAE goAML Portal?

The ADMIN user of the organization’s goAML Account can disable an active use, by clicking on “Disable” icon, as under:

I have forgotten my Password for the UAE goAML Portal. How do I reset it?

The goAML Portal Password can be reset as under:

1. Click on “Forgot Password” button

2. A pop-up will be provided to capture Username and Email ID (registered with goAML Portal)

3. An email shall be received on the registered email ID capturing the link to set a new Password.

I have forgotten my Username for accessing the UAE goAML Portal for 2nd Stage registration. How do I retrieve my FIU UAE goAML Login ID?

To retrieve the forgotten FIU UAE goAML Login Username, write an email to goAML Support Team on [email protected], capturing the following information:

Name of the organization
Organization ID
First and last name as registered on the goAML Portal
Registered Email ID
Emirates ID and Passport Number
Date of Birth
Nationality

Do I get UAE FIU goAML Registration Certificate?

The Financial Institutions, Virtual Asset Service Providers, and Designated Non-Financial Businesses and Professions have to register with the UAE FIU goAML system.

Once registered, the FIU UAE will share an email confirming the approval of the registration.

What is the UAE FIU goAML Contact Number?

goAML helpdesk contact number is: +971 2 6915599.

You may also contact goAML helpdesk by email: [email protected].

How do I update the changes in the organizational details on the UAE goAML Portal?

The Compliance Officer can update the changes in the organizational details as under:

a. Login https://services.uaefiu.gov.ae/goaml/

b. The Compliance Officer shall go to the “My goAML” menu and click on “My Org Details” from the dropdown list.

c. The Compliance Officer can now update the details like –

Organization name and address
Incorporation number
Nature of business activities
Website, Email ID and Contact number
Contact Person

d. Upon submission of the change details, the Supervisory Authority will verify and approve these changes. The Compliance Officer shall get an intimation for the approval by way of email on the registered email ID.

How do I deregister from the UAE FIU goAML Portal?

goAML Deregistration Procedure:

Write an email to [email protected] and cc it to [email protected]
Include the following information in your goAML deregistration email:
- goAML Registration Number
- Entity Name
- Individual Name
- Supervisory Body
- Date of Cancellation of Trade License
Attach your Trade License copy and Clearance Certificate issued by the relevant authority

You should received goAML Deregistration email conformation shortly.

How to access goAML message board?

To access the goAML message board, log in to the goAML portal and select message board from the menu bar. You will be able to see the inbox. Further, the messages can only be exchanged between a registered entity and the FIU.

Five reasons goAML registrations get rejected, and how to avoid them

Across 200-plus advisory engagements, most rejected or delayed registrations trace back to the same handful of avoidable errors:

Reason	What goes wrong	How to avoid it
Wrong registration type	Entity selects Stakeholder instead of Reporting Entity	Always select Reporting Entity for FIs, DNFBPs, and VASPs
Mismatched supervisory authority	The chosen authority does not match the licence	Confirm your supervisor before submitting
Documents not merged	Files uploaded separately and rejected	Merge all documents into a single PDF
Licence number entered in the wrong field	Registration number captured instead of the trade licence number	Enter the licence number exactly as on the trade licence
OTP expired	The 24-hour email OTP lapses before use	Complete the step the same day you receive it

How to change MLRO in goAML?

In order to change MLRO in goAML, the new MLRO needs to register as an individual using the same organisation ID.

The regulator will then approve the newly registered MLRO, and then the new MLRO needs to inform the support team of goAML – [email protected] to deactivate the old MLRO and activate him as the new MLRO.

How AML UAE Can Help with goAML Registration

Navigating goAML registration and AML compliance requirements in UAE can be complex. AML UAE provides end-to-end support to help regulated entities register efficiently and remain compliant with AML/CFT and CPF requirements. AML UAE helps with:

Identifying goAML registration requirements
Preparing and reviewing required documentation
Assisting with SACM and goAML portal registration
Supporting ongoing reporting obligations such as SAR/STR filings
Advising on AML/CFT policies, procedures, and risk assessments

With expert AML consultants for support, businesses in UAE can avoid common goAML registration and reporting errors, reduce delays, and ensure compliance with regulatory requirements.

FIU UAE goAML Registration Step-by-Step Guide

Download UAE goAML registration guide: UAE Financial Intelligence Unit (FIU)

FIU UAE goAML Registration Step-by-Step Guide: Video

UAE’s Financial Intelligence Unit (FIU) launched a new anti-money laundering platform called goAML in UAE with the aim to regulate and control organized financial crimes.

goAML registration is the process that financial institutions and designated non-financial businesses and professions (DNFBPs) must follow to register on the goAML system. It includes registration on the goAML portal’s protection system (SACM) followed by registration on the goAML system.

goAML is an integrated system used to fight against money laundering and terrorism financing. The United Nations Office on Drugs and Crime (UNODC) built this system. All financial institutions and DNFBPs required to comply with AML guidelines are supposed to register on this platform.

To register for anti-money laundering in UAE, relevant entities must register into the FIU goAML system. This system collects data on the SAR, STR, REAR, DPMSR, HRC, HRCA, CNMR, and PNMR submitted by entities.

Visit https://services.uaefiu.gov.ae/ Systems >> GOAML
Login using username received from [email protected] &Google Authenticator Passcode as the password
Login using the username and password created at the time of registering on goAML Portal

In response to money laundering and terrorist financing, the goAML application is available to more than 60 member states of the United Nations Office on Drugs and Crime (UNODC) through their country FIUs.

goAML collects data on suspicious transaction reports, Dealers in Precious Metals and Stones Report (DPMSR) and other reports from country-specific FIUs, evaluates them, disseminates intelligence reports to relevant authorities and exchanges reports or data with other global authorities.

For goAML Login, click on link: https://services.uaefiu.gov.ae/ for goAML login. Then click on Systems, click on goAML, then provide your Username and the Google Authenticator Passcode as the Password. Click Sign In. You will now be redirected to the goAML UAE homepage. Now, click the Login button and provide the Username and Password created at the time of registering on the goAML portal and click login.

UAE Financial Intelligence Unit (FIU) is empowered to receive Suspicious Transactions Reports (STR), Suspicious Activity Reports (SAR), Dealers in Precious Metals and Stones Report (DPMSR), Real Estate Activity Report (REAR) via a portal specifically maintained for the purpose viz., goAML. DNFBPs and FIs in UAE are required to file these reports with goAML UAE.

DNFBPs in UAE have to register with the goAML portal and provide all mandatory information and supporting documents. The FIU UAE will verify this information and send an email notifying the approval of the registration.

1. If you ever forget your UAEFIU goAML login password, hit forget password button as highlighted below:

goAML Forgot Password

2. It will pop up the reset password request window. You need to enter your user name, registered email, CAPTCHA, and hit submit

goAML Reset Password

3. You will receive a link on your registered email which will help you reset your UAE goAML password

goAML Change your password

In order to update organization detail, the registered user needs to login to the UAE FIU goAML portal, go to the My goAML Menu, and then click My Org Details Menu.

Here, the user can update information like business name, licensed activity, incorporation number, email, website, contact person, telephone number, and address.

The supervisory authority will verify the information, and upon approval, an automated confirmation email will be sent to the organization’s registered email.

Registering for goAML in the UAE involves pre-registration on the SACM portal, where documents such as the trade license, the MLRO’s ID, and the authorisation letter are uploaded, after which the email containing the goAML login credentials is received. The goAML website can be logged in to using credentials received from SACM and Google Authenticator, and registration as a new organisation can be completed.

If you are not receiving emails from CBUAE’s goAML system, make sure you have white-listed the emails [email protected] and [email protected].

Yes, delegating your CBUAE FIU goAML reporting responsibilities to third parties is possible. You may outsource goAML reporting responsibilities for STR, SAR, DPMSR, REAR, etc., to external parties, but it is recommended that such parties create an account on the goAML portal before providing such services.

The admin user of the goAML portal should click the change Selected Delegating Organization, provide the Organization ID associated with the delegated party, and submit the request. The supervisory authority will verify the information and approve the change.

Yes, you can. Navigate to My goAML menu and make the required changes. The admin user of your organization must approve the change in email, and then the supervisory authority will verify the information and approve the change.

You need to click the preview button before submitting an STR/SAR/DPMSR/PNMR/CNMR/REAR and then click the print button to print the report.

STR Printing

The CBUAE FIU goAML registration in UAE is approved by the respective regulator or supervisory body.

The goAML Message Board facilitates communication between the FIU UAE and the goAML users. The reporting entities can come to know of the status of their submitted reports immediately through the message board. The FIU also requests its information requirement through the message board. The goAML message board is not specific to a particular user, but it is for the reporting entity as a whole.

The United Nations Office on Drugs and Crime (UNODC) developed the goAML software. It is an integrated system for Financial Intelligence Units to receive, analyse, and distribute Suspicious Transactions Reports (STRs) in an efficient way. The UAE is the first country in the Gulf to adopt this modern STR reporting system.

UNODC is the United Nations Office on Drugs and Crime. You can reach UNODC at https://www.unodc.org/

The goAML portal is maintained by the FIU UAE. For all IT and technical related issues, please send an email to [email protected]

One can contact the FIU UAE on +971 2 6915599, email: [email protected].

One needs to register with the UAE FIU goAML portal. The detailed guide for FIU registration process is available here: https://amluae.com/goaml-registration-guide/

goAML is a communication medium between the reporting entity and the Financial Intelligence Unit (FIU). All the suspicion reports and reporting of designated transactions prescribed under AML/CFT regulations will be reported via the goAML Portal. So to submit these reports, a reporting entity shall initially have to register with the goAML.

Failure to register on the goAML portal, the FIU’s electronic reporting system, is an administrative violation. The fine is between AED 50,000 and AED 200,000.

All FIs, DNFBPs & VASPs must register on the goAML portal and implement the policies and procedures to identify and report any suspicious transactions related to money laundering or terrorism financing.

Share via :

About the Author

Pathik Shah

FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)

Pathik is an ACAMS-certified AML consultant specialising in governance, risk, and compliance for regulated entities in the UAE. He brings over 28 years of experience, with 1,000+ hours of AML training and 200+ advisory engagements across DNFBPs, VASPs, and FIs. He supports businesses in aligning with AML/CFT requirements from the CBUAE, DFSA, MoET, MoJ, VARA, CMA, FSRA, and FATF. Known for translating complex regulations into audit-ready procedures, Pathik enables operational clarity and compliance readiness.

Reach Out to Pathik

FATF Grey List June 2024 – Jamaica and Türkiye removed, Monaco and Venezuela added

FATF Grey List June 2024 - Jamaica and Türkiye removed, Monaco and Venezuela added

Published On: 06/28/2024

Last Reviewed On: 08/18/2026 | Last Updated On: 08/18/2026

FATF Grey List June 2024 - Jamaica and Türkiye removed, Monaco and Venezuela added

On June 28, 2024, Jamaica and Türkiye have been removed from the FATF Grey List, also known as Jurisdiction under Increased Monitoring list, which includes countries that are actively working with the FATF to address strategic deficiencies in their regimes to counter money laundering, terrorist financing and proliferation financing.

At the Financial Action Task Force plenary meeting ending June 28, 2024, Jamaica and Türkiye were confirmed as having successfully completed their action plans to resolve the strategic deficiencies identified earlier during their mutual evaluations within the agreed timeframe and consequently removed from the FATF Grey List.

Changes in Financial Action Task Force (FATF) Grey List

Countries Removed from FATF's Grey List (Jurisdiction Under Increased Monitoring):

Jamaica
Türkiye

Countries Added to FATF's Grey List (Jurisdictions under Increased Monitoring):

Monaco
Venezuela

FATF Grey List as of 28th June 2024

1. Bulgaria
2. Burkina Faso
3. Cameroon
4. Croatia
5. Democratic Republic of the Congo
6. Haiti
7. Kenya
8. Mali
9. Monaco
10. Mozambique
11. Namibia

12. Nigeria
13. Philippines
14. Senegal
15. South Africa
16. South Sudan
17. Syria
18. Tanzania
19. Venezuela
20. Vietnam
21. Yemen

Source: Jurisdictions under Increased Monitoring – June 2024 (fatf-gafi.org)

Our timely and accurate AML consulting services

For your smooth journey towards your goals

Share via :

FATF Tightens Focus on High-Risk Jurisdictions, Eases Burden on Low-Capacity Nations

Published On: 10/18/2024

Last Reviewed On: 08/14/2026 | Last Updated On: 08/14/2026

FATF Tightens Focus on High-Risk Jurisdictions, Eases Burden on Low-Capacity Nations

The Financial Action Task Force (FATF) is a global Anti Money Laundering/Counter Financing of Terrorism and Counter-Proliferation Financing (AML/CFT and CPF) trendsetter. Its primary objectives are to promote the spreading of the AML spirit worldwide, track the implementation of the FATF Recommendations, and review AML/CFT and CPF trends and Money Laundering, Terrorism Financing, and Proliferation Financing (ML/FT & PF) mitigation measures.

The FATF isn’t empowered to impose fines and penalties against countries that function contrary to such assessment parameters. However, the FATF identifies countries and jurisdictions that have strategic deficiencies in their AML/CFT and CPF regime by publishing two watchlists thrice annually.

These watchlists are known as:

“High Risk Jurisdictions Subject to a Call for Action” often referred to as “FATF blacklist”
“Jurisdictions under Increased Monitoring” often referred to as “FATF Grey list”

The International Cooperation Review Group (ICRG) by FATF identifies and reviews grey-listed countries through a mutual evaluation process.

The FATF published “Procedures: For the FATF AML/CFT/CPF Mutual Evaluations, Follow-Up and ICRG,” which sets forth the procedures on basis of which the mutual evaluation process, follow-up, and ICRG process takes place.

The latest update to these procedures makes way risk focused grey listing approach by:

Increasing the Observation Period for Least Developed Countries (LDCs) from 12 months to two years to update the ICRG assessment body on their progress during review.
- Giving more time to address deficiencies prior to being listed
- LDCs with limited financial sectors will not be listed if they do not pose substantial ML/FT & PF risks.
Prioritising the assessment of regulatory shortcomings in higher-income countries and large financial sector jurisdictions, as their deficiencies pose a substantial threat to the international financial system.

These updated procedures help level the playing field when it comes to ICRG review, which determines whether a jurisdiction must be placed on the grey list.

We help you prepare and implement

a robust Anti-Money Laundering Program.

Effective AML consulting services

make your business dealings brighter, smoother, and better

Share via :

Senegal Removed; Lebanon, Algeria, Angola, and Côte d’Ivoire Added: FATF Grey List October 2024 Update

Published On: 10/26/2024

Last Reviewed On: 08/14/2026 | Last Updated On: 08/14/2026

Senegal Removed; Lebanon, Algeria, Angola, and Côte d’Ivoire Added: FATF Grey List October 2024 Update

The Financial Action Task Force (FATF) is a global watchdog on Money Laundering, Terrorism Financing, and Proliferation Financing. It releases a list of Jurisdictions under Increased Monitoring, commonly referred to as the Grey List. The FATF also sets international standards related to the Anti-Money Laundering (AML), Combating the Financing of Terrorism (CFT), and Counter-Proliferation Financing (CPF) regimes.

The Grey List includes countries that are proactively working with the FATF to counter strategic deficiencies in their regulatory framework to combat the threats of ML/TF and PF.

On 25 October 2024, the FATF concluded its October Plenary. In this latest plenary, the FATF removed Senegal from the ‘Grey List’. Senegal’s removal is in recognition of the countries significant progress in improving its AML/CFT/CPF regime.

This plenary also resulted in additions to the ‘Grey List’. The FATF added Algeria, Angola, Côte d’Ivoire, and Lebanon to the ‘Grey List’. These countries are now expected to work with the FATF and address the deficiencies in their AML/CFT/CPF regimes.

This requires modifications to the regulated entity’s internal AML policies and procedures to ensure that adequate Customer Due Diligence measures are applied while engaging with customers from or closely associated with the “FATF-defined Jurisdictions Subject to Increased Monitoring” list, adopting a risk-based approach.

Other updates from this Plenary include:

Adoption of joint FATF GAFILAT mutual evaluation report of Argentina, recognising the improvement Argentina made in its AML/CFT/CPF framework.
Adoption of FATF-MENAFATF assessment of Oman, recognising the positive steps of Oman to improve its AML/CFT/CPF regime with robust technical compliance.
Revision in FATF guidance for National Money Laundering Risk Assessment.
Agreement to release for public consultation proposed revisions to FATF standards, mainly Recommendation 1.
Agreement to strengthen support to regional bodies, for high-quality, consistent evaluations across the global network.
Launching initiative by inviting Senegal and the Cayman Islands to participate actively in the FATF to further engage with the region and acknowledge diverse perspectives.

Changes in Financial Action Task Force (FATF) Grey List

Countries Removed from FATF's Grey List (Jurisdiction Under Increased Monitoring):

Senegal

Countries Added to FATF's Grey List (Jurisdictions under Increased Monitoring):

Algeria
Angola
Côte d’Ivoire
Lebanon

FATF Grey List as of 25th October 2024

1. Algeria
2. Angola
3. Bulgaria
4. Burkina Faso
5. Cameroon
6. Côte d’Ivoire
7. Croatia
8. Democratic Republic of the Congo
9. Haiti
10. Kenya
11. Lebanon
12. Mali

13. Monaco
14. Mozambique
15. Namibia
16. Nigeria
17. Philippines
18. South Africa
19. South Sudan
20. Syria
21. Tanzania
22. Venezuela
23. Vietnam
24. Yemen

Source: Jurisdictions under Increased Monitoring – 25 October 2024

To dive deeper into the FATF Grey List Update History: Refer to FATF Grey List and Blacklist Update History

To learn more about the difference between FATF-blacklisted countries and greylisted countries: Checkout What are FATF Blacklist and Grey list countries?

Wondering How the FATF Blacklist and Grey List
Impact Your AML Compliance?

AML UAE is your trusted partner in ensuring your business keeps pace
with FATF updates in the UAE context

Share via :

Implementation Guide for DNFBPs on Customer Risk Assessment

Published On: 12/20/2024

Last Reviewed On: 08/14/2026 | Last Updated On: 08/14/2026

Implementation Guide for DNFBPs on Customer Risk Assessment

The Ministry of Economy is the supervisory authority for Designated Non-Financial Businesses and Professions (DNFBPs) in UAE. It has published the Guide to help DNFBPs effectively comply with their Anti-Money Laundering (AML), Combatting the Financing of Terrorism (CFT), and Counter-Proliferation Financing (CPF) compliance obligations, specifically the following:

Obligation to consider all risk factors to understand the overall risk of financial crimes and determine the required level of risk mitigation measures to be adopted
Obligation to document the risk assessments, update them on a regular basis, and make them available to the regulatory authorities when requested

In this Update, we will discuss the meaning of CRA, its importance, the risk factors that must be considered for a comprehensive CRA, and the steps for implementing an effective CRA as discussed in the Guide.

The Meaning of Customer Risk Assessment (CRA)

The second segment of the Guide discusses how CRA differs from Institutional Risk Assessment (IRA) or Enterprise risk assessment (EWRA), while the third segment of the Guide discusses the meaning of CRA.

Customer Risk Assessment (CRA) is the process of assessing the Money Laundering (ML), Terrorism Financing (TF), and Proliferation Financing (PF) risks a customer presents. The CRA enables DNFBPs to adopt risk control measures such as Customer Due Diligence (CDD) and ongoing monitoring to mitigate the specific ML/TF and PF risks posed by the customers.

Both CRA and IRA are important parts of the DNFBP’s risk management framework but differ in certain aspects:

Parameter	CRA	IRA
Definition	CRA is the evaluation of ML/TF and PF risks a customer poses to the DNFBP.	IRA or EWRA is the assessment of the overall ML/TF and PF risk exposure of the DNFBP.
Factors to Be Considered	CRA involves considering factors such as customer characteristics, transaction patterns, behavioural analysis, geographic risks, etc.	IRA involves considering internal and external factors such as products, services, transactions, customers, jurisdictions, AML/CFT policies and procedures of the DNFBP, its operational processes, industry-specific risks, etc.
Level	It is conducted at the customer level.	It is conducted at the institutional level.
Purpose	As discussed in the fifth segment of the Guide, the purpose of the CRA is to enable DNFBP to adopt risk mitigation measures that are proportional to the level of ML/TF and PF risks presented by the customers. Therefore, conducting CRA is of immense importance.	The purpose of the IRA is to ensure that the DNFBP can effectively respond to the overall ML/TF and PF risks it faces.

Situations in which Customer Risk Assessment Should Be Conducted

The sixth segment of the Guide discusses the situations in which the CRA is triggered. This includes the following circumstances:

Onboarding of New Clients: CRA should be conducted before the business relationship with a client is created.
Throughout Business Relationships with Clients: CRA should be conducted periodically throughout the business relationship with the clients. The frequency of the CRA can vary according to the customer risk rating.
Change in Customer’s Profile: CRA is triggered whenever there is a change in the Customer’s profile, business relationship with the client changes, the products and services utilised by the client changes, etc.
Change in Risk Factors: CRA should be reconducted whenever there are changes in risk factors due to the National Risk Assessment (NRA) of UAE and the Sectoral Risk Assessments (SRA). This is to ensure that the findings of the NRA and CRA are incorporated into the CRA process.

Other situations that may result in a change in risk factors include amendments in regulations or guidance released by supervisory authorities, finding adverse media related to the Customer, sanctions listing, etc.

Risk Factors to Consider for Customer Risk Assessment

The seventh segment of the Guide discusses the risk factors that should be considered for a comprehensive CRA. A CRA should take into consideration a multiple range of factors to ensure that ML/TF and PF risks posed by the client are detected at an early stage and mitigated through the adoption of appropriate levels of CDD and other risk control measures. It includes the following risk factors:

Customer Related Risks
Geography Related Risks
Product/Services or Transaction-Related Risks
Delivery Channel-Related Risks
Other Applicable Risks

The eighth segment of the Guide discusses the necessity and importance of incorporating the risk factors identified in the NRA and the relevant SRA for a DNFBP.

The ninth segment of the Guide examines the Risk-Based Approach (RBA) and its importance in AML/CFT/CPF compliance. CRA is a facet of the RBA, enabling DNFBPs to categorise customers based on the level of ML/TF and PF risks they pose and adopt risk mitigation measures accordingly. This allows effective allocation of resources by ensuring that more stringent risk control measures are applied for high-risk customers.

For a comprehensive discussion of the factors to be considered for CRA, refer to our infographic here.

Steps for Successful Implementation of Customer Risk Assessment Process

The tenth segment of the Guide discusses the steps of implementing a comprehensive CRA process. Here’s an overview of these essential steps that DNFBPs must incorporate to undertake the CRA process successfully.

Defining Risk Factors:

The first step is to define the risk factors. These risk factors are to be used to assess the ML/TF and PF risks presented by the Customer.

Establishing Risk Levels and Defining Risk Scales and Risk Scores:

This step involves defining a scale for assessing the risk level with respect to each risk factor. For this purpose, risk scores can be utilised.

Creating a Risk Matrix to Represent the Risk Levels:

This step involves the creation of a risk matrix to represent the risk factors, levels, scales, and scores defined in the previous step.

Collecting Relevant Information and Documentation:

After defining their own risk factors and risk scores and creating the risk matrix, the DNFBPs need to use the same information during the CRA process. Therefore, when the Customer is onboarded, the DNFBP needs to collect the relevant information to aid its CRA process. This includes information such as the Customer’s identification documents, business activities, source of funds, information related to the transaction, etc.

Classifying Customers into Risk Categories:

The next step after gathering customer information is using the risk matrix created in Step 3 to categorise the customers in risk categories.

Calculating Customer Risk Scores:

The DNFBP needs to determine the overall risk score to be assigned to the Customer. This can be done in two ways:

Averaging the risk scores assigned to factors
Assigning risk weightage to each factor according to the importance of the factor to the specific DNFBP

Updating Risk Controls Based on Risk Scores:

The purpose of risk categorising customers is to adopt risk control measures that are in proportion to the level of risk that the customer presents. This step involves updating risk control measures as per the risk scores. For example, if the Customer is categorised as belonging to the higher risk category, the DNFBP should adopt suitable risk control measures such as conducting Enhanced Due Diligence, conducting ongoing monitoring of transactions, reporting suspicious activities and transactions, etc.

The Guide provides a detailed list of examples of risk mitigation measures that can be adopted.

Regularly Reviewing and Updating the CRA:

CRA should be regularly reviewed so that any changes in the risk factors are incorporated into the risk matrix.

Documenting the CRA Process:

The entire CRA process should be documented.

Maintaining Audit Trail of all Interactions with the Customer and CRA:

An audit trail must be maintained of all customer interactions, information collected, CRA conducted, risk mitigation measures adopted and its justification, etc.

Implementation Guide for DNFBPs on Customer Risk Assessment: A Summary

The Guide is divided into several segments. Here’s a final summary of the segments for a brief overview:

The first segment introduces the Guide and explains the purpose of conducting a CRA
The second segment discusses the difference between CRA and IRA
The third segment explains the meaning of a CRA
The fourth segment examines the means of high-risk customers and the importance of adopting stringent risk control measures for them
The fifth segment discusses the significance of the CRA process
The sixth segment lays down the situations in which it is necessary to conduct CRA
The seventh segment details the risk factors that must be considered while conducting the CRA
The eighth segment discusses the significance of incorporating the findings of the NRA and SRA for a comprehensive CRA
The ninth segment deliberates upon the implementation of the Risk-Based Approach and its importance in enhancing AML/CFT/CPF controls by focusing resources on higher ML/TF and PF risk areas
The tenth segment lays down a step-by-step approach to implementing the CRA process
The eleventh segment concludes the Guide by reiterating the importance of a comprehensive CRA in mitigating ML/TF and PF risks a DNFBP faces from its customers and meeting AML/CFT/CPF regulatory obligations.

With our AML expert guidance,

Start your AML compliance journey smoothly.

Share via :

MoEc’s Implementation Guide for DNFBPs on Customer Due Diligence (CDD)

Published On: 01/16/2025

Last Reviewed On: 08/13/2026 | Last Updated On: 08/13/2026

MoEc’s Implementation Guide for DNFBPs on Customer Due Diligence (CDD)

The Ministry of Economy (MoEc) has issued guidelines on Customer Due Diligence for DNFBPs in collaboration with the DNFBP’s Working Group under the Public and Private Partnership Committee. The standards set by the Financial Action Task Force (FATF), along with the industry’s best practices, are incorporated into these guidelines, providing a flexible approach for DNFBPs to meet their statutory obligations within the legal and regulatory environment.

The purpose of the MoEc’s Implementation Guide for DNFBPs on Customer Due Diligence (CDD) is to assist DNFBPs in tackling day-to-day compliance challenges and provide practical guidance in line with international best practices. Here is the summary of the key areas covered in the guideline.

What is Customer Due Diligence (CDD)?

Customer Due Diligence is a process employed by DNFBPs to understand the client profile. It includes measures like client identification and verification, understanding the purpose of business relationships, monitoring transactions, and keeping customer information up-to-date to counter financial crimes.

When do Business Need to Perform CDD?

CDD should be conducted in situations like:

Before starting a business relationship with a customer or during the process of starting a business relationship with a customer, opening an account or conducting transactions.
When the customer is making occasional transactions over AED 55,000, even if split into smaller amounts but seem connected or a transaction made in a single stretch.
Regardless of the stated exemption or threshold, if there’s any suspicion as to money laundering or terrorist financing.
When there are doubts about the veracity or adequacy of the previously provided customer information.

DNFBPs Customer Due Diligence Measures

For All Customers

DNFBPs should confirm and verify the identity of every customer, whether they are individuals, businesses or legal arrangements, through reliable and independent sources.
There must be proper authorisation and identity verification of the person acting on behalf of a customer.
Avoid dealings with any company that lacks genuine transparency or operates like a shell company.
Businesses must recognise and verify the identity of the beneficial owners, those with a significant stake (25% ownership or more) or effective control over the entity.
Gather information and understand the nature and purpose of the customer’s business relationship in order to understand its legitimacy.
Regularly review transactions and KYC information to check if they fit with the customer’s declared activities and risk profile.
Keep customer records updated, especially for customers categorised as high-risk.

For Legal Persons and Legal Arrangements

DNFBPs should understand the ownership and control structure of the customer and determine the nature of the business.
Identify and verify the information of the customer through:
- Details such as name, legal form, Memorandum of Association, office address
- Articles of Association recognised by relevant state authorities
- Names of the people in the senior management

Measures to Identify and Verify Beneficial Owners of the Customers

For Customers that are Legal Persons

Inquire whether any individual holds ownership interest, 25% or more of the company (directly or indirectly).
If it is unclear who is in control, identify individuals who manage or control the company in other ways, like decision-making authorities.
If no natural person can be identified, identify the senior managing official in power.
In the case of a listed company on a stock exchange subject to disclosure requirements or a majorly-owned subsidiary of such a company, the relevant identification data of the shareholders and beneficial owners can be obtained from a public register or the customer or other reliable sources.

For Customers that are Legal Arrangements

The settlor (person who creates the trust), the trustee(s) (person managing the trust), protector (if any), beneficiaries (people benefiting from the trust) or any other natural person with control in case of a trust.
Individuals holding similar positions in other types of legal arrangements.

Timing of Verification

DNFBPs must verify the information of their customers in the early phases of the business relationship, during or before the process of setting up business relationships with the customers. For occasional customers and in some cases if allowed, the verification of the customer identity may be completed after establishing the business relationship provided that:

it is done as soon as possible
it is necessary to avoid disrupting normal business operations.
money laundering and terrorist financing risks are effectively managed.

In the above cases, DNFBPs are required to implement risk management procedures to ensure that they counter ML/TF risks effectively. These measures can include:

Limitation on the number, types, and/or amount of transactions that can be performed
Monitoring of large or complex transactions which do not align with the type of business relationship

CDD for Existing Customers

For existing customers, DNFBPs must review and apply CDD measures depending on the importance of the business relationship and the risk level of the situation. It is important to consider whether the CDD has been conducted in the past and whether the information is still relevant.

When CDD Cannot Be Completed

If a DNFBP is not able to successfully complete the Customer Due Diligence process:

The DNFBP must refuse to start the business relationship or process a transaction.
The business relationship must be terminated if the business relationship has started.
The DNFBP needs to consider submitting a Suspicious Transaction Report (STR).

Avoid “Tipping Off” the Customer

DNFBPs and their staff should refrain from revealing information to anyone if they are filing a Suspicious Transaction Report (STR) with the Financial Intelligence Unit (FIU). In some cases where the DNFBPs suspect ML/TF but asking the customer for additional information will alert them, they are allowed to skip the due diligence process. Instead, they can directly file an STR with the authorities.

Reliance on CDD Measures Already Undertaken

A customer’s identity is not required to be verified for every transaction if their identity has already been verified. However, if there are concerns about the definiteness of the customer’s information, like the transactions do not match the customers’ business profile or there is a sudden increase in the volume of transactions, DNFBPs should reassess the provided information.

Ongoing Customer Due Diligence

Ongoing CDD means continuously monitoring and reviewing customer relationships to comply with regulations and reduce the risk of money laundering, fraud, and other financial crimes. The ongoing customer due diligence transaction process involves:

Continuous Monitoring: Inspecting the transactions and activities of the customer on a regular basis to recognise any unusual or suspicious patterns.
Updating Customer Information: Reexamining and updating customers’ details for any changes to be displayed on their risk profile.
Customer Risk Assessment: Evaluating each customer’s risk level based on their behaviour, transactions, and their geographic location.
Enhanced Due Diligence: Extra precautions when there are high-risk customers and performing strict checks, like taking extra documents or closely examining their transactions.
Training Staff: It is important that the employees know the importance of ongoing CDD and are trained to observe warning signs.
Regulatory Reporting: Following legal rules to report suspicious activities to the authorities.

The frequency of the ongoing monitoring needs to be decided based on the level of risks associated with the customer. High-risk customers need to undergo reviews more often than low-risk customers.

Record-Keeping Requirements

DNFBPs operating in the UAE must keep CDD records, whether physically or digitally, for at least five years after their business relationship with a customer ends.

Records can include identification documents, sanctions screening evidence, business records showing correspondence between the business and customer, and analysis records for background checks in the case of unusual or large transactions are also required to be maintained.

These records are required to keep domestic and international records and details of the customer transactions for the firm to respond to the request from government or regulatory bodies, and these records should be detailed enough to trace any specific transaction to use as evidence for charging somebody of criminal activity.

Guidelines for Record Keeping

The documents collected for customer verification must be from dependable and independent sources, and the information should be current at the time it is obtained. The most dependable documents are those that are hard to forge or obtain illegally, like government-issued IDs and passports, reports from independent business or company registries, audited annual reports and other sources.
All the documents must be clear and readable with a photo identity.
For a copy of documents, they must be verified against the original by an authorised staff member. For the cases where the original document is not available, the copy of the document should be notarised by a notary, lawyer or a qualified professional.
A staff member should provide a summary of the foreign language documents in the familiar language. It is the responsibility of the firm to ensure that they understand the nature and content of the document. The firm can also hire a professional translator to ensure that the document is properly understood.

Simplified CDD

DNFBPs use a risk-based approach to determine the level of Customer Due Diligence required, which means the intensity of the assessments depends on the level of money laundering or terrorism financing risks associated with a customer or transaction. Simplified Due Diligence is only acceptable when the risks are identified as lower based on thorough risk analysis.

When is Simplified Due Diligence Required?

Simplified CDD is allowed when:

A customer is assessed as low-risk after a proper risk analysis.
There is no indication from the customer suggesting money laundering or terrorism financing.
The transactions carried out by the customers are low in value and fit with the customer’s profile.

Simplified CDD measures can not be undertaken when there is a suspicion as to ML/TF or where the associated risks are high.

Enhanced Due Diligence

Enhanced Due Diligence takes into account rigorous inspections, detailed evaluations, and closely monitored activities related to customers that are considered high-risk when the customer or beneficial owner of the customer is a PEP or associated with a PEP.

When is Enhanced Customer Due Diligence Required?

Enhanced Due Diligence is required in situations when a business relationship or transaction suggests a higher risk of money laundering or terrorist financing. These risks can arise from customers’ geographic location, their business activities, or their association with PEPs.

When a customer is identified as high-risk, the intensity and nature of the examination increase to assess whether the transactions or activities are suspicious.

When the Enhanced CDD process is complete for high-risk customers, the senior management is involved in deciding whether to start or continue doing business with them.

For high-risk customers, as a part of the EDD process, the DNFBPs are required to:

Obtain additional information on the customer and beneficial owners
Carry out more frequent CDD measures, and transaction reviews based on the patterns identified and increase the number and timing of controls applied.
Obtain additional information on the intended nature of the business relationship
Verifying Source of Funds and Source of Wealth (Particularly for foreign PEPs)
Obtaining approval of the senior management to commence or continue the business relationship

Summing Up: Implementation Guide DNFBPs on Customer Due Diligence

Customer Due Diligence can be a complex process, but businesses can handle CDD efficiently with the right tools and strategies. MoEc’s Implementation Guidance for DNFBPs on Customer Due Diligence (CDD) provides practical and actionable guidance to DNFBPs in implementing an effective CDD process to counter ML/TF risks effectively.

With our AML expert guidance,

Start your AML compliance journey smoothly.

Share via :

Philippines Removed; Laos and Nepal Added: FATF Grey List February 2025 Update

Published On: 02/21/2025

Last Reviewed On: 08/13/2026 | Last Updated On: 08/13/2026

Philippines Removed; Laos and Nepal Added: FATF Grey List February 2025 Update

On 21st February 2025, the Financial Action Task Force (FATF) concluded its February Plenary. During this Plenary, Philippines was removed, and Laos and Nepal were added to the FATF’s Grey List.

FATF is a global leader in efforts against financial crimes such as Money Laundering (ML), Terrorism Financing (TF), and Proliferation Financing (PF). FATF conducts extensive research on these financial crimes and sets international standards on Anti-Money Laundering (AML), Combatting the Financing of Terrorism (CFT), and Counter Proliferation Financing (CPF). Its primary mandate is to lead and encourage international efforts for the mitigation of ML/TF and PF.

FATF releases a list of “Jurisdictions under Increased Monitoring” colloquially known as the FATF Grey List. This is a list of countries with strategic deficiencies in their AML/CFT/CPF regimes who are actively working with the FATF to address these deficiencies.

To know about the FATF Grey List Update History, check out our blog here.

To understand the differences between FATF Grey List and Blacklist, read our blog here.

Here are the changes FATF made to its Grey List after its latest Plenary:

Updates Made to the Financial Action Task Force (FATF) Grey List in February 2025

Countries Removed from FATF's Grey List (Jurisdiction Under Increased Monitoring):

Philippines

Countries Added to FATF's Grey List (Jurisdictions under Increased Monitoring):

Laos
Nepal

The FATF Grey List as of 21st February 2025

1. Algeria
2. Angola
3. Bulgaria
4. Burkina Faso
5. Cameroon
6. Côte d’Ivoire
7. Croatia
8. Democratic Republic of Congo
9. Haiti
10. Kenya
11. Laos
12. Lebanon
13. Mali

14. Monaco
15. Mozambique
16. Namibia
17. Nepal
18. Nigeria
19. South Africa
20. South Sudan
21. Syria
22. Tanzania
23. Venezuela
24. Vietnam
25. Yemen

Significant Updates to the FATF Grey List for Regulated Entities in UAE

When FATF updates its Grey List, it triggers the necessity for revision and changes in a Regulated Entity’s AML/CFT/CPF compliance program. UAE’s AML/CFT/CPF laws require Regulated Entities to take into account FATF’s Grey List while implementing their AML/CFT/CPF Programs. Regulated entities need to adopt a risk-based approach while engaging with customers from FATF Grey List countries and implement ML/TF and PF risk control measures based on the level of financial crime risks posed by the customer.

Specifically, the FATF Grey List triggers changes in the following components of a regulated entity’s AML/CFT/CPF Program:

Enterprise-Wide Risk Assessment (EWRA)
AML/CFT/CPF Policies, Procedures, and Controls
Customer Due Diligence (CDD) measures for customers from FATF Grey List countries
Configuration of AML software

To know more about how the FATF Grey List update triggers changes in a regulated entity’s AML/CFT/CPF compliance process, read our extensive blog on “Impact of FATF Grey List Update on UAE DNFBPs: AML/CFT Compliance Imperatives”

Don’t Let FATF’s Grey List Update
Catch You Off Guard

AML UAE helps you decode the FATF changes with expert AML services

Share via :

Croatia, Mali, and Tanzania Removed; Bolivia and Virgin Islands (UK) Added: FATF Grey List June 2025 Update

Published On: 06/22/2025

Last Reviewed On: 08/11/2026 | Last Updated On: 08/11/2026

Croatia, Mali, and Tanzania Removed; Bolivia and Virgin Islands (UK) Added: FATF Grey List June 2025 Update

On 13^th June 2025, the Financial Action Task Force (FATF) concluded its second Plenary. During this Plenary, Croatia, Mali, and Tanzania were removed from the Grey List countries while Bolivia and The Virgin Islands (UK) were added to the FATF Grey List countries, 2025.

FATF is a global leader in efforts against financial crimes such as Money Laundering (ML), Terrorism Financing (TF), and Proliferation Financing (PF). FATF conducts extensive research on these financial crimes and sets international standards on Anti-Money Laundering (AML), Combatting the Financing of Terrorism (CFT), and Counter Proliferation Financing (CPF). Its primary mandate is to lead and encourage international efforts for the mitigation of ML/TF and PF.

FATF releases a list of “Jurisdictions under Increased Monitoring” colloquially known as the FATF Grey List. This is a list of countries with strategic deficiencies in their AML/CFT/CPF regimes that are actively working with the FATF to address these deficiencies.

To know about the FATF Grey List Update History, check out our blog here.

To understand the differences between FATF Grey List and Blacklist, read our blog here.

Here are the changes FATF made to its Grey List after its latest Plenary:

Updates Made to the Financial Action Task Force (FATF) Grey List on 13th June 2025

Countries Removed from FATF Grey List (Jurisdiction Under Increased Monitoring) on 13th June 2025:

Croatia
Mali
Tanzania

Countries Added to FATF Grey List (Jurisdictions under Increased Monitoring) on 13th June 2025:

Bolivia
Virgin Islands (UK)/BVI

The FATF Grey List as of 13th June 2025: Jurisdictions Under Increased Monitoring as of 13th June 2025

1. Algeria
2. Angola
3. Bolivia
4. Bulgaria
5. Burkina Faso
6. Cameroon
7. Côte d’Ivoire
8. Democratic Republic of Congo
9. Haiti
10. Kenya
11. Laos
12. Lebanon

13. Monaco
14. Mozambique
15. Namibia
16. Nepal
17. Nigeria
18. South Africa
19. South Sudan
20. Syria
21. Venezuela
22. Vietnam
23. Virgin Islands (UK)
24. Yemen

Immediate impact of the FATF Grey List update 13th June 2025 on Regulated Entities:

As a consequence of FATF Grey List June 2025 Update, AML Compliance measures implemented by Regulated Entities need to be revised:

Enterprise- Wide Risk Assessment (EWRA):
Customer Due Diligence (CDD): CDD measures concerning customers or suppliers associated with “FATF defined Jurisdictions Subject to Increased Monitoring”
AML Policies and Procedures:
Recalibrating configuration of AML software solutions

To know more about how the FATF Grey List update triggers changes in a regulated entity’s AML/CFT/CPF compliance process, read our extensive blog on “Impact of FATF Grey List Update on UAE DNFBPs: AML/CFT Compliance Imperatives”

What will be the Implications of FATF Greylisting on the British Virgin Islands (BVI)?

Due to the greylisting of British Virgin Islands (BVI) by FATF, the costs associated with financial transactions originating from and destined to BVI would increase. Further, the businesses would experience slight delays in the processing of transactions by banks as banks and financial institutions adopt a risk-based approach while dealing with high-risk jurisdictions like Virgin Islands (UK).

The obligated entities will have to assess the BVI greylisting impact on its Enterprise-Wide ML/FT risk assessment, take a risk-based approach and align policies and procedures with the revised EWRA.

The reporting entities would also need to change their internal processes in relation to transaction monitoring and customer risk assessment, consequent to the greylisting of BVI.

Further, the BVI-based entities will have to adopt suitable measures to ensure that they have accurate beneficial ownership information about their clients.

How Does Bolivia’s Inclusion on the FATF Grey List Countries 2025 Impact Its Virtual Asset Sector?

The Virtual Asset Sector in Bolivia would be subjected to stringent ML/FT controls consequent to Bolivia’s greylisting by FATF on 13^th June 2025. The government would try to bring in a stringent regulatory framework and stricter supervision of crypto exchanges and crypto assets wallet providers. The obligated entities will have to strengthen their CDD, transaction monitoring, and suspicious transaction monitoring-related controls and have a more comprehensive process for the ultimate beneficial owner identification.

This would result in increased compliance costs for VASPs based out of Bolivia. Banks and financial institutions would adopt a risk-based approach and decide to go for de-risking the relationship.

Due to Bolivia’s inclusion on the FATF Grey List countries 2025, the international businesses dealing with Bolivia in sectors like virtual assets, trade finance, money exchange, and precious metals and stones will reassess their risk, and the Bolivia-based businesses might have to undergo EDD measures.

What Does Removal from the FATF Grey List Mean for Croatia?

Consequent to the removal of Croatia from FATF’s grey list (the list of jurisdictions under increased monitoring), it would benefit Croatia’s economy, and Croatia’s financial institutions will have greater access to international correspondent banking and can resort to relaxed norms around customer due diligence.

The international businesses dealing with Croatia will take a risk-based approach, and they will be exposed to lower compliance risks while dealing with Croatia-based entities. It would make transaction processing faster as there would be reduced customer diligence requirements, and it would improve investor confidence.

Croatia’s successful removal from grey list shows its commitment to following a methodical, transparent, and sustained effort to comply with and implement FATF recommendations.

What should compliance teams do to mitigate risks arising from the greylisting of a country?

Compliance teams should take the following actions to mitigate risks arising out of the greylisting of a country:

Risk Assessment: Review exposure to grey-listed country and update Enterprise-Wide Risk Assessment (EWRA)
Policies & Procedures: Make suitable changes to customer onboarding and screening, as well as enhance due diligence policies and procedures to reflect a country’s new grey list status and the higher risks arising out of it.
Client Communication: Make suitable email templates and KYC templates ready to gather additional information from businesses from grey listed countries.
Ongoing Monitoring: Increase scrutiny of transactions or ownership links involving businesses from grey listed countries.

Don’t Let FATF’s Grey List Update
Catch You Off Guard

AML UAE helps you decode the FATF changes with expert AML services

Share via :

South Africa, Nigeria, Mozambique, and Burkina Faso Off from FATF Grey List October 2025 Plenary

South Africa, Nigeria, Mozambique, and Burkina Faso Off from FATF Grey List: October 2025 Plenary

Published On: 10/25/2025

Last Reviewed On: 08/06/2026 | Last Updated On: 08/06/2026

Executive Summary:

Removed from Grey list: 4 removals — South Africa, Nigeria, Mozambique, Burkina Faso.
Added to Grey List: No new additions.
Blacklist: No change.
Rationale: Progress on AML/CFT frameworks and inter-agency coordination.

South Africa, Nigeria, Mozambique, and Burkina Faso Off from FATF Grey List: October 2025 Plenary

As part of its mandate, FATF periodically provides updates for jurisdictions under their increased monitoring colloquially known as the “FATF Grey List”. This is a list of countries with strategic deficiencies in their AML/CFT/CPF regimes and are actively working with FATF to address these deficiencies.

On 24th October 2025, the last plenary session of the year was concluded by the FATF. It brought significant changes to the status of grey listed countries. South Africa, Nigeria, Mozambique, and Burkina Faso were removed from the FATF Grey List.

The Financial Action Task Force (FATF) is a global watchdog against the crimes of Money Laundering (ML), Terrorism Financing (TF), and Proliferation Financing (PF). FATF undertakes extensive research and sets international standards to combat financial crimes. FATF has issued uniform recommendations on Anti-Money Laundering (AML), Counter Financing of Terrorism (CFT), and Counter-Proliferation of Financing (CPF), for countries. It diligently monitors the compliance of these norms in the domestic AML/CFT/CPF framework of countries around the globe.

Updates Made to the Financial Action Task Force (FATF) Grey List on 24th October 2025

FATF Plenary October 2025: Updates made to FATF greylist mainly include removal of four countries as discussed below.

Countries Removed from FATF Grey List (Jurisdiction Under Increased Monitoring) on 24th October 2025:

FATF removes Burkina Faso from Grey List: 24th October 2025
FATF removes Mozambique from Grey List: 24th October 2025
FATF removes Nigeria from Grey List: 24th October 2025
FATF removes South Africa from Grey List: 24th October 2025

The FATF Grey List as of 24th October 2025: FATF Jurisdictions Under Increased Monitoring as of 24th October 2025

1. Algeria
2. Angola
3. Bolivia
4. Bulgaria
5. Cameroon
6. Côte d’Ivoire
6. Democratic Republic of Congo
8. Haiti
9. Kenya
10. Laos

11. Lebanon
12. Monaco
13. Namibia
14. Nepal
15. South Sudan
16. Syria
17. Venezuela
18. Vietnam
19. Virgin Islands (UK)
20. Yemen

Action Plan for Regulated Entities Consequent to Changes in Financial Action Task Force Grey List dated 24th October 2025

– Conduct Enterprise-Wide Risk Assessment and assess the likelihood of ML/TF risks arising from the exposure to the latest FATF Grey List countries.

– Revise risk matrices to flag

South Africa
Nigeria
Mozambique
Burkina Faso

related profiles to appropriate risk ratings while considering other risk factors applicable.

– Ensure Enhanced Due Diligence (EDD) is applied to the customers or suppliers associated with the “FATF defined Jurisdictions subject to increased monitoring”.

– Update internal AML Policies and Procedures to reflect the material changes of FATF Grey List

– Recalibrate the configuration of AML software solutions in proportion with the FATF Grey List updates

– Ensure that screening and submission of Regulatory Reports capture elevated or diluted risks associated with the Grey-Listed countries and mandate escalation as per the updated list.

– Conduct structured training sessions for the employees to educate them with updated procedures for dealing with the customer.

Grey Lists Changes, Your Vigilance Shouldn’t

AML UAE Helps You to Strengthen Your Compliance Requirements with Every FATF Update

Share via :

DRC, Monaco, Bulgaria, and Côte d’Ivoire Removed from FATF Grey List Countries, 30th October 2026

Key takeaways: FATF Plenary October 2026

Outcome of the FATF Plenary, October 2026

What changed on the FATF grey list in October 2026

Countries added to the FATF grey list on 30 October 2026

Countries removed from the FATF grey list on 30 October 2026

FATF grey list countries in full, as of 30 October 2026

FATF blacklist countries in full, as of 30 October 2026

What the grey list and blacklist mean for UAE firms

What else did the FATF decide at the October 2026 plenary?

What is changing for virtual assets and VASPs?

Why did fraud and scam compounds receive special attention?

What changed in mutual evaluations and the risk-based approach?

Did every grey-listed jurisdiction provide an updated report in October?

Why were the four countries removed?

Why was Bulgaria removed from the FATF grey list?

Why was Côte d’Ivoire (Ivory Coast) removed from the FATF grey list?

Why was the Democratic Republic of the Congo (DR Congo) removed from the FATF grey list?

Why was Monaco removed from the FATF grey list?

How did FATF verify that the four countries were ready for removal?

What can other countries learn from the four successful action plans?

How long were Bulgaria, Côte d’Ivoire, the DRC and Monaco on the FATF grey list?

What does delisting mean for customers, banks and businesses in these four countries?

Does removal make international transfers, banking or trade easier?

What does FATF delisting not change?

What remains to be done after the four countries leave increased monitoring?

What warning did FATF issue to Vietnam in October 2026?

Did the FATF blacklist change in October 2026?

UAE AML compliance: what regulated entities should do now

Does the FATF grey list affect UAE customer onboarding?

Does the October 2026 delisting change EDD for customers linked to the four countries?

What should readers watch after the October 2026 plenary?

FAQs on the FATF grey list update, October 2026

Which countries were added to the FATF grey list in October 2026?

Which countries were removed from the FATF grey list in October 2026?

How many countries are on the FATF grey list now?

Does grey-listing mean sanctions or automatic enhanced due diligence?

When is the next FATF grey list update?

Does delisting automatically remove enhanced checks for a customer?

Did Iran, North Korea or Myanmar leave the blacklist?

What should a UAE AML compliance officer do first after the October 2026 FATF update?

Is Monaco on the FATF grey list?

Is Bulgaria on the FATF grey list?

Is Côte d’Ivoire on the FATF grey list?

Is the Democratic Republic of the Congo on the FATF grey list?

Is Vietnam still on the FATF grey list?

goAML registration guide

goAML Registration Guide: Key Facts

What is goAML in UAE?

What is goAML registration?

Why should you register on UAE FIU goAML portal?

Who should register with goAML system in UAE?

UAE goAML Registration Deadline

What are the documents required for goAML registration in UAE?

How much does it cost to register for goAML?

UAE goAML Registration Type

What are the steps to register on the goAML Portal in UAE?

Stage 1 of goAML Registration: SACM Registration and Obtaining the Secret Key

Stage 2 of goAML Registration: Completing goAML Registration

UAE FIU goAML Registration Approval

What should I do if I do not receive an email OTP for my goAML Pre-registration request?

What if a business in UAE fails to Register in goAML?

Anti Money Laundering Registration and Subsequent Access to UAE goAML Portal

How to register as a “Person” on the UAE goAML Registration Portal?

Registration on goAML Portal as a “New User”

Approval of the “New User” Request by the Compliance Officer on the goAML Portal

Setting Access Rights for Users on the UAE goAML Portal for registered Reporting Entity?

How to disable an active user on the UAE goAML Portal?

I have forgotten my Password for the UAE goAML Portal. How do I reset it?

I have forgotten my Username for accessing the UAE goAML Portal for 2nd Stage registration. How do I retrieve my FIU UAE goAML Login ID?

Do I get UAE FIU goAML Registration Certificate?

What is the UAE FIU goAML Contact Number?

How do I update the changes in the organizational details on the UAE goAML Portal?

How do I deregister from the UAE FIU goAML Portal?

How to access goAML message board?

Five reasons goAML registrations get rejected, and how to avoid them

How to change MLRO in goAML?

FIU UAE goAML Registration Step-by-Step Guide

Download UAE goAML registration guide: UAE Financial Intelligence Unit (FIU)

FIU UAE goAML Registration Step-by-Step Guide: Video