Breaking: FATF Just Updated Its Grey List on June 2026. Here Is What UAE Businesses Must Do Immediately
On 19 June 2026, the Financial Action Task Force concluded its June Plenary in Paris and issued its latest FATF grey list update UAE 2026, adding Iraq and Bosnia and Herzegovina to the jurisdictions under increased monitoring list and removing Algeria and Namibia. The FATF black list remains unchanged, covering Iran, North Korea, and Myanmar.
This is the second FATF grey list update in 2026. On 13 February 2026, Kuwait and Papua New Guinea were added to the grey list, a development that many UAE businesses have yet to incorporate into their AML frameworks.
For UAE financial institutions, Designated Non-Financial Businesses and Professions (DNFBPs), and Virtual Asset Service Providers (VASPs), both updates are immediate compliance triggers. Under Federal Decree-Law No. 10 of 2025 and Cabinet Resolution 134 of 2025, every regulated entity in the UAE must incorporate changes to the FATF grey list into its enterprise-wide risk assessment (EWRA), country risk model, customer risk scoring, and transaction monitoring systems without delay.
This guide explains exactly what the FATF grey list update UAE 2026 means, what changed in both February and June 2026, what the difference between the grey list and blacklist is, and precisely what your business must do right now, broken down by sector.
What Is the FATF Grey List? A Plain-Language Explanation
The FATF grey list is the informal name for the Financial Action Task Force’s list of jurisdictions under increased monitoring. These are countries that have strategic deficiencies in their systems to counter money laundering, terrorist financing, and proliferation financing but have committed at a high political level to fix these deficiencies within agreed timeframes. FATF monitors their progress and updates the list three times a year, at its February, June, and October Plenaries.
Understanding the FATF grey list in simple terms requires separating two common misconceptions:
Misconception 1: Grey-listing means sanctions.
It does not. The FATF grey list is not a sanctions list. Grey-listed countries can continue international trade and banking. The listing is a risk signal, not a prohibition.
Misconception 2: Grey-listing automatically triggers enhanced due diligence.
It does not. FATF explicitly does not call for enhanced due diligence to be applied to a jurisdiction solely because it is grey-listed, and it discourages indiscriminate de-risking. Grey-list status is an input into a firm’s risk assessment, not an automatic trigger for enhanced measures.
What grey-listing requires of UAE-regulated entities is a structured, risk-based response: updating country risk models, reviewing customer and counterparty risk ratings where exposure exists, and applying enhanced due diligence where the firm’s own risk assessment supports it.
The FATF blacklist, formally called High-Risk Jurisdictions subject to a Call for Action, is a different matter entirely. For countries on the blacklist, the FATF calls on all members to apply enhanced due diligence and, in the most severe cases, to impose countermeasures to protect the international financial system. As of 19 June 2026, only Iran, North Korea, and Myanmar are on the FATF blacklist. The FATF blacklist countries’ due diligence requirements are mandatory, not risk-based.
FATF Grey List Update June 2026: What Changed on 19 June
The June 2026 FATF Plenary, held in Paris under the outgoing Mexican Presidency of Elisa de Anda Madrazo, made the following changes to the jurisdictions under the increased monitoring list:
Added to the FATF Grey List June 2026
Iraq has been added to the FATF grey list following the conclusion of its mutual evaluation. Iraq FATF grey list 2026 is particularly significant for UAE businesses given the volume of UAE-Iraq trade, the presence of Iraqi nationals as clients of UAE financial institutions and DNFBPs, and Iraq’s proximity as a major cross-border payment corridor. UAE businesses with client exposure to Iraq, including real estate agents, gold traders, exchange houses, banks, and corporate service providers, must treat this as a priority review trigger.
Bosnia and Herzegovina has been added following the identification of deficiencies in its AML/CFT regime. Bosnia and Herzegovina’s 2026 FATF grey list carries less direct commercial relevance for most UAE businesses than Iraq’s does. Still, entities with European correspondent banking relationships or clients from the Western Balkans should reassess their country risk exposure accordingly.
Removed from the FATF Grey List June 2026
Algeria has been removed from the grey list following satisfactory completion of its FATF action plan, supported by MENAFATF. FATF grey list in 2026 is positive news for UAE businesses with Algerian client exposure. Existing EDD applied based on grey-list status should be reviewed, and risk ratings recalibrated downward where the firm’s own assessment supports such a move. This does not mean automatic removal of enhanced measures; a documented risk-based assessment must support the re-rating.
Namibia has been removed from the grey list following progress in its AML/CFT reforms, supported by ESAAMLG. FATF grey list Namibia removed 2026 similarly requires a structured review of any Namibia-related customer risk ratings, and EDD applied on grey-list grounds.
Current FATF Grey List 22 Jurisdictions as of 19 June 2026
The FATF grey list now includes 22 jurisdictions under increased monitoring. The complete current list includes: Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Côte d’Ivoire, Democratic Republic of the Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the Virgin Islands (UK), and Yemen.
FATF Grey List Update February 2026: What Many UAE Businesses Have Still Not Acted On
The February 2026 FATF Plenary, concluded on 13 February 2026, made two additions that many UAE-regulated entities have not yet fully incorporated into their compliance frameworks:
Kuwait was added to the FATF grey list in February 2026. UAE is the most commercially significant addition of the entire 2026 cycle for UAE businesses. Kuwait is a major Gulf trading partner, a source of significant real estate investment in Dubai and Abu Dhabi, and the nationality of many UAE-based clients across financial institutions and DNFBPs. Any UAE business with Kuwaiti client exposure, including real estate agents, auditors, legal consultants, CSPs, exchange houses, and banks, that has not yet updated its country risk model and customer risk ratings for Kuwait is in breach of its AML obligations under Federal Decree-Law No. 10 of 2025.
Papua New Guinea was added to the grey list in February 2026. Papua New Guinea is less commercially relevant for most UAE businesses, but still requires an assessment of any existing exposure and a documented rationale confirming whether enhanced measures are warranted.
What Is the Difference Between the FATF Grey List and Blacklist?
The FATF grey list vs blacklist difference UAE businesses need to understand is fundamental to applying proportionate compliance measures:
FATF Grey List | FATF Blacklist | |
Official name | Jurisdictions under Increased Monitoring | High-Risk Jurisdictions Subject to a Call for Action |
Meaning | Strategic AML/CFT deficiencies are actively being worked on | Serious strategic deficiencies and no satisfactory cooperation |
EDD required? | No risk-based assessment required | Yes, mandatory EDD for all members |
Countermeasures? | No | Yes, for the highest risk blacklist countries |
Current countries (June 2026) | 22 jurisdictions | Iran, North Korea, Myanmar |
Updated | 3 times per year | 3 times per year |
UAE business obligation | Update EWRA, country risk model, review affected clients | Apply mandatory EDD and countermeasures |
The critical distinction for UAE compliance: grey-list status feeds your risk-based framework as an input; it does not automatically change what you do with every client from that country. Blacklist status covering Iran, North Korea, and Myanmar triggers mandatory enhanced due diligence UAE obligations regardless of individual client risk assessment.
Does the FATF Grey List Update Mean You Must Apply EDD Automatically?
No, and this is the most important nuance in the FATF grey list update UAE 2026 for compliance officers to communicate to senior management and frontline staff.
FATF explicitly discourages indiscriminate de-risking in response to grey-list changes. Automatically refusing business or applying a blanket EDD to all clients from a newly grey-listed country without a supporting risk-based assessment is not compliant with the risk-based approach mandated by Federal Decree-Law No. 10 of 2025 and Cabinet Resolution 134 of 2025.
EDD requirements for FATF grey list countries UAE are triggered when your firm’s own risk assessment informed by the grey-list status rates a specific client relationship, transaction, or counterparty as higher risk. The grey-list status is one input into that assessment. Other inputs include the client’s specific country of residence or operations, the nature and purpose of the business relationship, the transaction type and value, the source of funds, and the presence or absence of other risk indicators.
What you must do is:
- Update your country risk model to reflect the new grey-list status of Iraq, Bosnia and Herzegovina, Kuwait, and Papua New Guinea.
- Review customer risk ratings for clients with material connections to these jurisdictions.
- Apply enhanced due diligence where the updated risk rating supports it, not blanket EDD for every client from these countries.
- Re-rate Algeria and Namibia downward following their removal and document the rationale.
- Document everything; the rationale for your risk-based decisions must be evidenced.
Need urgent support implementing the FATF grey list update action plan for your business?
AMLUAE provides same-week AML/CFT Health Checks assessing your current country risk framework against both the February and June 2026 FATF grey list updates.
How the FATF Grey List Update Affects UAE Businesses by Sector
Banks and Financial Institutions
For UAE banks and exchange houses, the FATF grey list update June 2026 requires immediate action across four areas. First, country risk models and transaction monitoring rules must be updated to reflect Iraq and Bosnia and Herzegovina as higher risk. Second, correspondent banking relationships with institutions in newly grey-listed jurisdictions require EDD review under the CBUAE’s April 2026 correspondent banking guidance. Third, cross-border payment corridors through Iraq and Bosnia must be flagged for enhanced monitoring. Fourth, any existing customers from Kuwait who were grey-listed in February 2026 and whose risk ratings have not been updated since then must be prioritized for immediate review.
Real Estate Agents and Brokers
The FATF grey list impact on UAE real estate agents is significant, particularly given the volume of Kuwaiti and Iraqi investment in UAE property. Under Federal Decree-Law No. 10 of 2025, real estate agents must conduct CDD on all transaction parties and verify the source of funds. Where a buyer, seller, or beneficial owner has material connections to Iraq, Kuwait, Bosnia, or Papua New Guinea, the grey-list status must inform, though not automatically determine, the level of due diligence applied. Real estate agents who have not updated their country risk assessments for Kuwait since February 2026 may already be in breach.
Gold Traders and Dealers in Precious Metals
The FATF grey list’s impact on UAE gold traders primarily relates to cross-border payment flows and supplier relationships. Iraq is a significant counterparty in the regional precious metals trade. The grey-listing of Iraq requires gold traders and dealers in precious metals and stones (DPMS) to review any existing relationships with Iraqi counterparties, update their transaction monitoring to flag Iraq-linked flows, and apply enhanced scrutiny to cash-based transactions involving Iraqi clients.
Corporate Service Providers and Company Formation Agents
Corporate service providers (CSPs) and company formation agents face particular exposure due to Kuwait’s grey-listing. Kuwait-registered holding structures, Kuwaiti beneficial owners, and Kuwaiti-directed corporate formations in the UAE are all common. Every CSP that has not updated its UBO identification and CDD risk ratings for Kuwaiti clients since February 2026 requires immediate remediation.
Exchange Houses
Exchange houses are among the most directly affected by Iraq’s grey listing, given the volume of remittances between the UAE and Iraq. Iraq-UAE remittance flows are among the largest in the Gulf region. Exchange houses must update transaction monitoring thresholds and alert rules for Iraq-linked transactions, review existing Iraqi customer risk ratings, and apply enhanced due diligence where the updated risk assessment supports it.
Free Zone Companies DIFC, ADGM, JAFZA, DMCC, Meydan
FATF grey list UAE DIFC ADGM 2026 obligations apply equally to free zone businesses. The DFSA updated its AML Module in March 2026, requiring DIFC firms to maintain current FATF grey list exposure in their risk frameworks. The FSRA issued Notice No. 40 of 2026, requiring ADGM-regulated entities to update their high-risk country lists and due diligence procedures in light of changes to the FATF list. All free zone businesses across JAFZA, DMCC, Meydan, and all UAE commercial free zones must treat both the February and June 2026 FATF grey list updates as compliance triggers under their federal AML/CFT obligations.
What Does the FATF Grey List Mean for Your Business: A Step-By-Step Action Plan
Here is the complete AML compliance grey list update action plan UAE businesses must follow in response to the June and February 2026 FATF grey list updates:
Step 1: Update your country risk model immediately.
Refresh your country risk model to reflect Iraq and Bosnia and Herzegovina as higher risk (added June 2026) and re-rate Algeria and Namibia as lower risk (removed June 2026). If you have not already done so, update your model for Kuwait and Papua New Guinea (added February 2026). Document the date and rationale for each change.
Step 2: Update your Enterprise-Wide Risk Assessment (EWRA)
Your EWRA must be updated to reflect the new grey-list composition. Under Cabinet Resolution 134 of 2025, the business-wide risk assessment is a living document; it must be revised when material risk indicators change. A FATF plenary update is a material risk indicator. Record the update date and the specific changes made.
Step 3: Review customer risk ratings for affected jurisdictions
Identify all clients with material connections to Iraq, Kuwait, Bosnia and Herzegovina, and Papua New Guinea, including nationality, country of residence, business operations, source of funds, UBO location, and counterparty location. For each identified client, assess whether the updated country risk rating changes their individual customer risk rating. Document the review outcome and rationale.
Step 4: Update sanctions and name screening
Confirm that your sanctions screening UAE systems are updated with the current FATF grey list and blacklist. Ensure country risk scoring in your screening tools reflects the June 2026 plenary changes. Run a retrospective screening pass for any clients from newly grey-listed jurisdictions if their last screening pre-dates the listing.
Step 5: Apply EDD where risk assessment supports it.
For clients whose updated risk rating warrants enhanced due diligence EDD UAE based on their individual risk profile informed by grey-list status, apply EDD proportionate to the risk. For clients whose risk rating remains low or medium despite grey-list country connections, document the risk-based rationale for not applying EDD. Do not apply blanket EDD that indiscriminately de-risks UAE AML, which is itself a compliance failure.
Step 6: Update transaction monitoring rules
Update transaction monitoring rules and alert thresholds for Iraq-linked and Kuwait-linked flows. Senior management escalation grey list procedures should be updated to reflect the new grey-list jurisdictions. For exchange houses and trade finance operations, add Iraq and Kuwait to enhanced monitoring queues.
Step 7: Update your AML policy and procedures.
Your AML policy update grey list UAE must reference the current FATF grey list composition and your firm’s response framework. Policies that reference grey-list countries by name or list must be updated. Policies that reference FATF monitoring lists by process requiring periodic updates must be actioned now.
Step 8: Brief and train relevant staff
AML training UAE FATF updates are mandatory for any staff whose duties involve client onboarding, transaction processing, CDD, or risk assessment. Frontline and compliance teams must understand which jurisdictions have changed, the compliance implications, and how to handle affected client relationships consistently. Training records must be documented.
Step 9: Update regulatory reporting workflows
Confirm that your regulatory reporting procedures in the UAE, including STR filing through the goAML portal, reflect the updated grey-list risk landscape. If any existing suspicious activity involving clients from newly grey-listed jurisdictions has not yet been reported, assess and act on it urgently.
Step 10: Document everything and review at the next FATF Plenary
Record all actions taken: country risk model update, EWRA update, customer reviews, screening updates, policy changes, and training delivery, with dates and responsible individuals. Schedule a calendar reminder for the October 2026 FATF Plenary, when the grey list will be updated next.
New FATF President July 2026: What UAE Businesses Should Know
The June 2026 Plenary was the final one under the Mexican Presidency of Elisa de Anda Madrazo. From 1 July 2026, Giles Thomson of the United Kingdom becomes FATF President with stated priorities on fraud, the risk-based approach, and information sharing. Vivek Aggarwal has been appointed as Vice President.
For UAE businesses, the new FATF President’s 2026 priorities signal what the next assessment cycle will focus on:
Fraud
Fraud-related money laundering is expected to receive greater attention from the FATF under Thomson’s presidency. UAE businesses, particularly those in financial services and digital payments, should review their integration of fraud and AML typologies.
Risk-based approach
The new FATF President’s focus on the risk-based approach reinforces the message that blanket de-risking is not acceptable. UAE regulators are expected to align supervisory messaging with this priority.
Information sharing
Cross-border information sharing between FIUs and financial institutions is a priority. UAE businesses should expect greater scrutiny of their STR quality and FIU engagement under this presidency.
Other Key Outcomes from the June 2026 FATF Plenary
Beyond the grey list changes, the June 2026 Plenary produced several other outcomes relevant to UAE-regulated entities:
FATF Recommendation 6 update
FATF updated its guidance on targeted financial sanctions related to terrorism and proliferation financing, including UN Security Council Resolutions 2664 on humanitarian exemptions and 2761. UAE businesses must ensure their sanctions frameworks reflect the latest UNSC guidance.
FATF Recommendation 16 consultation
FATF is consulting on updates to cross-border payment transparency requirements. Cross-border payment transparency FATF developments are particularly relevant for UAE exchange houses, banks, and payment service providers. UAE businesses should monitor developments under this consultation.
FATF mutual evaluations
The Plenary discussed mutual evaluation outcomes for Canada and Türkiye, providing useful typology intelligence for UAE businesses with exposure to these jurisdictions.
How AMLUAE Helps UAE Businesses Navigate FATF Grey List Updates
Every FATF Plenary update is a compliance trigger that requires action, not a news item to note and file. At AMLUAE, we help UAE financial institutions, DNFBPs, and VASPs respond to FATF grey list updates with structured, documented, and regulator-ready compliance actions:
AML/CFT Risk Assessment Report: Updated for both the February and June 2026 FATF grey list changes, covering all 22 current jurisdictions under increased monitoring and incorporating the latest country risk data into your enterprise-wide risk assessment.
AML/CFT Policy & Documentation: Updated to reflect the current FATF grey list composition, your firm’s country risk response framework, and your EDD trigger criteria for grey-listed and blacklisted jurisdictions.
AML/CFT Health Check: Assesses whether your current country risk model, EWRA, customer risk ratings, and screening systems have been updated in response to the February and June 2026 FATF grey list changes, and identifies any gaps before your next regulatory inspection.
In-House AML Compliance Setup: Builds a comprehensive compliance framework with built-in processes for responding to FATF grey-list updates, including country risk model management, EWRA update procedures, and staff training protocols.
AML Training Program: Role-based AML training UAE covering the latest FATF grey list update June 2026, what it means for frontline and compliance staff, and how to handle affected client relationships consistently.
Regulatory Reporting Services: End-to-end management of STR and SAR filing obligations, ensuring that any suspicious activity related to clients from newly grey-listed jurisdictions is reported accurately and on time through the goAML portal.
AML Software: Real-time sanctions screening UAE and country risk scoring tools that automatically incorporate FATF grey list and blacklist updates, eliminating the manual update burden and reducing the risk of screening gaps between Plenary cycles.
We serve financial institutions, DNFBPs, VASPs, and NPOs across Dubai, Abu Dhabi, Sharjah, Ras Al Khaimah, Fujairah, and all UAE free zones, including DIFC, ADGM, JAFZA, DMCC, and Meydan.
Whether you need to update your enterprise-wide risk assessment for the latest FATF grey list update UAE 2026, review your customer risk ratings for Iraqi or Kuwaiti exposure, or prepare for a Ministry of Economy or CBUAE inspection that will scrutinize your grey-list response, AMLUAE has the service that fits exactly where you are.
