What is the difference between FATF’s blacklist and greylist?

How the blacklisting and greylisting lines differ

FATF’s blacklist and greylist are not just different labels, they signal different levels of systemic concern. The blacklist is for jurisdictions with severe strategic deficiencies and a call for countermeasures. The greylist covers jurisdictions under increased monitoring that have committed to fixing weaknesses. That difference affects how strongly counterparties, compliance teams, and regulators should respond.

The practical distinction is the response posture. A greylisted jurisdiction is still in an active remediation track, so organisations usually apply heightened due diligence and closer monitoring. A blacklisted jurisdiction signals a much more serious breakdown in FATF expectations, so the appropriate stance is typically far more restrictive, with stronger controls and, where required, countermeasures rather than routine monitoring.

For a practitioner, the useful test is whether the issue is “monitor and remediate” or “treat as severe strategic deficiency.” That distinction matters because it changes customer onboarding, transaction screening, risk appetite, correspondent banking decisions, and escalation thresholds across the compliance stack. The FATF’s own standards and monitoring process are set out in its FATF Recommendations - AML and KYC Framework.

What the lists mean for compliance and counterparty risk

Greylist status usually means the jurisdiction has identified weaknesses but is cooperating with FATF to address them. That makes it a risk-managed exposure, not a full stop. Blacklist status, by contrast, implies the deficiency is acute enough that normal trust assumptions are no longer acceptable, so controls should move from enhanced monitoring to stronger restriction and formal escalation.

The difference also shows up in how firms document risk. Greylist treatment is often justified by enhanced due diligence, source-of-funds checks, and transaction monitoring that reflect an elevated but still manageable risk. Blacklist treatment should be documented as a higher-risk exception condition, because the risk is not only compliance failure but also exposure to sanctions-like handling, de-risking decisions, and broader reputational impact.

For institutions building control logic, it is useful to separate country risk scoring from the FATF action status itself. A greylist entry is a signal to intensify review; a blacklist entry is a signal that the jurisdiction’s control environment is considered fundamentally deficient until proven otherwise.

Why the distinction matters in day-to-day decision-making

The most common mistake is treating both lists as the same kind of “bad country” alert. They are related, but not equivalent. Greylist status should usually trigger a calibrated response that is consistent with ongoing remediation, while blacklist status should trigger the harshest compliance posture your policy permits.

That distinction matters most in onboarding, payment routing, correspondent relationships, and sanctions-adjacent escalation. If your internal policy does not distinguish between increased monitoring and countermeasures, you will either over-restrict greylisted relationships or under-react to blacklisted ones.

FATF list status should therefore be treated as an input to a broader risk decision, not as the decision itself. The right policy outcome depends on the jurisdiction’s exposure, customer profile, transaction type, and your institution’s tolerance for regulatory and reputational risk.

Practitioner Guidance

What to verify: Verify whether your policy distinguishes between enhanced due diligence for greylisted jurisdictions and restricted or prohibited handling for blacklisted ones. If the same workflow is used for both, the control is too blunt to support risk-based decisions.

Decision rule: If the jurisdiction is greylisted, apply elevated monitoring and documented remediation-aware review; if it is blacklisted, escalate to the most restrictive treatment permitted by policy and legal counsel.

Common mistake: Do not reduce FATF status to a binary “allowed versus disallowed” flag. That shortcut hides the operational difference between a jurisdiction that is still correcting deficiencies and one that is considered strategically high risk.

Practitioner takeaway: The key judgment is not the color of the list, but the action it should force in your control framework, greylist means watch closely and manage through remediation, blacklist means assume materially higher risk and respond with stronger restrictions.

Related resources from NHI Mgmt Group

• What is the difference between attack surface management and NHI governance?
• What is the difference between reviewing human access and reviewing NHIs?
• What is the difference between role-based access and API key governance for NHI security?
• What is the difference between human IAM controls and NHI governance?