The Financial Action Task Force (FATF) is the intergovernmental body that sets the global anti-money-laundering standard. It passes no laws and licenses no exchange. Its crypto rule, Recommendation 15, asks every country to regulate crypto businesses and to license or register them. Its two public lists, the “grey list” and the “black list”, name countries whose anti-money-laundering systems it considers weak.
This guide uses the statements the FATF issued at the end of its plenary of 28 to 30 October 2026, dated 30 October 2026, and our reading was current on 2 November 2026. The lists change three times a year, so check the date before relying on any membership you see elsewhere.
What is the FATF, and why does it matter for crypto?
The FATF is a 40-member body, established in 1989 and based in Paris. It describes itself as a policy-making body that works to generate the political will for national legislative and regulatory reforms. More than 200 countries and jurisdictions have committed to implement its Standards, and nine FATF-style regional bodies (FSRBs) are associate members.
The Standards are the Recommendations, their Interpretive Notes and the Glossary definitions. They set an international standard that countries should implement through measures adapted to their own circumstances, and implementation is assessed through peer reviews called mutual evaluations. That is how the FATF can be behind a rule without having written it: it sets the standard, and each country writes its own law to meet it.
Crypto came inside the standard in October 2018, when the FATF amended Recommendation 15, and in June 2019, when it adopted the Interpretive Note to that Recommendation. Since then the FATF has published a targeted update on crypto implementation every year. For what a crypto business is called under these rules, and how that differs from the EU term, see our guide to VASP and CASP.
What does Recommendation 15 require?
Recommendation 15 is titled “new technologies”. Its crypto paragraph asks countries to make sure that virtual asset service providers (VASPs) are regulated for anti-money-laundering and counter-terrorist-financing purposes, licensed or registered, and subject to effective systems for monitoring compliance. The Interpretive Note adds the detail:
- Risk assessment. Countries identify, assess and understand the money laundering, terrorist financing and proliferation financing risks of crypto activity, and apply a risk-based approach.
- Licensing or registration. VASPs must at least be licensed or registered where they are created. A VASP that is a natural person registers where their place of business is. A country may also require registration from providers that serve customers in, or operate from, its territory. Countries must act against people carrying out VASP activity without a licence.
- Supervision. A competent authority, not a self-regulatory body, supervises VASPs on a risk basis, with powers to inspect, compel information, sanction and withdraw a licence.
- Preventive measures. Recommendations 10 to 21 apply to VASPs. Customer due diligence applies to occasional transactions above USD or EUR 1,000, and Recommendation 16 becomes the Travel Rule, which requires the sending VASP to obtain and pass on originator and beneficiary information.
- Sanctions and cooperation. Penalties must reach directors and senior management, and supervisors must share information with foreign counterparts.
The FATF’s July 2026 update adds one point that matters for a site about restrictions: prohibition is permitted under the FATF Standards, but its effectiveness depends on strong supervision and enforcement. The FATF reports that countries taking that route struggle to find and sanction illegal activity, and they are assessed like any other: six jurisdictions that fully or partly prohibit crypto have been rated largely compliant. Of 33 jurisdictions taking a prohibition approach, 21 prohibit crypto and its providers fully and 12 partly.
How do the grey list and black list work?
Both lists come from a process that began in 2007 and is overseen by the FATF’s International Co-operation Review Group. A jurisdiction is reviewed when it is nominated by a member or a regional body, when it does not take part in a regional body, or when its mutual evaluation went badly. The stated thresholds include 20 or more non-compliant or partially compliant technical ratings, or such ratings on three or more of Recommendations 3, 5, 6, 10, 11 and 20. Recommendation 15 is not one of those six.
The FATF publishes two statements at the end of each plenary, in February, June and October. The two lists are different in kind:
- Grey list. The formal name is “jurisdictions under increased monitoring”. The country has committed to an action plan with deadlines to fix named weaknesses and reports on progress.
- Black list. The formal name is “high-risk jurisdictions subject to a call for action”. The FATF calls on countries to apply enhanced due diligence and, in the most serious cases, countermeasures.
A jurisdiction leaves a list when it has addressed all or nearly all of its action plan, an on-site visit confirms that the reforms are being carried out, and a plenary decides to remove it. The four removals in October 2026 followed that path.
Which countries are on the lists now?
On 30 October 2026 the grey list names 18 jurisdictions and the black list names 3. The map also marks the four jurisdictions removed at the same plenary. Select a country for its detail.
A few details from the statements are worth reading closely.
- The FATF has escalated its language on Vietnam. All of Vietnam’s deadlines expired in May 2025. The statement expresses significant concern about the pace of progress and says the FATF expects tangible improvements by February 2027 or will consider next steps. One of Vietnam’s ten outstanding items is taking action to regulate virtual assets and VASPs. See our Vietnam page.
- Three grey-list action plans mention VASPs. Vietnam’s, the Virgin Islands (UK) (risk-based supervision of VASPs) and Iraq’s (a legislative framework for VASPs, which the statement abbreviates as VSAPs). Bulgaria’s removal also cites market entry controls for VASPs. The other grey-list statements do not mention crypto.
- Not every grey-list statement is fresh. The FATF says Bosnia and Herzegovina, Haiti, Iraq and Yemen chose not to report this cycle, so their earlier statements are reprinted and may not reflect the latest status. Bosnia and Herzegovina, Haiti and Iraq carry June 2026 text, and Yemen carries text from February 2023. Syria’s printed text is also labelled February 2023, although the FATF lists Syria among the countries reviewed since June 2026.
- Syria and Yemen are listed despite finished plans. The FATF determined in June 2014 that each had substantially addressed its action plan at a technical level, but it has been unable to hold the on-site visit because of the security situation.
- Myanmar is the only black-list country asked for enhanced due diligence rather than countermeasures. The statement also asks Myanmar to address fraud and cyber scam activity, which it says remains extensive.
The detail of every grey-list entry is in the table below. Sort by commitment date to see which cases are oldest.
What does a listing mean for exchanges and users?
The statements say what the FATF asks of other countries. They do not name exchanges, and no FATF text tells a platform what to do at a withdrawal screen. The consequences come through national law and through each firm’s own policy, so they differ by country and by platform.
Grey list. The FATF says it does not call for enhanced due diligence on these jurisdictions. It encourages members to take the information into account in their risk analysis. It says its Standards do not envisage derisking, meaning cutting off entire classes of customers, and call for a risk-based approach instead. It also asks that flows of funds for humanitarian assistance, legitimate non-profit activity and remittances are not disrupted or discouraged. A platform that blocks a whole grey-list country is therefore applying its own policy, not a FATF requirement.
Black list. Recommendation 19 says financial institutions should apply enhanced due diligence to business relationships and transactions with persons and institutions from countries where the FATF calls for it, and that countries should be able to apply countermeasures when called on to do so. The Interpretive Note to Recommendation 15 applies Recommendations 10 to 21 to VASPs, so this reaches crypto businesses too. For Iran, the FATF’s list of countermeasures speaks of VASPs directly: refusing or prohibiting VASP branches and representative offices, limiting business relationships and transactions, virtual asset transactions included, on a risk basis, and barring new correspondent relationships with VASPs in the country.
Platform policy. Some platforms write the list into their terms. The MEXC user agreement, last updated 13 October 2026, includes any country the FATF identifies as subject to a call for action among its prohibited jurisdictions, alongside countries under comprehensive EU or OFAC sanctions, and says its list is non-exclusive. It names the black list, not the grey list.
Two limits apply. First, neither list is a sanctions list. The FATF calls on countries to act, and what a country does is set in its own law. Sanctions screening is a separate check that often runs beside it. Second, a listing is context, not an access status. In our dataset a restriction is recorded by what a platform or law actually does in a country, with a primary source, so a country’s presence on a FATF list does not by itself change a row. To see what applies on a platform in a given country, use the restriction explorer.
How does the FATF rate countries on crypto rules?
The FATF measures each country against Recommendation 15 in its mutual evaluations and follow-up reports. A mutual evaluation is a peer review by the FATF or a regional body, and it gives each Recommendation one of four technical compliance ratings: compliant, largely compliant, partially compliant or non-compliant. Under the new round, countries also receive a time-bound roadmap of key actions to complete within three years.
As of April 2026, 149 jurisdictions had been assessed on the crypto requirements. Only one is fully compliant. Largely compliant rose from 40 of 138 in 2025 to 51 of 149, and non-compliant went from 29 to 33.
The rating is built from nine criteria, from the risk assessment (15.3) to international cooperation (15.11). The weak points in the 2026 results are licensing and risk assessment: only 59 of 149 jurisdictions (40 percent) were rated met or mostly met on requiring VASPs to be licensed or registered, and only 48 of 149 on risk assessment. The FATF’s separate survey, which 147 of the 205 members of its network answered, found that 83 percent of surveyed jurisdictions have passed Travel Rule legislation, up from 73 percent in 2025.
A poor crypto rating does not itself put a country on a list. Recommendation 15 is not among the six Recommendations in the review trigger, although it counts toward the overall tally of weak ratings. The link in practice is indirect: when a country is on the grey list, crypto gaps can appear in its action plan, as they do for Vietnam.
What comes next for crypto at the FATF:
- A targeted review. The October 2026 plenary agreed to launch a targeted review and accelerated follow-up for jurisdictions with materially important virtual asset sectors, using objective criteria. Results are due in June and October 2027.
- The market in scope. The FATF says jurisdictions with materially important VASP activity make up about 97 percent of the global virtual asset market.
- New evaluations. The plenary adopted the mutual evaluation reports of Mexico and the United States, to be published in December 2026.
Common questions about the FATF
Is the FATF grey list the same as a sanctions list?
No. The grey list is a public statement that a country has committed to fix named weaknesses, and the FATF asks for risk-based attention, not for blocking. Targeted financial sanctions are a separate part of the Standards (Recommendations 6 and 7) and are set by governments and the UN Security Council.
Are the United States, the United Kingdom or Russia on the lists?
None of them is named on either 30 October 2026 statement. Russia’s FATF membership remains suspended, a step taken on 24 February 2023, and the plenary confirmed that the suspension stands. Suspension is a membership matter and is separate from the lists.
Does a grey-list country ban crypto?
The listing does not say whether crypto is legal there. The lists concern gaps in a country’s anti-money-laundering system. Each country’s crypto rules are a separate matter and sit in our country pages, for example Kenya, Vietnam and Venezuela.
How often do the lists change?
At each plenary, in February, June and October. The next plenary falls in February 2027, when the FATF expects progress from Vietnam and Myanmar.
Why do exchanges ask more questions about some countries?
The FATF standard asks providers to take a risk-based approach and to apply enhanced due diligence where the FATF calls for it. Beyond that, the questions come from national law and a firm’s own risk policy. For the transfer-level checks, see the Travel Rule guide.
How do we use FATF lists on this site?
We treat a FATF listing as context for a country, never as a status on its own. The date and plenary of any list we quote are stated, and we do not mix lists from different statements. Rows in our dataset still rest on a platform’s own documents, a regulator’s text or our geo-access test, and our methodology explains how each status is sourced and dated.
