FATF Grey/Black Lists, AML & High-Risk Jurisdictions: How to Detect Indirect Risk

A company may be registered in a country that is neither sanctioned nor grey-listed and still expose your organisation to sanctions, money laundering or geographic risk.

An EU company, for example, may purchase from a supplier in Türkiye or Kazakhstan without any direct Russia-related match. But further analysis can reveal sanctioned ownership, restricted affiliates, control relationships or other parties deeper in the network that may require additional scrutiny.

This is why monitoring high-risk jurisdictions should go beyond checking a country against the Financial Action Task Force grey list. Compliance teams need to understand the entire corporate and other relevant relationships.

What Is the FATF Grey List?

The Financial Action Task Force (FATF) publishes two main lists of jurisdictions with significant deficiencies in their AML/CFT frameworks.

The FATF grey list, officially called Jurisdictions under Increased Monitoring, includes countries that have committed to addressing identified strategic deficiencies within agreed timeframes.

Being grey listed does not mean that all companies or transactions connected to the jurisdiction are automatically high risk. FATF explicitly states that it does not call for blanket enhanced due diligence or de-risking for grey-list jurisdictions. Instead, organisations should apply a risk-based approach.

Click to learn more👇

The countries commonly referred to as FATF blacklist countries fall under High-Risk Jurisdictions subject to a Call for Action. For these jurisdictions, FATF calls for enhanced due diligence and, in the most serious cases, countermeasures. As of 19 June 2026, this category includes Iran, the Democratic People's Republic of Korea and Myanmar.

FATF updates its high-risk and monitored jurisdiction statements three times a year, so continuous monitoring is essential for any AML geographic risk framework.

A High-Risk Country Is Not Defined by the FATF List Alone

A common compliance mistake is treating the FATF countries list as the complete list of high-risk jurisdictions.

In practice, an AML high-risk country may require additional scrutiny because of sanctions, national regulations, corruption exposure, conflict, weak corporate transparency or connections to other restricted jurisdictions, even if it is not included in the FATF grey list.

Russia is a clear example.

As of June 2026, Russia does not appear on the FATF grey or black list, although its FATF membership remains suspended. At the same time, the EU added Russia to its list of high-risk third countries, with the designation entering into force on 29 January 2026.

A jurisdiction does not need to be grey-listed to create significant compliance risk.

Direct exposure exists when an organisation works with a customer, supplier, bank or other counterparty located in or directly connected to a higher-risk jurisdiction. 

Indirect exposure can arise when such a connection appears further along the ownership, payment or supply chain, for example through a beneficial owner, affiliate, intermediary, distributor, bank or end-user. In practice, this means that a company may have no direct relationship with a high-risk country and still be exposed to relevant sanctions or AML risks.

Red Flags for Indirect Jurisdiction Risk

When a company has links to higher-risk regions, compliance teams should pay particular attention to:

Corporate and Ownership Signals

• ownership or control links involving sanctioned or restricted parties;
• Russia- or Belarus-linked corporate relationships that require further assessment;
• affiliates or intermediaries with unclear roles in the corporate network;
• newly established trading companies with limited operating history.

Trade and Supply-Chain Signals

• intermediaries with no clear commercial purpose;
• unusual or recently changed trade routes;
• mismatches between the buyer, delivery destination and end-user;
• transactions involving sensitive or dual-use goods.

Payment Signals

• payments involving unexpected banks or jurisdictions;
• payment routes that do not align with the stated commercial relationship.

Corporate-network analysis can help identify ownership, control and affiliation risks, while payment, shipment and end-use signals may require additional transactional or trade data.

These indicators do not prove sanctions circumvention on their own. They signal that further due diligence may be necessary.

How to Monitor High-Risk Jurisdictions Effectively

A practical high-risk countries AML framework should combine several layers of information.

Start with the current FATF grey list countries, FATF high-risk jurisdictions and relevant national or regional lists. Then screen the company, directors and beneficial owners against sanctions and other risk datasets.

The next step is crucial: map ownership and corporate relationships beyond the immediate counterparty. 

Second- and third-level connections may reveal exposure that a standard name or country check misses.

Compliance teams should also consider the jurisdictions involved in trade, payments, transit and end-use — and monitor these factors continuously as sanctions, ownership structures and country classifications change.

YC.World helps compliance teams analyse companies together with their ownership and wider corporate networks, allowing them to identify indirect connections that may change the risk assessment. The platform consolidates data from 80+ countries and 350 public sources and visualises relationships between companies and individuals across jurisdictions.

Read more: How YC World Maps Beneficial Ownership Across Jurisdictions in Seconds

Map ownership, affiliates and cross-border connections with YC.World to identify hidden sanctions exposure.

FAQ