FATF grey list after October 2026: what changes for business payments

A company paying an overseas supplier may read the words “grey list” and assume the transfer is forbidden. That shortcut can block a legitimate invoice while failing to catch a truly restricted counterparty elsewhere. The list describes weaknesses in a country's financial-crime controls. It does not decide the legality of each individual payment.

At Soulbit Academy we examine the 30 October 2026 update through the questions a finance team must answer before releasing funds. What is the country's current FATF status? Who is the actual beneficiary? Which laws and controls apply to this channel? Those are separate questions. A sound approval records separate answers rather than merging them into one red or green label.

FATF grey list October 2026: four exits and the remaining jurisdictions

The FATF removed Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco from increased monitoring at its 28 to 30 October 2026 plenary. Its official plenary outcome says successful on-site visits followed completion of the jurisdictions' action plans. Removal is a country-level monitoring decision. It is not a certification of every corporation or financial institution based there.

The body of the 30 October statement on jurisdictions under increased monitoring lists 18 current jurisdictions. Bolivia, Haiti and Venezuela are among them. Their inclusion matters to a Latin American treasury team, but it does not make every transaction connected to them unlawful. A policy should cite the date because the FATF updates its statements after plenaries. An undated spreadsheet is a weak basis for a payment decision.

October decision	Jurisdictions or category	Meaning for a payment team
Leave increased monitoring	Bulgaria, Côte d'Ivoire, Democratic Republic of the Congo, Monaco	Refresh country-risk records; retain counterparty checks
Remain under increased monitoring	Bolivia, Haiti and Venezuela, among others	Apply proportionate risk review without assuming a general ban
High-risk call-for-action list	A separate FATF declaration	Do not transfer the grey-list rule to this more serious category
Individual sanctions	Depend on the applicable authority and measure	Screen payer and payee separately from country status

Why might a removed country still appear in a search result?

Third-party databases can lag behind the FATF decision. Even the metadata tags on the FATF publication still name the four removed countries because the same page describes their exit at the end. To establish current status, read the statement's operative body together with the plenary announcement. Record the document date and the date your team checked it. A cached heading or country tag alone may be misleading.

What increased monitoring by the FATF actually means

FATF increased monitoring means a jurisdiction has committed to address strategic deficiencies in controls against money laundering, terrorist financing and proliferation financing. The arrangement is commonly called the grey list. The FATF and its regional partners monitor progress against an agreed action plan. A listing therefore describes a country's control system and reform commitments, not the conduct of every resident business.

The FATF statement also explains the limits of the label. It does not call for enhanced due diligence automatically on every transaction involving a jurisdiction under increased monitoring. It discourages de-risking, or cutting off entire customer groups. Institutions should instead consider the published information in a risk-based assessment. The FATF specifically asks that legitimate humanitarian, nonprofit and remittance flows not be discouraged by blunt measures. A commercial payment requires the same discipline of looking at the actual circumstances.

The FATF publishes a separate statement on high-risk jurisdictions subject to a call for action. For that category, the organisation calls for enhanced due diligence and, in the most serious cases, countermeasures. Applying those instructions to the grey list would misstate the FATF position. A risk matrix should name the exact category, official source and review date. The distinction should be visible to both compliance and treasury staff.

Does leaving the grey list make every payment safe?

No. Removal means the FATF judged the action plan complete and confirmed implementation through an on-site visit. The paying business must still establish the beneficiary's identity, ownership, activity and purpose. It must also check applicable restrictions and its own internal approval requirements. A country-level decision cannot certify a transaction that has not yet been examined.

Bolivia, Haiti and Venezuela: three entries, different facts

Bolivia, Haiti and Venezuela remain in the 30 October 2026 statement. The three names belong to the same monitoring category, but their FATF action plans and recent reporting differ. Haiti did not report progress for this cycle, so the October publication reproduces an earlier statement. A finance team should not turn these different cases into a generic Latin America risk score. The source date behind each observation matters as much as the current list status.

For Bolivia, the FATF cites risk-based supervision of certain nonfinancial activities, consequences for breaches of beneficial-ownership rules and investigations aligned with national risks. These are concerns about the country's control framework. A company paying a Bolivian supplier still needs to examine the supplier's own documents, the economic purpose and the receiving channel. Our article on stablecoins for companies in Bolivia describes that local commercial context without treating grey-list status as a licence or payment prohibition.

Venezuela is named here only because it appears in the FATF's increased-monitoring statement. Other authorities' laws and sanctions can affect transactions linked to the country. Grey-list status alone is therefore insufficient to assess legality or execution. A specific case requires specialist review of applicable measures. The inclusion should not be turned into an operational payment route or a general assertion that a transaction is allowed.

A useful distinction is between “country listed,” “counterparty under investigation,” and “sanctioned person.” These describe different facts with different legal consequences and different sources. The first informs country-risk assessment. The second calls for review of the particular alert. The third may trigger direct restrictions. If software collapses the three into one warning, the reviewer may lose the evidence needed to defend a decision later.

How to assess a cross-border payment using a risk-based approach

A payment involving a grey-listed jurisdiction needs a documented, proportionate assessment of the actual operation. A blanket approval ignores risk; a blanket refusal ignores the FATF's position. In practice, treasury needs to identify the beneficiary, understand what is being paid for, check applicable restrictions and preserve an authorisation trail. The exact documents depend on the country, transaction and intermediary.

The first control is identity. The legal name, place of incorporation and beneficial owner should match the contract, invoice and receiving account or wallet. The second is commercial purpose. The amount and service description should make sense against the business relationship. The third is the payment channel. The company should know which institution processes the transfer and what information it requires. The fourth is the result of relevant sanctions and adverse-information checks.

Payment stage	Question to resolve	Useful evidence
Counterparty onboarding	Who receives the funds and controls the entity?	Registration, identity and beneficial-ownership records
Commercial purpose	What goods or services are being paid for?	Contract, invoice, delivery record and internal approval
Risk assessment	What do country, sector and channel add to risk?	Dated risk matrix and compliance decision
Execution	What information and restrictions apply to this channel?	Payment instruction, transaction identifier and confirmation
Reconciliation	Did the result match the authorised payment?	Receipt, ledger entry and supporting file

This is an educational workflow, not a universal legal checklist. A high-value or complex operation may require additional records under local law or an intermediary's policy. A company should not use a general table to waive its obligations. It can use the steps to ask complete questions and find gaps before a transfer is due. The goal is to move from an unexplained country label to a review that someone else can reproduce.

Preparation also reduces delays. If a supplier changes its legal name or asks to use an account controlled by another entity, a payment can stop even when the country is not grey-listed. Resolve that discrepancy at onboarding rather than after the transfer is initiated. A counterparty-risk assessment for treasury gives the finance team a place to preserve context across repeated transactions. The risk review should be refreshed when ownership, purpose or route changes.

What should a company update after a FATF plenary changes the list?

Update the country-risk record, its source URL and the date checked. Revisit existing counterparties proportionately instead of labelling them automatically safe or forbidden. If an internal restriction rested solely on inclusion in the list, review its rationale. Tell the people who schedule and approve payments which fact changed and which controls remain. Keep the older version for auditability rather than silently overwriting it.

Grey list, sanctions and Travel Rule are separate checks

The FATF grey list, sanctions lists and the Travel Rule answer different questions. The grey list concerns a jurisdiction's strategic control gaps. Sanctions identify restrictions applicable to a person, entity or activity under a particular regime. The Travel Rule concerns originator and beneficiary information shared by covered virtual-asset service providers under national implementation. None of these checks can stand in for the others.

A person can be sanctioned while living in a country outside the grey list. A legitimate company can operate in a grey-listed country. The article on sanctions-list screening for international payments covers the identity check and the handling of name matches. This article covers country monitoring and the resulting risk assessment. The distinction matters because a sanctions match can have specific legal effects that a grey-list entry does not.

The FATF Travel Rule for crypto payments addresses information that accompanies certain transfers between virtual-asset service providers. Being on the grey list does not change that obligation by itself. The FATF plenary also discussed accelerating implementation of its virtual-asset standards, but that is a separate policy track. The same organisation can publish both statements without making them one rule.

An enhanced-diligence requirement may still arise from local law, a supervisor or an intermediary's internal risk policy, even though the FATF does not impose it automatically for grey-list countries. Ask for the basis of each requirement. Supplying requested evidence is compatible with avoiding an inaccurate statement that all payments are globally banned. Precise language improves both compliance and communication with suppliers.

What Soulbit covers and what remains the company's decision

Soulbit supports company balances in USDC and USDT and fiat in USD, EUR and GBP, with institutional custody and KYB verification. Its scope includes business payments, batch payroll disbursement in stablecoins, quote-based OTC conversion and AML/KYT controls. The local banking rail described for Soulbit is in Colombia. These capabilities are not a universal permission to transfer to every jurisdiction or counterparty.

The company remains responsible for knowing its suppliers and documenting the economic reason for a payment. Its tax, accounting and regulatory obligations also remain its own. Soulbit may request information or pause a transaction during compliance review. No payment technology removes duties imposed on the payer, beneficiary or processing institution. A clear invoice and beneficiary record make that review easier without guaranteeing acceptance.

If a stablecoin is used, reconcile amount, date, asset and destination address against the commercial record. That transaction trail complements identity and provider-information requirements. The guide to reconciling stablecoin payments in accounting explains how to connect the operational evidence to the ledger. A reviewer should be able to follow the payment without relying on someone's memory weeks later.

Recheck the FATF statement after each plenary instead of freezing a policy around an old screenshot. The October exits show how quickly a spreadsheet can age. The usable chain of evidence is straightforward: official source, date, counterparty, purpose and recorded decision. That chain explains why an operation was approved, held for more information or declined.