FATF Shifts Risk Designations While High-Risk Jurisdictions Hold Steady

Key Takeaways

• Four Countries Delisted: Burkina Faso, Mozambique, Nigeria, and South Africa were removed from FATF’s Jurisdictions Under Increased Monitoring following the October 2025 plenary.
• High-Risk Jurisdictions Unchanged: Iran, the DPRK, and Burma remain designated as high-risk, with Iran and the DPRK still subject to FATF countermeasures.
• Two Iran Countermeasures Reaffirmed: FATF again highlighted two specific countermeasures related to prohibiting establishment of financial institution branches and restricting operations involving Iran.
• U.S. Institutions Must Adjust: FinCEN advises financial institutions to incorporate FATF’s updates into risk-based due diligence obligations under 31 C.F.R. § 1010.610(a) and related rules.
• U.S. Restrictions Go Further: Existing U.S. sanctions and FinCEN’s Section 311 measure continue to impose broader prohibitions on Iranian and North Korean financial institutions.

Deep Dive

The global anti–money laundering community saw another shift this fall as the Financial Action Task Force (FATF) updated its lists of jurisdictions with strategic deficiencies. FinCEN, which acts as the United States’ financial intelligence unit, issued a notice on Friday advising U.S. financial institutions to take these changes into account as they review their risk-based controls and international relationships.

The updates stem from the FATF plenary held on October 24, 2025, where the intergovernmental watchdog announced that Burkina Faso, Mozambique, Nigeria, and South Africa had made enough progress to be removed from its list of Jurisdictions Under Increased Monitoring. Their exit is a significant milestone for each country, all of which had been working through FATF action plans to strengthen anti-money laundering, counter–terrorist financing, and counter–proliferation financing (AML/CFT/CPF) systems.

While four countries came off the watchlist, the FATF left its highest-risk category unchanged. Iran, the Democratic People’s Republic of Korea (DPRK), and Burma remain High-Risk Jurisdictions Subject to a Call for Action, meaning they are viewed as posing significant systemic threats to the global financial system.

For Iran, the FATF issued a reminder that jurisdictions are expected to apply countermeasures, including refusing the establishment of Iranian financial institution branches or subsidiaries, and prohibiting their own institutions from setting up operations inside Iran. The FATF highlighted those two specific countermeasures again, underscoring persistent concerns related to proliferation financing.

The call for countermeasures continues for the DPRK as well. Burma, meanwhile, remains subject to enhanced due diligence rather than the full suite of countermeasures imposed on Iran and the DPRK.

What U.S. Institutions Need to Know

FinCEN’s notice reiterates that U.S. institutions must incorporate FATF’s findings into their risk-based due diligence programs, especially obligations tied to correspondent accounts for foreign financial institutions under 31 C.F.R. § 1010.610(a). Institutions are required to maintain controls that can detect and report suspicious activity in these relationships on an ongoing basis.

Money services businesses (MSBs) are reminded of similar requirements when dealing with foreign agents and foreign counterparties, consistent with FinCEN Interpretive Release 2004-1. FinCEN again emphasized a theme it has repeated in recent years, which is that risk-based compliance should not lead to broad, indiscriminate de-risking, especially for classes of customers like foreign embassies or institutions in higher-risk regions.

The advisory also points financial institutions toward their obligations under U.S. sanctions regimes and relevant UN Security Council Resolutions, noting that certain provisions carry direct implications for financial flows tied to high-risk jurisdictions.

The FATF’s global stance aligns with, but is far narrower than, existing U.S. prohibitions involving Iran and the DPRK. U.S. financial institutions are already barred from opening or maintaining correspondent accounts for banks in either country, reflecting a suite of measures that go beyond FATF recommendations.

Those restrictions include:

• Executive Order 13599 and the Iranian Transactions and Sanctions Regulations (31 C.F.R. Part 560), which block property of the Government of Iran and Iranian financial institutions.
• National Security Presidential Memorandum-2, directing maximum-pressure measures against Iran due to its nuclear and missile programs and support for terrorist groups.
• FinCEN’s 2019 designation of Iran as a jurisdiction of primary money laundering concern under Section 311 of the USA Patriot Act, which prohibits U.S. institutions from maintaining correspondent accounts for Iranian financial institutions and bars the use of U.S. correspondent accounts to route transactions involving them.

These measures mean U.S. financial institutions are already operating under a far stricter framework than the one outlined by the FATF. The rules leave little room for ambiguity. U.S. banks cannot open, maintain, or indirectly process correspondent accounts for Iranian or North Korean financial institutions, and attempts to route such activity through foreign banks remain prohibited under the Section 311 rule.

In practice, the FATF’s call for countermeasures largely reinforces a system the United States already has in place, but the true takeaway is less about new obligations and more about ensuring that long-standing sanctions, prohibitions, and due diligence expectations continue to be reflected in day-to-day risk assessments, especially as geopolitical conditions evolve.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.