FATF Grey List & UAE

In March 2022, the UAE was added to the FATF’s list of Jurisdictions under Increased Monitoring, commonly known as the grey list. For a financial centre that handles hundreds of billions of dollars in trade, investment and financial flows annually, the listing had immediate and far-reaching consequences: tightened scrutiny from foreign regulators, friction in correspondent banking relationships, and a reputational cloud over one of the world’s most active real estate and investment markets.

In June 2024, the UAE was removed from the grey list following a two-year period of intensive regulatory reform. The removal was significant; it reflected genuine structural change in the UAE’s AML/CFT framework rather than a cosmetic compliance exercise. But removal from the grey list does not mean a return to pre-2022 compliance expectations. The infrastructure built to secure delisting remains in place, and regulators, both domestic and international, expect it to be maintained.

This guide explains what the FATF grey list is, how the UAE came to be listed and removed, what the listing meant for businesses operating in and with the UAE, and what compliance teams need to do in the post-removal environment.

1. What Is the FATF Grey List? Definition & Criteria

The Financial Action Task Force (FATF) is the international standard-setting body for anti-money laundering and counter-terrorist financing. Established in 1989 and headquartered in Paris, FATF sets the global AML/CFT standards, the 40 FATF Recommendations, that form the basis of domestic AML legislation in over 200 jurisdictions worldwide.

The FATF grey list identifies countries that have been assessed as having strategic deficiencies in their AML/CFT frameworks and that have made a high-level political commitment to work with FATF to address those deficiencies within agreed timeframes. Listing is a public process: FATF publishes the list after each of its three annual plenaries, along with a statement for each listed jurisdiction identifying the specific deficiencies that must be addressed.

How a Country Gets Listed

• FATF conducts a Mutual Evaluation Report (MER) of the country’s AML/CFT framework, assessing both the technical quality of legislation and the effectiveness of implementation in practice

• Where the MER identifies significant deficiencies, FATF’s International Co-operation Review Group (ICRG) initiates a review process

• The country is given the opportunity to engage with FATF and present an action plan to address the deficiencies

• Where FATF determines that strategic deficiencies remain and a formal action plan is warranted, the country is added to the grey list at the next plenary

• The country works through its action plan under FATF oversight, with progress reviewed at each plenary, until all items are resolved and FATF authorises removal

2. UAE & the FATF Grey List: Recent History and Current Status

The UAE’s journey through FATF’s listing process reflects both the vulnerabilities inherent in its position as a major global financial and trade hub, and the capacity of the UAE government to mobilise a comprehensive reform response when the regulatory and reputational stakes demanded it.

Current Status: June 2024 Onwards

As of June 2024, the UAE is not on the FATF grey list or black list. FATF’s public statement confirmed that the UAE had substantially completed its action plan and demonstrated effective implementation of AML/CFT reforms across the key areas identified in the 2019 Mutual Evaluation.

However, removal from the grey list triggers ongoing FATF follow-up reporting obligations. The UAE will continue to submit regular follow-up reports to FATF documenting the maintenance and further development of its AML/CFT framework. Compliance expectations established during the reform period, for businesses, regulators and financial institutions, remain fully in force.

3. Difference Between FATF Grey List and Black List

A common source of confusion is the difference between the FATF grey list and the FATF black list. They are fundamentally different in nature, severity and consequence.

For practical compliance purposes, the critical distinction is this: grey-listed countries are working with FATF to fix identified problems. Black-listed countries represent a more fundamental risk to the integrity of the international financial system. The compliance response to each should reflect that difference.

4. Business Impact of Grey-Listing (Banking, Correspondent Relationships, Investor Sentiment)

The practical consequences of FATF grey listing extend well beyond the regulatory arena. For businesses operating in or with a grey-listed jurisdiction, the listing triggers a cascade of commercial and operational consequences that flow from the compliance obligations of their counterparties, bankers and regulators.

The De-Risking Problem

One of the most damaging consequences of grey listing is de-risking: the tendency of large international banks to exit relationships with customers, sectors or jurisdictions that they deem too costly or complex to manage under EDD requirements. During the UAE’s grey-list period, several major international correspondent banks either closed accounts held by UAE financial institutions or imposed severe restrictions on UAE-related transactions.

De-risking is widely criticised by FATF and international bodies as a disproportionate response that pushes legitimate financial flows into unregulated channels. But it is a rational commercial response to a compliance burden that large banks, under pressure from their own regulators, find difficult to justify for relationships with grey-listed jurisdiction counterparties.

5. EDD Obligations for Counterparties from Grey-Listed Countries

For compliance teams in UAE-regulated businesses, one of the most operationally significant consequences of FATF grey-listing, whether the UAE’s own listing or that of a counterparty’s jurisdiction, is the enhanced due diligence obligation it triggers.

UAE Regulatory Requirements for High-Risk Country EDD

Cabinet Decision No. 10 of 2019 and the guidance of all major UAE regulators (CBUAE, DFSA, FSRA) require firms to apply enhanced due diligence to customers, transactions and correspondent relationships that involve jurisdictions identified on the FATF grey or black list. Specifically:

• Customers who are nationals of, or resident in, a grey-listed jurisdiction require EDD at onboarding and enhanced ongoing monitoring

• Transactions with counterparties in grey-listed jurisdictions require additional scrutiny, including verification of the transaction purpose and the source of funds

• Correspondent banking relationships with institutions in grey-listed jurisdictions require mandatory EDD, including assessment of the respondent institution’s own AML controls

• Wire transfers to or from grey-listed jurisdictions may require additional originator and beneficiary information beyond the standard travel rule requirements

Applying EDD in Practice for Grey-Listed Country Counterparties

• Identify the customer’s jurisdiction of nationality, residency and primary business activity, all three may be relevant

• Screen against current FATF grey and black lists at onboarding and when the lists are updated (typically three times per year after each FATF plenary)

• Apply EDD measures: senior management approval; source of funds verification; source of wealth documentation for high-value relationships; enhanced transaction monitoring

• Document the EDD rationale and the measures applied in the customer file, regulators expect to see the decision-making process, not just a checkbox

• Review the EDD assessment when the FATF list is updated, a country’s removal from the grey list should trigger a re-assessment of whether EDD remains required on risk grounds

6. How UAE Strengthened Its AML/CFT Regime

The reforms implemented by the UAE between March 2022 and June 2024 were among the most comprehensive and rapid AML/CFT reforms undertaken by any jurisdiction in the FATF process. They covered legislative changes, institutional capacity, enforcement action and private sector compliance.

Legislative and Regulatory Changes

• Amendment of Cabinet Decision No. 10 of 2019 by Cabinet Resolution No. 24 of 2022 to incorporate updated FATF requirements on virtual assets, proliferation financing and the travel rule

• Establishment of VARA (Virtual Assets Regulatory Authority) in Dubai in 2022 as a dedicated regulator for virtual asset service providers

• Strengthening of the beneficial ownership register framework, requiring most onshore and free zone companies to file and maintain accurate UBO information

• Enhanced targeted financial sanctions (TFS) implementation procedures, including faster asset freeze mechanisms and broader screening obligations

• Expansion of the goAML platform with improved STR filing functionality and higher DNFBP adoption rates

Enforcement and Supervision

• CBUAE issued AED 5.6 billion in aggregate fines against eleven banks in 2023, demonstrating willingness to take enforcement action at scale

• Ministry of Economy significantly increased inspection frequency and scope across DNFBP sectors, including real estate, gold and corporate service providers

• Dubai Public Prosecution and AMLSCU increased financial crime prosecutions and asset confiscation actions

• Inter-agency coordination between AMLSCU, CBUAE, DFSA, VARA and MoE improved significantly through formal information-sharing frameworks

Private Sector Engagement

• Mandatory DNFBP registration on the MoE portal, significantly increasing the number of regulated entities within the formal AML supervision perimeter

• Expanded AML training and awareness programmes for real estate brokers, gold dealers, lawyers and CSPs

• Increased adoption of transaction monitoring systems across the banking sector, with CBUAE guidance on minimum standards for automated monitoring

• Enhanced correspondent banking due diligence frameworks across UAE banks, addressing one of the key findings of the 2019 MER

7. What Compliance Teams Must Do Today

The UAE’s removal from the FATF grey list in June 2024 is good news for businesses operating in or with the UAE. But it does not reduce compliance obligations, it validates the framework that has been built and confirms that the elevated standard is now the permanent baseline.

For UAE-Based Regulated Entities

The compliance infrastructure built or upgraded during the grey-list period, transaction monitoring systems, CDD procedures, EDD frameworks, STR filing processes, should be maintained and tested on an ongoing basis. Regulators have invested significantly in their supervisory capacity and will continue to enforce.

For International Firms with UAE Counterparties

Firms that applied EDD to UAE counterparties during the grey-list period should formally update their risk assessments and country risk frameworks to reflect UAE’s removal. This does not mean reducing diligence to a minimum, the UAE remains a high-volume, high-value financial centre with exposure to sectors that carry inherent AML risk, but it does mean that EDD is no longer automatically required solely on the basis of FATF grey-list status.

Ongoing Monitoring of the FATF List

The FATF grey list is a dynamic document. Countries are added and removed at each plenary. Any business that transacts internationally must have a live process for monitoring FATF list updates and adjusting its country risk assessments accordingly. The list that was current when a customer was onboarded may not be current today.