Picture a payment company onboarding a trading firm registered in Sofia. Its parent is a holding company in the British Virgin Islands, and its buyers pay from Algeria. Bulgaria left the FATF grey list on 30 October 2026 and, as an EU member, can never appear on the EU list. The British Virgin Islands sit on both. Algeria left the FATF grey list in June 2026, while the EU still names it.
A rating turns the FATF and EU high risk country lists into one number per country, and an examiner will ask you to trace it to its sources.
What is an AML country risk rating, and which rules ask for one?
An AML country risk rating is a score or tier for each jurisdiction that measures the money laundering, terrorist financing and sanctions risk of business tied to it. It is the geographic factor of a risk based approach, one input to the customer score that also feeds the firm's business wide AML risk assessment.
No rule prescribes a formula, but every major rule names geography. The FATF Recommendations ask firms to assess risk for "countries or geographic areas" alongside customers, products, services, transactions and delivery channels (interpretive note to Recommendation 1, paragraph 12, p. 34). The note to Recommendation 10 gives four examples of higher risk countries: weak AML systems found by credible reviews, sanctions or embargoes, high corruption or crime, and support for terrorism (paragraph 15(b), p. 70).
In the US, the FFIEC BSA/AML manual names the risk categories as "products, services, customers, and geographic locations" and gives its own example: quantify risk by assessing the domestic and international locations where the bank does business.
In the EU, Annex III of the AMLR lists six geographic factors, from FATF monitoring to financial secrecy; it applies from 10 July 2027. UK firms read regulation 33(6) of the Money Laundering Regulations.
Which sources feed a country risk rating, and what does each measure?
Table 1. Public inputs to an AML country risk rating (checked 1 November 2026)
| Input | Publisher | How often | What it measures | Scale | Where to get it |
|---|---|---|---|---|---|
| Call for action ("black list") | FATF | Three times a year | Serious strategic deficiencies; EDD or countermeasures called for | Listed or not; 3 countries | FATF black and grey lists |
| Increased monitoring ("grey list") | FATF | Three times a year | Deficiencies a country has committed to fix | Listed or not; 22 in June 2026, 4 removed on 30 October 2026 | Statement of 19 June 2026 |
| High risk third countries | European Commission | Each delegated act | Deficiencies that threaten the EU financial system | Listed or not; 26 countries | Commission list |
| Basel AML Index | Basel Institute on Governance | Public Edition yearly; Expert Edition quarterly | Vulnerability to money laundering, 17 indicators | 0 to 10; 177 jurisdictions | Basel ranking |
| Corruption Perceptions Index | Transparency International | Yearly | Perceived public sector corruption | 0 (highly corrupt) to 100; 182 countries | CPI 2025 |
| Sanctions programs | OFAC, EU, UK, UN | As measures change | Embargoes and listings tied to a country | From targeted listings to country wide | OFAC programs |
| Financial Secrecy Index | Tax Justice Network | Periodic; last 23 June 2026 | Room for secrecy in law, weighted by market size | Secrecy score 0 to 100 | FSI |
| INCSR Volume II | US State Department | Yearly; 2025 edition latest | Money laundering findings by country | Narrative, no score | 2025 INCSR |
The FATF last changed its lists on 30 October 2026. Its site blocks automated reads and no archive held the October statements on 1 November 2026, so the October line in the 2026 changes below comes from FinCEN's notice of the same day. The notice reports four removals from increased monitoring and names no additions. The call for action list is unchanged: countermeasures on Iran and North Korea, enhanced due diligence on Myanmar.
The Basel AML Index is built for money laundering risk and scores countries on a continuous scale. Its 2025 Public Edition, published on 8 December 2025, ranks 177 jurisdictions by money laundering risk, from Myanmar at 8.18 to Finland at 3.03. Half of its weight sits in the AML framework domain, where FATF evaluation reports alone carry 35 percent. The CPI and the Financial Secrecy Index already sit inside it (methodology).
Adding the countries with the lowest CPI scores again on top counts corruption twice, so give the CPI a small weight or use it to break ties.
How do you combine the inputs into one score?
Start with a few inputs. Put each on the same 0 to 100 scale, weight them, band the result and write down the overrides. complead, formerly Sanction Scanner, made one set of choices for its free AML Country Risk Index: weights of 40 percent for the Basel AML Index, 35 percent for sanctions intensity and 25 percent for FATF status, and four bands, with Low up to 34, Medium from 35, High from 55 and Critical from 75 to 100. The example below borrows them.
These scales are illustrative, not the index's own; set yours and record why.
- Basel AML Index: the 0 to 10 score times 10.
- FATF status: not listed 0, increased monitoring 60, call for action with EDD 85, call for action with countermeasures 100.
- Sanctions intensity: no country program 0, a country program aimed at listed persons 40, sectoral or trade limits 70, country wide embargo 100.
Run the numbers:
- Bulgaria until 30 October 2026: Basel 5.00 gives 50 times 0.40, or 20.0; grey listing gives 60 times 0.25, or 15.0; OFAC runs no Bulgaria program, so sanctions add 0. Score 35.0: Medium, by one point.
- Bulgaria after the October plenary: 20.0 alone. Score 20.0: Low.
- Algeria after 19 June 2026: Basel 6.82 gives 27.3, and the other two inputs add 0. Score 27.3: Low, down from 42.3 while it was grey listed.
The blend gets Algeria wrong for an EU firm, because the EU list still names it. Three overrides follow from the rules above: a country wide embargo sets the top band or prohibited; a call for action country never rates below High; and for EU entities, a country on the EU list never rates below High, because EDD is mandatory there.
Record each run: the source, edition and date of every input, the scales, weights and band edges, each override with its reason, and who approved it. The FATF note to Recommendation 1 asks firms to document assessments "in order to be able to demonstrate their basis".
How should you rate the hard cases?
Countries the FATF removed this year. Bulgaria had been grey listed since October 2023; in June 2026 the FATF found its action plan substantially complete, pending a visit to check the reforms, and it left the list on 30 October 2026. The EU list covers third countries only and the AMLR names Member States as a lower risk factor, so Bulgaria's FATF input drops on that date. Algeria left the grey list on 19 June 2026, yet the Commission still lists it, and its Basel score of 6.82 ranks 15th of 177. Monaco, Côte d'Ivoire and the Democratic Republic of the Congo, removed in October, also stay on the EU list. Lower the FATF input on the plenary date and keep the EU override until a delegated act removes the country.
An offshore center with no Basel score. The British Virgin Islands are on the FATF grey list and, since 29 January 2026, on the EU list, but the Basel Public Edition does not rank them. Holding companies in other offshore centers raise the same gap. Decide in writing how a missing input is filled (the Basel Expert Edition, the FSI or a set default); a silent zero understates the risk.
A sanctions program with a middling Basel score. Cuba scores 5.16 on the Basel index, 91st of 177, while OFAC runs a Cuba program (page updated 15 October 2026). Scored at 100 on sanctions, the blend reaches 55.6, High; a US firm that treats the program as an embargo overrides it to the top.
Countries the index leaves out. Iran, North Korea and Russia have no Basel Public Edition score; Basel excludes Russia because the FATF suspended its membership. With Basel missing and both other inputs at 100, Iran scores 25 plus 35: 60, High. Only the override puts it in Critical.
How often should you refresh country ratings?
Tie the rescore to the inputs. The FFIEC manual sets "no requirement" to update the risk assessment "on a continuous or specified periodic basis", and says assessments are generally updated to include changes in a bank's geographic locations. The triggers:
- FATF plenaries, three a year: a listing or removal moves the FATF input on the plenary date.
- EU delegated acts: the 2026 amendments to Delegated Regulation (EU) 2016/1675 entered into force 20 days after publication. EDD follows that date.
- The Basel Public Edition, once a year: the 2025 data closed on 10 November 2025, while the Expert Edition updates quarterly.
- CPI and FSI releases, which move the tie breakers.
- Sanctions program changes: OFAC dates every program page, and a new country wide measure triggers the override at once.
- National rules: the UK narrowed its EDD list on 30 June 2026.
Country list changes in 2026
- 29 January 2026: Delegated Regulations (EU) 2026/46 and (EU) 2026/83 entered into force, adding Russia, Bolivia and the British Virgin Islands to the EU list and removing Burkina Faso, Mali, Mozambique, Nigeria, South Africa and Tanzania.
- 4 February 2026: Transparency International published the CPI 2025: 182 countries, global average 42.
- 19 June 2026: The FATF added Bosnia and Herzegovina and Iraq to increased monitoring and removed Algeria and Namibia.
- 23 June 2026: The Tax Justice Network updated the Financial Secrecy Index.
- 30 June 2026: UK regulation 33(1)(b) began to cover persons established in "a FATF call for action country"; before, it covered both FATF lists.
- 30 October 2026: The FATF removed Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco from increased monitoring and left the call for action list unchanged (FinCEN's notice).
How does the country rating feed the customer risk score?
The country rating is one factor of the customer risk assessment, beside customer type, product and channel. Score every country a customer touches. Count where it is established, where its owners live, and where its payments go and come from. Take the highest or weight them, and record which.
Some listings force enhanced due diligence whatever the score: Article 18a of the EU directive for countries on the Commission's list, UK regulation 33(1)(b) for a FATF call for action country, and FATF Recommendation 19 where the FATF calls for it. The grey list does not. The FATF's June statement calls for no enhanced due diligence on those jurisdictions and asks every jurisdiction to weigh its findings in risk analysis.
When EDD applies, a high risk country questionnaire collects the file: how the customer is linked to the country, why it does business there, and where its funds and wealth come from. In complead's customer risk assessment and KYC, the policy owner sets the weights and thresholds for country and every other factor and simulates a change on the live portfolio before publishing it. Each rating carries its factors, sources and model version. Overrides need a recorded reason, and every weight change is versioned with who made it and when.
Back to the Sofia trading firm. On 30 October 2026, Bulgaria fell from 35.0, Medium, to 20.0, Low. For an EU payment company, the British Virgin Islands parent and the Algerian buyers still land in High through the EU list override, so the customer stays High, and the file shows which input decided it.
How this page was checked. Every list, score and date was read on 1 November 2026 at its publisher, or in an archived copy where the site refused automated requests (the FATF, FFIEC and EU law sites). The October 2026 FATF outcome comes from FinCEN's notice. Last reviewed: 2 November 2026.
